import re
import mimetypes
import dateparser
from CommonServerPython import *  # noqa: F401

import demistomock as demisto  # noqa: F401

''' GLOBAL VARS '''
ALARM_HEADERS = ['alarmId', 'alarmStatus', 'associatedCases', 'alarmRuleName', 'dateInserted', 'dateUpdated',
                 'entityName', 'alarmDataCached', 'personId', 'eventCount', 'rbpMax', 'rbpAvg']

ALARM_EVENTS_HEADERS = ['commonEventName', 'logMessage', 'priority', 'logDate', 'impactedHostId', 'impactedZone',
                        'serviceName', '', 'entityName', 'classificationName', 'classificationTypeName']

CASE_EVIDENCES_HEADERS = ['number', 'type', 'status', 'dateCreated', 'createdBy', 'text', 'alarm', 'file']

TAG_HEADERS = ['number', 'text', 'dateCreated', 'createdBy']

ENTITY_HEADERS = ['id', 'name', 'fullName', 'recordStatusName', 'shortDesc', 'dateUpdated']

USER_HEADERS = ['id', 'fullName', 'userType', 'firstName', 'lastName', 'recordStatusName', 'dateUpdated',
                'objectPermissions']

LIST_HEADERS = ['guid', 'name', 'listType', 'status', 'shortDescription', 'id', 'entityName', 'dateCreated',
                'owner', 'writeAccess', 'readAccess']

NETWORK_HEADERS = ['id', 'name', 'shortDesc', 'longDesc', 'recordStatusName', 'bip', 'eip', 'entity', 'riskLevel',
                   'dateUpdated', 'threatLevel', 'threatLevelComment', 'hostZone', 'location']

ALARM_STATUS = {0: 'New',
                1: 'Opened',
                2: 'Working',
                3: 'Escalated',
                4: 'Closed',
                5: 'Closed_FalseAlarm',
                6: 'Closed_Resolved',
                7: 'Closed_Unresolved',
                8: 'Closed_Reported',
                9: 'Closed_Monitor'}

CASE_STATUS = {'Created': 1,
               'Completed': 2,
               'Incident': 3,
               'Mitigated': 4,
               'Resolved': 5}

QUERY_TYPES_MAP = {'host_name': {'filter_type': 23, 'value_type': 4},
                   'entity_id': {'filter_type': 136, 'value_type': 2},
                   'source_type': {'filter_type': 9, 'value_type': 2},
                   'username': {'filter_type': 43, 'value_type': 4},
                   'subject': {'filter_type': 33, 'value_type': 4},
                   'sender': {'filter_type': 31, 'value_type': 4},
                   'recipient': {'filter_type': 32, 'value_type': 4},
                   'hash_': {'filter_type': 138, 'value_type': 4},
                   'url': {'filter_type': 42, 'value_type': 4},
                   'process_name': {'filter_type': 41, 'value_type': 4},
                   'object_': {'filter_type': 34, 'value_type': 4},
                   'ipaddress': {'filter_type': 17, 'value_type': 5}}

SOURCE_TYPE_MAP = {
    "API_-_AWS_CloudTrail": 1000598,
    "API_-_AWS_CloudWatch_Alarm": 1000607,
    "API_-_AWS_Config_Event": 1000610,
    "API_-_AWS_S3_Flat_File": 1000703,
    "API_-_AWS_S3_Server_Access_Event": 1000575,
    "API_-_BeyondTrust_Retina_Vulnerability_Management": 1000299,
    "API_-_Box_Event": 1000633,
    "API_-_Cisco_IDS/IPS": 1000025,
    "API_-_Cradlepoint_ECM": 1000600,
    "API_-_IP360_Vulnerability_Scanner": 1000589,
    "API_-_Metasploit_Penetration_Scanner": 1000297,
    "API_-_Nessus_Vulnerability_Scanner": 1000237,
    "API_-_NetApp_CIFS_Security_Audit_Event_Log": 1000238,
    "API_-_NeXpose_Vulnerability_Scanner": 1000296,
    "API_-_Office_365_Management_Activity": 1000645,
    "API_-_Office_365_Message_Tracking": 1000730,
    "API_-_Okta_Event": 1000618,
    "API_-_Qualys_Vulnerability_Scanner": 1000232,
    "API_-_Salesforce_EventLogFile": 1000609,
    "API_-_Sourcefire_eStreamer": 1000298,
    "API_-_Tenable_SecurityCenter": 1000663,
    "API_-_Tenable.io_Scanner": 1000624,
    "Flat_File_-_ActivIdentity_CMS": 1000494,
    "Flat_File_-_Airwatch_MDM": 1000337,
    "Flat_File_-_Alfresco": 1000604,
    "Flat_File_-_AllScripts": 1000734,
    "Flat_File_-_Apache_Access_Log": 1000000001,
    "Flat_File_-_Apache_Error_Log": 80,
    "Flat_File_-_Apache_SSL_Access_Log": 1000000002,
    "Flat_File_-_Apache_SSL_Error_Log": 82,
    "Flat_File_-_Apache_Tomcat_Access_Log": 1000056,
    "Flat_File_-_Apache_Tomcat_Console_Log": 1000465,
    "Flat_File_-_Avaya_Secure_Access_Link_Remote_Access_Log": 1000474,
    "Flat_File_-_Avaya_Voice_Mail_Log": 131,
    "Flat_File_-_Axway_SFTP": 1000372,
    "Flat_File_-_Beacon_Endpoint_Profiler": 1000518,
    "Flat_File_-_Bind_9": 1000084,
    "Flat_File_-_BlackBerry_Enterprise_Server": 164,
    "Flat_File_-_Blue_Coat_Proxy_BCREPORTERMAIN_Format": 1000000006,
    "Flat_File_-_Blue_Coat_Proxy_CSV_Format": 95,
    "Flat_File_-_Blue_Coat_Proxy_SQUID-1_Format": 167,
    "Flat_File_-_Blue_Coat_Proxy_W3C_Format": 1000003,
    "Flat_File_-_Bro_IDS_Critical_Stack_Intel_Log": 1000611,
    "Flat_File_-_Broadcom_SiteMinder": 1000794,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTDS": 1000379,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTEL": 1000386,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTJL": 1000385,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTLL": 1000384,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTNV": 1000383,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTOM": 1000371,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTPW": 1000380,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRL": 1000382,
    "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRV": 1000381,
    "Flat_File_-_CA_ControlMinder": 1000345,
    "Flat_File_-_Cerberus_FTP_Server": 1000417,
    "Flat_File_-_Cerner": 1000422,
    "Flat_File_-_Cisco_AMP_for_Endpoints": 1000744,
    "Flat_File_-_Cisco_Email_Security_Appliance": 1000615,
    "Flat_File_-_Cisco_LMS_(cwcli)": 1000212,
    "Flat_File_-_Cisco_LMS_(Syslog)": 1000207,
    "Flat_File_-_Cisco_NGFW": 1000107,
    "Flat_File_-_Cisco_Secure_ACS_CSV_File": 139,
    "Flat_File_-_Cisco_Security_Agent": 1000094,
    "Flat_File_-_Cisco_Umbrella_DNS": 1000705,
    "Flat_File_-_Cisco_Web_Security_aclog": 1000224,
    "Flat_File_-_Citrix_Access_Gateway_IIS_Format": 1000024,
    "Flat_File_-_Citrix_Access_Gateway_NCSA_Common_Format": 1000023,
    "Flat_File_-_Citrix_Access_Gateway_W3C_Format": 1000022,
    "Flat_File_-_Citrix_Presentation_Server": 1000086,
    "Flat_File_-_Citrix_Secure_Gateway": 1000440,
    "Flat_File_-_ClamAV_Anti-Virus": 1000052,
    "Flat_File_-_ColdFusion_Application_Log": 1000357,
    "Flat_File_-_ColdFusion_Exception_Log": 1000395,
    "Flat_File_-_ColdFusion_Mail_Log": 1000361,
    "Flat_File_-_ColdFusion_Mailsent_Log": 1000360,
    "Flat_File_-_ColdFusion_Server_Log": 1000355,
    "Flat_File_-_Cornerstone_Managed_File_Transfer": 1000374,
    "Flat_File_-_Coyote_Point_Equalizer": 1000214,
    "Flat_File_-_DB2_Audit_Log": 1000035,
    "Flat_File_-_DB2_via_BMC_Log_Master": 1000290,
    "Flat_File_-_Defender_Server": 1000151,
    "Flat_File_-_DocWorks": 1000424,
    "Flat_File_-_eClinicalWorks_Audit_Log": 1000748,
    "Flat_File_-_EMC_Isilon": 1000563,
    "Flat_File_-_Epicor_Coalition": 1000124,
    "Flat_File_-_FairWarning_Ready-For-Healthcare": 1000269,
    "Flat_File_-_FileZilla_System_Log": 1000564,
    "Flat_File_-_FireEye_Web_MPS": 1000310,
    "Flat_File_-_Forcepoint_Web_Security_CEF_Cloud_Format": 1000706,
    "Flat_File_-_Forescout_CounterACT": 1000501,
    "Flat_File_-_FoxT_BoKS_Server_Access_Control": 1000688,
    "Flat_File_-_FundsXpress": 1000517,
    "Flat_File_-_Gene6_FTP": 154,
    "Flat_File_-_GlobalSCAPE_EFT": 1000231,
    "Flat_File_-_Hadoop": 1000457,
    "Flat_File_-_HMC": 1000614,
    "Flat_File_-_HP-UX_Audit_Log": 115,
    "Flat_File_-_IBM_4690_POS": 1000109,
    "Flat_File_-_IBM_Informix_Application_Log": 1000169,
    "Flat_File_-_IBM_Informix_Audit_Log": 1000170,
    "Flat_File_-_IBM_Tivoli_Storage_Manager": 1000454,
    "Flat_File_-_IBM_WebSphere_App_Server_v7_Audit_Log": 1000179,
    "Flat_File_-_IBM_WebSphere_Cast_Iron_Cloud_Integration": 1000389,
    "Flat_File_-_IBM_ZOS_Batch_Decryption_Log": 146,
    "Flat_File_-_IBM_ZOS_CICS_Decryption_Log": 147,
    "Flat_File_-_IBM_ZOS_RACF_Access_Log": 148,
    "Flat_File_-_IBM_ZOS_RACF_SMF_Type_80": 175,
    "Flat_File_-_IPSwitch_WS_FTP": 1000777,
    "Flat_File_-_Irix_Audit_Logs": 1000117,
    "Flat_File_-_IT-CUBE_AgileSI": 1000316,
    "Flat_File_-_JBoss_Log_File": 134,
    "Flat_File_-_Juniper_Steel_Belted_Radius_Server": 1000261,
    "Flat_File_-_Kerio_Mail_Server": 1000115,
    "Flat_File_-_KERISYS_Doors_Event_Export_Format": 1000129,
    "Flat_File_-_Kippo_Honeypot": 1000522,
    "Flat_File_-_Linux_Audit_ASCII": 1000154,
    "Flat_File_-_Linux_Audit_Log": 1000123,
    "Flat_File_-_Linux_Host_Secure_Log": 1000507,
    "Flat_File_-_LOGbinder_EX": 1000623,
    "Flat_File_-_LogRhythm_Alarm_Reingest": 8,
    "Flat_File_-_LogRhythm_Data_Indexer_Monitor": 1000648,
    "Flat_File_-_LogRhythm_Oracle_Log": 1000716,
    "Flat_File_-_LogRhythm_System_Monitor": 17,
    "Flat_File_-_LogRhythm_System_Monitor_Log_File": 1000858,
    "Flat_File_-_LogRhythm_Trebek_Log": 1000717,
    "Flat_File_-_LogRhythm_Zeus_Log": 1000715,
    "Flat_File_-_Lotus_Domino_Client_Log": 1000041,
    "Flat_File_-_McAfee_Cloud_Proxy_do_not_use": 1000826,
    "Flat_File_-_McAfee_ePO_HIPS": 1000552,
    "Flat_File_-_McAfee_Foundstone": 1000049,
    "Flat_File_-_McAfee_Proxy_Cloud": 1000829,
    "Flat_File_-_McAfee_SaaS_Web_Protection": 1000638,
    "Flat_File_-_McAfee_Web_Gateway_Audit_Log": 1000685,
    "Flat_File_-_Merak": 1000312,
    "Flat_File_-_Meridian": 1000098,
    "Flat_File_-_Microsoft_ActiveSync_2010": 1000404,
    "Flat_File_-_Microsoft_CRM": 1000106,
    "Flat_File_-_Microsoft_DHCP_Server_Log": 122,
    "Flat_File_-_Microsoft_Forefront_TMG": 1000402,
    "Flat_File_-_Microsoft_Forefront_TMG_Web_Proxy": 1000586,
    "Flat_File_-_Microsoft_IIS_(IIS_Format)_File": 112,
    "Flat_File_-_Microsoft_IIS_7.x_W3C_Extended_Format": 1000655,
    "Flat_File_-_Microsoft_IIS_Error_Log_V6": 1000323,
    "Flat_File_-_Microsoft_IIS_FTP_IIS_Log_File_Format": 1000150,
    "Flat_File_-_Microsoft_IIS_FTP_W3C_Extended_Format": 161,
    "Flat_File_-_Microsoft_IIS_NCSA_Common_Format_File": 111,
    "Flat_File_-_Microsoft_IIS_SMTP_W3C_Format": 1000397,
    "Flat_File_-_Microsoft_IIS_URL_Scan_Log": 1000054,
    "Flat_File_-_Microsoft_IIS_W3C_File": 84,
    "Flat_File_-_Microsoft_ISA_Server_2004": 187,
    "Flat_File_-_Microsoft_ISA_Server_W3C_File": 21,
    "Flat_File_-_Microsoft_Netlogon": 1000579,
    "Flat_File_-_Microsoft_Port_Reporter_PR-PORTS_Log": 1000274,
    "Flat_File_-_Microsoft_Semantic_Logging": 1000582,
    "Flat_File_-_Microsoft_SQL_Server_2000_Error_Log": 40,
    "Flat_File_-_Microsoft_SQL_Server_2005_Error_Log": 1000172,
    "Flat_File_-_Microsoft_SQL_Server_2008_Error_Log": 1000181,
    "Flat_File_-_Microsoft_SQL_Server_2012_Error_Log": 1000479,
    "Flat_File_-_Microsoft_SQL_Server_2014_Error_Log": 1000637,
    "Flat_File_-_Microsoft_Windows_2003_DNS": 1000506,
    "Flat_File_-_Microsoft_Windows_2008_DNS": 1000276,
    "Flat_File_-_Microsoft_Windows_2012_DNS": 1000619,
    "Flat_File_-_Microsoft_Windows_Firewall": 119,
    "Flat_File_-_MicroStrategy": 1000535,
    "Flat_File_-_Mimecast_Audit": 1000721,
    "Flat_File_-_Mimecast_Email": 1000726,
    "Flat_File_-_Monetra": 1000288,
    "Flat_File_-_MongoDB": 185,
    "Flat_File_-_MS_Exchange_2003_Message_Tracking_Log": 1000000005,
    "Flat_File_-_MS_Exchange_2007_Message_Tracking_Log": 1000000004,
    "Flat_File_-_MS_Exchange_2010_Message_Tracking_Log": 1000000007,
    "Flat_File_-_MS_Exchange_2013_Message_Tracking_Log": 1000561,
    "Flat_File_-_MS_Exchange_2016_Message_Tracking_Log": 1000805,
    "Flat_File_-_MS_Exchange_RPC_Client_Access": 1000433,
    "Flat_File_-_MS_IAS/RAS_Server_NPS_DB_Log_Format": 121,
    "Flat_File_-_MS_IAS/RAS_Server_Standard_Log_Format": 1000168,
    "Flat_File_-_MS_ISA_Server_2006_ISA_All_Fields": 157,
    "Flat_File_-_MS_ISA_Server_2006_W3C_All_Fields": 156,
    "Flat_File_-_MS_SQL_Server_Reporting_Services_2008": 1000066,
    "Flat_File_-_MySQL": 1000247,
    "Flat_File_-_MySQL_error.log": 1000252,
    "Flat_File_-_MySQL_mysql.log": 1000256,
    "Flat_File_-_MySQL_mysql-slow.log": 1000253,
    "Flat_File_-_Nessus_System_Log": 1000220,
    "Flat_File_-_NetApp_Cluster": 1000593,
    "Flat_File_-_Nginx_Log": 1000718,
    "Flat_File_-_Novell_Audit": 1000110,
    "Flat_File_-_Novell_GroupWise": 1000429,
    "Flat_File_-_Novell_LDAP": 1000307,
    "Flat_File_-_ObserveIT_Enterprise": 1000363,
    "Flat_File_-_Office_365_Message_Tracking": 1000720,
    "Flat_File_-_OpenDJ": 1000455,
    "Flat_File_-_OpenVMS": 1000127,
    "Flat_File_-_OpenVPN": 1000311,
    "Flat_File_-_Oracle_11g_Fine_Grained_Audit_Trail": 1000227,
    "Flat_File_-_Oracle_9i": 1000007,
    "Flat_File_-_Oracle_BRM_CM_Log": 1000515,
    "Flat_File_-_Oracle_BRM_DM_Log": 1000514,
    "Flat_File_-_Oracle_Listener_Audit_Trail": 1000346,
    "Flat_File_-_Oracle_SunOne_Directory_Server": 1000278,
    "Flat_File_-_Oracle_SunOne_Web_Server_Access_Log": 1000277,
    "Flat_File_-_Oracle_Virtual_Directory": 1000315,
    "Flat_File_-_Oracle_WebLogic_11g_Access_Log": 1000471,
    "Flat_File_-_Other": 127,
    "Flat_File_-_PeopleSoft": 1000822,
    "Flat_File_-_PhpMyAdmin_Honeypot": 1000523,
    "Flat_File_-_Postfix": 1000294,
    "Flat_File_-_PowerBroker_Servers": 1000528,
    "Flat_File_-_Princeton_Card_Secure": 1000136,
    "Flat_File_-_ProFTPD": 1000087,
    "Flat_File_-_PureMessage_For_Exchange_SMTP_Log": 1000180,
    "Flat_File_-_PureMessage_For_UNIX_Blocklist_Log": 1000176,
    "Flat_File_-_PureMessage_For_UNIX_Message_Log": 1000177,
    "Flat_File_-_RACF_(SMF)": 1000033,
    "Flat_File_-_Radmin": 1000367,
    "Flat_File_-_Restic_Backup_Log": 14,
    "Flat_File_-_RL_Patient_Feedback": 1000349,
    "Flat_File_-_RSA_Adaptive_Authentication": 1000283,
    "Flat_File_-_RSA_Authentication_Manager_6.1": 1000226,
    "Flat_File_-_S2_Badge_Reader": 1000630,
    "Flat_File_-_Safenet": 1000714,
    "Flat_File_-_Sendmail_File": 133,
    "Flat_File_-_Sharepoint_ULS": 1000221,
    "Flat_File_-_ShoreTel_VOIP": 1000351,
    "Flat_File_-_Siemens_Radiology_Information_System": 1000091,
    "Flat_File_-_Snort_Fast_Alert_File": 37,
    "Flat_File_-_Solaris_-_Sulog": 1000043,
    "Flat_File_-_Solaris_Audit_Log": 1000116,
    "Flat_File_-_SpamAssassin": 1000047,
    "Flat_File_-_Squid_Proxy": 1000070,
    "Flat_File_-_Subversion": 1000516,
    "Flat_File_-_Sudo.Log": 1000373,
    "Flat_File_-_Swift_Alliance": 1000099,
    "Flat_File_-_Symantec_Antivirus_10.x_Corporate_Edtn": 176,
    "Flat_File_-_Symantec_Antivirus_12.x_Corporate_Edtn": 1000602,
    "Flat_File_-_Symitar_Episys_Console_Log": 1000466,
    "Flat_File_-_Symitar_Episys_Sysevent_Log": 1000450,
    "Flat_File_-_Tandem_EMSOUT_Log_File": 138,
    "Flat_File_-_Tandem_XYGATE": 1000306,
    "Flat_File_-_Tectia_SSH_Server": 1000476,
    "Flat_File_-_Trade_Innovations_CSCS": 1000114,
    "Flat_File_-_Trend_Micro_IMSS": 1000219,
    "Flat_File_-_Trend_Micro_Office_Scan": 1000244,
    "Flat_File_-_Tumbleweed_Mailgate_Server": 1000067,
    "Flat_File_-_Verint_Audit_Trail_File": 142,
    "Flat_File_-_VMWare_Virtual_Machine": 109,
    "Flat_File_-_Voltage_Securemail": 1000368,
    "Flat_File_-_Vormetric_Log_File": 135,
    "Flat_File_-_vsFTP_Daemon_Log": 1000042,
    "Flat_File_-_Vyatta_Firewall_Kernel_Log": 1000456,
    "Flat_File_-_WordPot_Honeypot": 1000524,
    "Flat_File_-_X-NetStat_Log": 38,
    "Flat_File_-_XPient_POS_CCA_Manager": 159,
    "Flat_File_-_XPIENT_POS_POSLOG": 1000275,
    "Flat_File_-_XPIENT_POS_Shell_Log": 1000287,
    "IPFIX_-_IP_Flow_Information_Export": 1000484,
    "J-Flow_-_Juniper_J-Flow_Version_5": 1000292,
    "J-Flow_-_Juniper_J-Flow_Version_9": 1000293,
    "LogRhythm_CloudAI": 1000678,
    "LogRhythm_Data_Loss_Defender": 1000044,
    "LogRhythm_Demo_File_-_Application_Server_Log": 1000186,
    "LogRhythm_Demo_File_-_Content_Inspection_Log": 1000190,
    "LogRhythm_Demo_File_-_Database_Audit_Log": 1000191,
    "LogRhythm_Demo_File_-_Ecom_Server_Log": 1000194,
    "LogRhythm_Demo_File_-_File_Server_Log": 1000184,
    "LogRhythm_Demo_File_-_Firewall_Log": 1000189,
    "LogRhythm_Demo_File_-_FTP_Log": 1000182,
    "LogRhythm_Demo_File_-_IDS_Alarms_Log": 1000188,
    "LogRhythm_Demo_File_-_Mail_Server_Log": 1000185,
    "LogRhythm_Demo_File_-_Netflow_Log": 1000193,
    "LogRhythm_Demo_File_-_Network_Device_Log": 1000192,
    "LogRhythm_Demo_File_-_Network_Server_Log": 1000183,
    "LogRhythm_Demo_File_-_VPN_Log": 1000195,
    "LogRhythm_Demo_File_-_Web_Access_Log": 1000187,
    "LogRhythm_File_Monitor_(AIX)": 8,
    "LogRhythm_File_Monitor_(HP-UX)": 1000137,
    "LogRhythm_File_Monitor_(Linux)": 2,
    "LogRhythm_File_Monitor_(Solaris)": 6,
    "LogRhythm_File_Monitor_(Windows)": 3,
    "LogRhythm_Filter": 1000695,
    "LogRhythm_Network_Connection_Monitor_(AIX)": 1000163,
    "LogRhythm_Network_Connection_Monitor_(HP-UX)": 1000164,
    "LogRhythm_Network_Connection_Monitor_(Linux)": 1000165,
    "LogRhythm_Network_Connection_Monitor_(Solaris)": 1000166,
    "LogRhythm_Network_Connection_Monitor_(Windows)": 1000162,
    "LogRhythm_Process_Monitor_(AIX)": 1000159,
    "LogRhythm_Process_Monitor_(HP-UX)": 1000160,
    "LogRhythm_Process_Monitor_(Linux)": 1000167,
    "LogRhythm_Process_Monitor_(Solaris)": 1000161,
    "LogRhythm_Process_Monitor_(Windows)": 1000158,
    "LogRhythm_Registry_Integrity_Monitor": 1000539,
    "LogRhythm_SQL_Server_2000_C2_Audit_Log": 1000202,
    "LogRhythm_SQL_Server_2005_C2_Audit_Log": 1000203,
    "LogRhythm_SQL_Server_2008_C2_Audit_Log": 1000204,
    "LogRhythm_SQL_Server_2012+_C2_Audit_Log": 1000475,
    "LogRhythm_User_Activity_Monitor_(AIX)": 1000062,
    "LogRhythm_User_Activity_Monitor_(HP-UX)": 1000138,
    "LogRhythm_User_Activity_Monitor_(Linux)": 1000060,
    "LogRhythm_User_Activity_Monitor_(Solaris)": 1000061,
    "LogRhythm_User_Activity_Monitor_(Windows)": 1000059,
    "MS_Event_Log_for_XP/2000/2003_-_Application": 31,
    "MS_Event_Log_for_XP/2000/2003_-_Application_-_Espaniol": 1000571,
    "MS_Event_Log_for_XP/2000/2003_-_BioPassword": 151,
    "MS_Event_Log_for_XP/2000/2003_-_DFS": 1000112,
    "MS_Event_Log_for_XP/2000/2003_-_Directory_Service": 32,
    "MS_Event_Log_for_XP/2000/2003_-_DNS": 76,
    "MS_Event_Log_for_XP/2000/2003_-_DotDefender": 1000083,
    "MS_Event_Log_for_XP/2000/2003_-_EMC_Celerra_NAS": 1000488,
    "MS_Event_Log_for_XP/2000/2003_-_File_Rep_Service": 33,
    "MS_Event_Log_for_XP/2000/2003_-_HA": 1000069,
    "MS_Event_Log_for_XP/2000/2003_-_Kaspersky": 1000102,
    "MS_Event_Log_for_XP/2000/2003_-_Micros_POS": 1000354,
    "MS_Event_Log_for_XP/2000/2003_-_PatchLink": 1000073,
    "MS_Event_Log_for_XP/2000/2003_-_SafeWord_2008": 199,
    "MS_Event_Log_for_XP/2000/2003_-_SCE": 1000173,
    "MS_Event_Log_for_XP/2000/2003_-_Security": 23,
    "MS_Event_Log_for_XP/2000/2003_-_Security_-_Espaniol": 1000569,
    "MS_Event_Log_for_XP/2000/2003_-_SMS_2003": 1000038,
    "MS_Event_Log_for_XP/2000/2003_-_System": 30,
    "MS_Event_Log_for_XP/2000/2003_-_System_-_Espaniol": 1000570,
    "MS_Event_Log_for_XP/2000/2003_-_Virtual_Server": 1000075,
    "MS_Windows_Event_Logging_-_ADFS_Admin": 1000661,
    "MS_Windows_Event_Logging_-_Application": 1000032,
    "MS_Windows_Event_Logging_-_AppLockerApp": 1000557,
    "MS_Windows_Event_Logging_-_Backup": 1000341,
    "MS_Windows_Event_Logging_-_Citrix_Delivery_Services": 1000526,
    "MS_Windows_Event_Logging_-_Citrix_XenApp": 1000701,
    "MS_Windows_Event_Logging_-_DFS": 1000121,
    "MS_Windows_Event_Logging_-_DHCP_Admin": 1000540,
    "MS_Windows_Event_Logging_-_DHCP_Operational": 1000537,
    "MS_Windows_Event_Logging_-_Diagnosis-PLA": 1000280,
    "MS_Windows_Event_Logging_-_Digital_Persona": 1000483,
    "MS_Windows_Event_Logging_-_Dir_Service": 1000119,
    "MS_Windows_Event_Logging_-_DNS": 1000120,
    "MS_Windows_Event_Logging_-_Dot_Defender": 1000303,
    "MS_Windows_Event_Logging_-_ESD_Data_Flow_Track": 1000583,
    "MS_Windows_Event_Logging_-_Exchange_Mailbox_DB_Failures": 1000446,
    "MS_Windows_Event_Logging_-_FailoverClustering/Operational": 1000447,
    "MS_Windows_Event_Logging_-_Firewall_With_Advanced_Security": 1000302,
    "MS_Windows_Event_Logging_-_Forefront_AV": 1000352,
    "MS_Windows_Event_Logging_-_Group_Policy_Operational": 1000301,
    "MS_Windows_Event_Logging_-_Hyper-V_Hvisor": 1000264,
    "MS_Windows_Event_Logging_-_Hyper-V_IMS": 1000263,
    "MS_Windows_Event_Logging_-_Hyper-V_Network": 1000265,
    "MS_Windows_Event_Logging_-_Hyper-V_SynthSt": 1000266,
    "MS_Windows_Event_Logging_-_Hyper-V_VMMS": 1000251,
    "MS_Windows_Event_Logging_-_Hyper-V_Worker": 1000262,
    "MS_Windows_Event_Logging_-_Kaspersky": 1000495,
    "MS_Windows_Event_Logging_-_Kernel_PnP_Configuration": 1000559,
    "MS_Windows_Event_Logging_-_Lync_Server": 1000628,
    "MS_Windows_Event_Logging_-_MSExchange_Management": 1000338,
    "MS_Windows_Event_Logging_-_Operations_Manager": 1000421,
    "MS_Windows_Event_Logging_-_PowerShell": 1000627,
    "MS_Windows_Event_Logging_-_Print_Services": 1000356,
    "MS_Windows_Event_Logging_-_Quest_ActiveRoles_EDM_Server": 1000577,
    "MS_Windows_Event_Logging_-_Replication": 1000122,
    "MS_Windows_Event_Logging_-_SafeWord_2008": 1000419,
    "MS_Windows_Event_Logging_-_Security": 1000030,
    "MS_Windows_Event_Logging_-_Setup": 1000281,
    "MS_Windows_Event_Logging_-_Sysmon": 1000558,
    "MS_Windows_Event_Logging_-_System": 1000031,
    "MS_Windows_Event_Logging_-_Task_Scheduler": 1000308,
    "MS_Windows_Event_Logging_-_TS_Gateway": 1000532,
    "MS_Windows_Event_Logging_-_TS_Licensing": 1000272,
    "MS_Windows_Event_Logging_-_TS_Local_Session_Manager": 1000271,
    "MS_Windows_Event_Logging_-_TS_Remote_Connection_Manager": 1000300,
    "MS_Windows_Event_Logging_-_TS_Session_Broker": 1000320,
    "MS_Windows_Event_Logging_-_TS_Session_Broker_Client": 1000309,
    "MS_Windows_Event_Logging_-_VisualSVN": 1000578,
    "MS_Windows_Event_Logging_:_Deutsch_-_Security": 1000470,
    "MS_Windows_Event_Logging_:_Espaniol_-_Application": 1000566,
    "MS_Windows_Event_Logging_:_Espaniol_-_Security": 1000565,
    "MS_Windows_Event_Logging_:_Espaniol_-_System": 1000568,
    "MS_Windows_Event_Logging_:_Francais_-_System": 1000468,
    "MS_Windows_Event_Logging_:Francais_-_Security": 1000469,
    "MS_Windows_Event_Logging_XML_-_ADFS": 1000868,
    "MS_Windows_Event_Logging_XML_-_Application": 1000562,
    "MS_Windows_Event_Logging_XML_-_Forwarded_Events": 1000746,
    "MS_Windows_Event_Logging_XML_-_Generic": 1000738,
    "MS_Windows_Event_Logging_XML_-_LRTracer": 1000784,
    "MS_Windows_Event_Logging_XML_-_Security": 1000639,
    "MS_Windows_Event_Logging_XML_-_Sysmon": 1000862,
    "MS_Windows_Event_Logging_XML_-_Sysmon_7.01": 1000724,
    "MS_Windows_Event_Logging_XML_-_Sysmon_8/9/10": 1000745,
    "MS_Windows_Event_Logging_XML_-_System": 1000662,
    "MS_Windows_Event_Logging_XML_-_Unisys_Stealth": 1000681,
    "MS_Windows_Event_Logging_XML_-_Windows_Defender": 1000856,
    "Netflow_-_Cisco_Netflow_Version_1": 101,
    "Netflow_-_Cisco_Netflow_Version_5": 102,
    "Netflow_-_Cisco_Netflow_Version_9": 1000174,
    "Netflow_-_Palo_Alto_Version_9": 191,
    "Netflow_-_SonicWALL_Version_5": 1000436,
    "Netflow_-_SonicWALL_Version_9": 1000437,
    "OPSEC_LEA_-_Checkpoint_Firewall": 125,
    "OPSEC_LEA_-_Checkpoint_Firewall_Audit_Log": 1000304,
    "OPSEC_LEA_-_Checkpoint_For_LR_7.4.1+": 1000741,
    "OPSEC_LEA_-_Checkpoint_Log_Server": 126,
    "sFlow_-_Version_5": 1000239,
    "SNMP_Trap_-_Audiolog": 1000259,
    "SNMP_Trap_-_Autoregistered": 1000149,
    "SNMP_Trap_-_Brocade_Switch": 1000599,
    "SNMP_Trap_-_Cisco_5508_Wireless_Controller": 1000545,
    "SNMP_Trap_-_Cisco_IP_SLA": 1000572,
    "SNMP_Trap_-_Cisco_Prime": 1000629,
    "SNMP_Trap_-_Cisco_Router-Switch": 1000327,
    "SNMP_Trap_-_CyberArk": 1000240,
    "SNMP_Trap_-_Dell_OpenManage": 1000322,
    "SNMP_Trap_-_HP_Network_Node_Manager": 1000377,
    "SNMP_Trap_-_IBM_TS3000_Series_Tape_Drive": 1000258,
    "SNMP_Trap_-_Riverbed_SteelCentral_NetShark": 1000508,
    "SNMP_Trap_-_RSA_Authentication_Manager": 1000248,
    "SNMP_Trap_-_Swift_Alliance": 1000405,
    "SNMP_Trap_-_Trend_Micro_Control_Manager": 1000413,
    "Syslog_-_3Com_Switch": 1000329,
    "Syslog_-_A10_Networks_AX1000_Load_Balancer": 1000268,
    "Syslog_-_A10_Networks_Web_Application_Firewall": 1000785,
    "Syslog_-_Accellion_Secure_File_Transfer_Application": 1000665,
    "Syslog_-_Active_Scout_IPS": 128,
    "Syslog_-_Adallom": 1000585,
    "Syslog_-_Adtran_Switch": 1000284,
    "Syslog_-_Aerohive_Access_Point": 1000467,
    "Syslog_-_Aerohive_Firewall": 1000677,
    "Syslog_-_AIMIA_Tomcat": 1000635,
    "Syslog_-_AirDefense_Enterprise": 182,
    "Syslog_-_Airmagnet_Wireless_IDS": 177,
    "Syslog_-_AirTight_IDS/IPS": 145,
    "Syslog_-_AirWatch_MDM": 1000594,
    "Syslog_-_Airwave_Management_System_Log": 150,
    "Syslog_-_AIX_Host": 90,
    "Syslog_-_Alcatel-Lucent_Switch": 1000756,
    "Syslog_-_Alcatel-Lucent_Wireless_Controller": 1000425,
    "Syslog_-_AlertLogic": 1000742,
    "Syslog_-_AMX_AV_Controller": 27,
    "Syslog_-_Apache_Access_Log": 1000255,
    "Syslog_-_Apache_Error_Log": 1000254,
    "Syslog_-_Apache_Tomcat_Request_Parameters": 110,
    "Syslog_-_Apache_Tomcat_Service_Clients_Log": 1000418,
    "Syslog_-_APC_ATS": 1000400,
    "Syslog_-_APC_NetBotz_Environmental_Monitoring": 1000348,
    "Syslog_-_APC_PDU": 1000416,
    "Syslog_-_APC_UPS": 1000200,
    "Syslog_-_Apcon_Network_Monitor": 1000491,
    "Syslog_-_Apex_One": 1000832,
    "Syslog_-_Arbor_Networks_Peakflow": 1000477,
    "Syslog_-_Arbor_Networks_Spectrum": 1000708,
    "Syslog_-_Arbor_Pravail_APS": 1000464,
    "Syslog_-_Arista_Switch": 1000410,
    "Syslog_-_Array_TMX_Load_Balancer": 1000525,
    "Syslog_-_Arris_CMTS": 1000230,
    "Syslog_-_Aruba_Clear_Pass": 1000502,
    "Syslog_-_Aruba_Mobility_Controller": 144,
    "Syslog_-_Aruba_Wireless_Access_Point": 1000529,
    "Syslog_-_AS/400_via_Powertech_Interact": 178,
    "Syslog_-_Asus_WRT_Router": 1000679,
    "Syslog_-_Avatier_Identity_Management_Suite_(AIMS)": 1000780,
    "Syslog_-_Avaya_Communications_Manager": 1000459,
    "Syslog_-_Avaya_Ethernet_Routing_Switch": 1000482,
    "Syslog_-_Avaya_G450_Media_Gateway": 1000680,
    "Syslog_-_Avaya_Router": 1000581,
    "Syslog_-_Aventail_SSL/VPN": 1000132,
    "Syslog_-_Avocent_Cyclades_Terminal_Server": 1000396,
    "Syslog_-_Azul_Java_Appliance": 1000217,
    "Syslog_-_Barracuda_Load_Balancer": 1000370,
    "Syslog_-_Barracuda_Mail_Archiver": 1000492,
    "Syslog_-_Barracuda_NG_Firewall": 1000442,
    "Syslog_-_Barracuda_NG_Firewall_6.x": 1000613,
    "Syslog_-_Barracuda_Spam_Firewall": 132,
    "Syslog_-_Barracuda_Web_Application_Firewall": 1000342,
    "Syslog_-_Barracuda_Webfilter": 140,
    "Syslog_-_BeyondTrust_BeyondInsight_LEEF": 1000778,
    "Syslog_-_Bind_DNS": 1000621,
    "Syslog_-_Bit9_Parity_Suite": 1000215,
    "Syslog_-_Bit9_Security_Platform_CEF": 1000622,
    "Syslog_-_Bit9+Carbon_Black_(Deprecated)": 1000620,
    "Syslog_-_BitDefender": 1000597,
    "Syslog_-_Black_Diamond_Switch": 1000004,
    "Syslog_-_Blue_Coat_CAS": 1000739,
    "Syslog_-_Blue_Coat_Forward_Proxy": 1000509,
    "Syslog_-_Blue_Coat_PacketShaper": 1000392,
    "Syslog_-_Blue_Coat_ProxyAV_ISA_W3C_Format": 1000126,
    "Syslog_-_Blue_Coat_ProxyAV_MS_Proxy_2.0_Format": 1000143,
    "Syslog_-_Blue_Coat_ProxySG": 166,
    "Syslog_-_Blue_Socket_Wireless_Controller": 1000451,
    "Syslog_-_Bluecat_Adonis": 1000438,
    "Syslog_-_BlueCedar": 1000753,
    "Syslog_-_BluVector": 1000769,
    "Syslog_-_Bomgar": 1000347,
    "Syslog_-_Bradford_Networks_NAC": 1000553,
    "Syslog_-_Bradford_Remediation_&_Registration_Svr": 155,
    "Syslog_-_Bro_IDS": 1000723,
    "Syslog_-_Brocade_Switch": 183,
    "Syslog_-_Bromium_vSentry_CEF": 1000513,
    "Syslog_-_BSD_Host": 117,
    "Syslog_-_CA_Privileged_Access_Manager": 1000808,
    "Syslog_-_Cb_Defense_CEF": 1000702,
    "Syslog_-_Cb_Protection_CEF": 1000420,
    "Syslog_-_Cb_Response_LEEF": 1000651,
    "Syslog_-_Cell_Relay": 1000407,
    "Syslog_-_Certes_Networks_CEP": 1000445,
    "Syslog_-_Check_Point_Log_Exporter": 1000806,
    "Syslog_-_Checkpoint_Site-to-Site_VPN": 1000376,
    "Syslog_-_Cisco_ACS": 1000063,
    "Syslog_-_Cisco_Aironet_WAP": 1000002,
    "Syslog_-_Cisco_APIC": 1000764,
    "Syslog_-_Cisco_Application_Control_Engine": 1000130,
    "Syslog_-_Cisco_ASA": 5,
    "Syslog_-_Cisco_Clean_Access_(CCA)_Appliance": 1000201,
    "Syslog_-_Cisco_CSS_Load_Balancer": 1000064,
    "Syslog_-_Cisco_Email_Security_Appliance": 1000021,
    "Syslog_-_Cisco_FirePOWER": 1000683,
    "Syslog_-_Cisco_Firepower_Threat_Defense": 18,
    "Syslog_-_Cisco_FireSIGHT": 1000595,
    "Syslog_-_Cisco_FWSM": 163,
    "Syslog_-_Cisco_Global_Site_Selector": 1000068,
    "Syslog_-_Cisco_ISE": 1000369,
    "Syslog_-_Cisco_Meraki": 1000530,
    "Syslog_-_Cisco_Nexus_Switch": 1000225,
    "Syslog_-_Cisco_PIX": 1000000003,
    "Syslog_-_Cisco_Prime_Infrastructure": 1000500,
    "Syslog_-_Cisco_Router": 86,
    "Syslog_-_Cisco_Secure_ACS_5": 1000206,
    "Syslog_-_Cisco_Session_Border_Controller": 11,
    "Syslog_-_Cisco_Switch": 85,
    "Syslog_-_Cisco_Telepresence_Video_Communications_Server": 1000657,
    "Syslog_-_Cisco_UCS": 1000391,
    "Syslog_-_Cisco_Unified_Comm_Mgr_(Call_Mgr)": 1000133,
    "Syslog_-_Cisco_VPN_Concentrator": 116,
    "Syslog_-_Cisco_WAAS": 1000333,
    "Syslog_-_Cisco_Web_Security": 1000390,
    "Syslog_-_Cisco_Wireless_Access_Point": 1000394,
    "Syslog_-_Cisco_Wireless_Control_System": 1000101,
    "Syslog_-_CiscoWorks": 1000260,
    "Syslog_-_Citrix_Access_Gateway_Server": 1000403,
    "Syslog_-_Citrix_Netscaler": 25,
    "Syslog_-_Citrix_XenServer": 1000257,
    "Syslog_-_Claroty_CTD_CEF": 1000801,
    "Syslog_-_Clearswift_Secure_Email_Gateway": 1000747,
    "Syslog_-_CloudLock": 1000659,
    "Syslog_-_CodeGreen_Data_Loss_Prevention": 1000097,
    "Syslog_-_Cofense_Triage_CEF": 1000632,
    "Syslog_-_Consentry_NAC": 165,
    "Syslog_-_Corero_IPS": 1000431,
    "Syslog_-_Corero_SmartWall_DDoS": 22,
    "Syslog_-_CoyotePoint_Equalizer": 1000289,
    "Syslog_-_Crowdstrike_Falconhost_CEF": 1000682,
    "Syslog_-_CyberArk": 1000325,
    "Syslog_-_CyberArk_Privileged_Threat_Analytics": 1000652,
    "Syslog_-_Cylance_CEF": 1000813,
    "Syslog_-_CylancePROTECT": 1000625,
    "Syslog_-_DarkTrace_CEF": 1000710,
    "Syslog_-_Dell_Force_10": 1000423,
    "Syslog_-_Dell_PowerConnect_Switch": 1000118,
    "Syslog_-_Dell_Remote_Access_Controller": 1000324,
    "Syslog_-_Dell_SecureWorks_iSensor_IPS": 1000554,
    "Syslog_-_Dialogic_Media_Gateway": 1000125,
    "Syslog_-_Digital_Guardian_CEF": 1000800,
    "Syslog_-_D-Link_Switch": 1000504,
    "Syslog_-_Don_not_use": 1000827,
    "Syslog_-_Dragos_Platform_CEF": 1000852,
    "Syslog_-_Ecessa_ShieldLink": 1000282,
    "Syslog_-_EfficientIP": 7,
    "Syslog_-_EMC_Avamar": 1000556,
    "Syslog_-_EMC_Centera": 1000490,
    "Syslog_-_EMC_Data_Domain": 1000551,
    "Syslog_-_EMC_Isilon": 20,
    "Syslog_-_EMC_Unity_Array": 1000751,
    "Syslog_-_EMC_VNX": 1000432,
    "Syslog_-_Ensilo_NGAV": 1000830,
    "Syslog_-_Enterasys_Dragon_IDS": 1000131,
    "Syslog_-_Enterasys_Router": 123,
    "Syslog_-_Enterasys_Switch": 124,
    "Syslog_-_Entrust_Entelligence_Messaging_Server": 1000462,
    "Syslog_-_Entrust_IdentityGuard": 1000234,
    "Syslog_-_Epic_Hyperspace_CEF": 1000668,
    "Syslog_-_EqualLogic_SAN": 189,
    "Syslog_-_eSafe_Email_Security": 1000366,
    "Syslog_-_ESET_Remote_Administrator_(ERA)_LEEF": 1000754,
    "Syslog_-_Event_Reporter_(Win_2000/XP/2003)": 1000046,
    "Syslog_-_Exabeam": 3,
    "Syslog_-_Exchange_Message_Tracking": 6,
    "Syslog_-_ExtraHop": 1000795,
    "Syslog_-_Extreme_Wireless_LAN": 1000058,
    "Syslog_-_ExtremeWare": 1000318,
    "Syslog_-_ExtremeXOS": 1000317,
    "Syslog_-_F5_BIG-IP_Access_Policy_Manager": 1000676,
    "Syslog_-_F5_BIG-IP_AFM": 1000771,
    "Syslog_-_F5_BIG-IP_ASM": 1000236,
    "Syslog_-_F5_BIG-IP_ASM_Key-Value_Pairs": 1000749,
    "Syslog_-_F5_BIG-IP_ASM_v12": 1000709,
    "Syslog_-_F5_Big-IP_GTM_&_DNS": 188,
    "Syslog_-_F5_Big-IP_LTM": 1000335,
    "Syslog_-_F5_FirePass_Firewall": 179,
    "Syslog_-_F5_Silverline_DDoS_Protection": 1000799,
    "Syslog_-_Fargo_HDP_Card_Printer_and_Encoder": 1000358,
    "Syslog_-_Fat_Pipe_Load_Balancer": 1000807,
    "Syslog_-_Fidelis_XPS": 1000104,
    "Syslog_-_FireEye_E-Mail_MPS": 1000542,
    "Syslog_-_FireEye_EX": 1000831,
    "Syslog_-_FireEye_Web_MPS/CMS/ETP/HX": 1000359,
    "Syslog_-_Forcepoint_DLP": 1000321,
    "Syslog_-_Forcepoint_Email_Security_Gateway": 1000591,
    "Syslog_-_Forcepoint_Stonesoft_NGFW": 1000675,
    "Syslog_-_Forcepoint_SureView_Insider_Threat": 1000660,
    "Syslog_-_Forcepoint_Web_Security": 1000375,
    "Syslog_-_Forcepoint_Web_Security_CEF_Format": 1000452,
    "Syslog_-_Forescout_CounterACT_NAC": 1000157,
    "Syslog_-_Fortinet_FortiAnalyzer": 1000811,
    "Syslog_-_Fortinet_FortiAuthenticator": 1000846,
    "Syslog_-_Fortinet_FortiDDoS": 1000782,
    "Syslog_-_Fortinet_FortiGate": 130,
    "Syslog_-_Fortinet_FortiGate_v4.0": 1000199,
    "Syslog_-_Fortinet_FortiGate_v5.0": 1000426,
    "Syslog_-_Fortinet_FortiGate_v5.2": 1000567,
    "Syslog_-_Fortinet_FortiGate_v5.4/v5.6": 1000700,
    "Syslog_-_Fortinet_FortiGate_v5.6_CEF": 1000722,
    "Syslog_-_Fortinet_Fortigate_v6.0": 1000774,
    "Syslog_-_Fortinet_FortiMail": 1000536,
    "Syslog_-_Fortinet_FortiWeb": 1000493,
    "Syslog_-_Foundry_Switch": 1000050,
    "Syslog_-_Gene6_FTP": 153,
    "Syslog_-_Generic_CEF": 1000725,
    "Syslog_-_Generic_ISC_DHCP": 1000088,
    "Syslog_-_Generic_LEEF": 1000728,
    "Syslog_-_Guardium_Database_Activity_Monitor": 1000326,
    "Syslog_-_H3C_Router": 1000243,
    "Syslog_-_Hitachi_Universal_Storage_Platform": 1000398,
    "Syslog_-_HP_BladeSystem": 1000439,
    "Syslog_-_HP_iLO": 1000616,
    "Syslog_-_HP_Procurve_Switch": 160,
    "Syslog_-_HP_Router": 1000057,
    "Syslog_-_HP_Switch": 1000444,
    "Syslog_-_HP_Unix_Tru64": 1000096,
    "Syslog_-_HP_Virtual_Connect_Switch": 1000350,
    "Syslog_-_HP-UX_Host": 89,
    "Syslog_-_Huawei_Access_Router": 1000541,
    "Syslog_-_IBM_Blade_Center": 1000401,
    "Syslog_-_IBM_Security_Network_Protection": 1000521,
    "Syslog_-_IBM_Virtual_Tape_Library_Server": 1000511,
    "Syslog_-_IBM_WebSphere_DataPower_Integration": 1000441,
    "Syslog_-_IBM_zSecure_Alert_for_ACF2_2.1.0": 1000590,
    "Syslog_-_IceWarp_Server": 1000267,
    "Syslog_-_Imperva_Incapsula_CEF": 1000763,
    "Syslog_-_Imperva_SecureSphere": 1000135,
    "Syslog_-_Imprivata_OneSign_SSO": 1000693,
    "Syslog_-_InfoBlox": 1000089,
    "Syslog_-_Invincea_(LEEF)": 1000626,
    "Syslog_-_iPrism_Proxy_Log": 1000095,
    "Syslog_-_IPSWITCH_MOVEit_Server": 1000573,
    "Syslog_-_IPTables": 1000364,
    "Syslog_-_IRIX_Host": 118,
    "Syslog_-_iSeries_via_Powertech_Interact": 184,
    "Syslog_-_Ivanti_FileDirector": 16,
    "Syslog_-_JetNexus_Load_Balancer": 1000332,
    "Syslog_-_Juniper_DX_Application_Accelerator": 1000147,
    "Syslog_-_Juniper_Firewall": 1000045,
    "Syslog_-_Juniper_Firewall_3400": 1000601,
    "Syslog_-_Juniper_Host_Checker": 1000082,
    "Syslog_-_Juniper_IDP": 1000053,
    "Syslog_-_Juniper_NSM": 1000242,
    "Syslog_-_Juniper_Router": 1000026,
    "Syslog_-_Juniper_SSL_VPN": 186,
    "Syslog_-_Juniper_SSL_VPN_WELF_Format": 1000111,
    "Syslog_-_Juniper_Switch": 1000037,
    "Syslog_-_Juniper_Trapeze": 1000343,
    "Syslog_-_Juniper_vGW_Virtual_Gateway": 1000448,
    "Syslog_-_Kaspersky_Security_Center": 1000797,
    "Syslog_-_Kea_DHCP_Server": 10,
    "Syslog_-_Kemp_Load_Balancer": 1000412,
    "Syslog_-_KFSensor_Honeypot": 1000672,
    "Syslog_-_KFSensor_Honeypot_CEF": 1000691,
    "Syslog_-_Lancope_StealthWatch": 1000393,
    "Syslog_-_Lancope_StealthWatch_CEF": 1000698,
    "Syslog_-_Layer_7_SecureSpan_SOA_Gateway": 1000427,
    "Syslog_-_Legacy_Checkpoint_Firewall_(Not_Log_Exporter)": 1000434,
    "Syslog_-_Legacy_Checkpoint_IPS_(Not_Log_Exporter)": 1000103,
    "Syslog_-_Lieberman_Enterprise_Random_Password_Manager": 1000353,
    "Syslog_-_Linux_Audit": 1000139,
    "Syslog_-_Linux_Host": 13,
    "Syslog_-_Linux_TACACS_Plus": 23,
    "Syslog_-_LOGbinder_EX": 1000533,
    "Syslog_-_LOGbinder_SP": 1000408,
    "Syslog_-_LOGbinder_SQL": 1000555,
    "Syslog_-_LogRhythm_Data_Indexer_Monitor": 1000653,
    "Syslog_-_LogRhythm_Inter_Deployment_Data_Sharing": 1000815,
    "Syslog_-_LogRhythm_Log_Distribution_Services": 1000840,
    "Syslog_-_LogRhythm_Network_Monitor": 197,
    "Syslog_-_LogRhythm_Syslog_Generator": 105,
    "Syslog_-_Lumension": 1000608,
    "Syslog_-_MacOS_X": 1000144,
    "Syslog_-_Malwarebytes_Endpoint_Security_CEF": 1000773,
    "Syslog_-_Mandiant_MIR": 1000489,
    "Syslog_-_McAfee_Advanced_Threat_Defense": 1000617,
    "Syslog_-_McAfee_Email_And_Web_Security": 1000051,
    "Syslog_-_McAfee_ePO": 1000866,
    "Syslog_-_McAfee_Firewall_Enterprise": 1000001,
    "Syslog_-_McAfee_Network_Security_Manager": 1000036,
    "Syslog_-_McAfee_Secure_Internet_Gateway": 136,
    "Syslog_-_McAfee_SecureMail": 1000092,
    "Syslog_-_McAfee_Skyhigh_for_Shadow_IT_LEEF": 1000644,
    "Syslog_-_McAfee_Web_Gateway": 1000612,
    "Syslog_-_mGuard_Firewall": 1000711,
    "Syslog_-_Microsoft_Advanced_Threat_Analytics_(ATA)_CEF": 1000731,
    "Syslog_-_Microsoft_Azure_Log_Integration": 1000733,
    "Syslog_-_Microsoft_Azure_MFA": 1000707,
    "Syslog_-_Microsoft_Forefront_UAG": 1000461,
    "Syslog_-_Mirapoint": 1000228,
    "Syslog_-_MobileIron": 1000497,
    "Syslog_-_Motorola_Access_Point": 1000313,
    "Syslog_-_MS_IIS_Web_Log_W3C_Format_(Snare)": 1000027,
    "Syslog_-_MS_Windows_Event_Logging_XML_-_Application": 1000783,
    "Syslog_-_MS_Windows_Event_Logging_XML_-_Security": 1000669,
    "Syslog_-_MS_Windows_Event_Logging_XML_-_System": 1000671,
    "Syslog_-_Nagios": 1000319,
    "Syslog_-_nCircle_Configuration_Compliance_Manager": 1000430,
    "Syslog_-_NetApp_Filer": 1000108,
    "Syslog_-_NETASQ_Firewall": 1000485,
    "Syslog_-_NetGate_Router": 1000527,
    "Syslog_-_NetMotion_VPN": 1000592,
    "Syslog_-_Netscout_nGenius_InfiniStream": 1000481,
    "Syslog_-_NetScreen_Firewall": 107,
    "Syslog_-_Netskope": 1000736,
    "Syslog_-_Netskope_CEF": 1000853,
    "Syslog_-_Network_Chemistry_RFprotect": 108,
    "Syslog_-_Nginx_Web_Log": 1000584,
    "Syslog_-_Nimble_Storage": 1000727,
    "Syslog_-_Nortel_8600_Switch": 1000081,
    "Syslog_-_Nortel_BayStack_Switch": 171,
    "Syslog_-_Nortel_Contivity": 1000153,
    "Syslog_-_Nortel_Firewall": 168,
    "Syslog_-_Nortel_IP_1220": 1000205,
    "Syslog_-_Nortel_Passport_Switch": 169,
    "Syslog_-_Nozomi_Networks_Guardian_CEF": 1000819,
    "Syslog_-_NuSecure_Gateway": 1000198,
    "Syslog_-_Nutanix": 26,
    "Syslog_-_Open_Collector": 1000759,
    "Syslog_-_Open_Collector_-_AWS_CloudTrail": 1000786,
    "Syslog_-_Open_Collector_-_AWS_CloudWatch": 1000789,
    "Syslog_-_Open_Collector_-_AWS_Config_Events": 1000790,
    "Syslog_-_Open_Collector_-_AWS_Guard_Duty": 1000791,
    "Syslog_-_Open_Collector_-_AWS_S3": 1000802,
    "Syslog_-_Open_Collector_-_Azure_Event_Hub": 1000772,
    "Syslog_-_Open_Collector_-_Carbon_Black_Cloud": 1000861,
    "Syslog_-_Open_Collector_-_CarbonBlackBeat_Heartbeat": 1000864,
    "Syslog_-_Open_Collector_-_Cisco_AMP": 1000842,
    "Syslog_-_Open_Collector_-_Cisco_Umbrella": 1000787,
    "Syslog_-_Open_Collector_-_CiscoAMPBeat_Heartbeat": 1000843,
    "Syslog_-_Open_Collector_-_Duo_Authentication_Security": 1000854,
    "Syslog_-_Open_Collector_-_DuoBeat_Heartbeat": 1000855,
    "Syslog_-_Open_Collector_-_EventHubBeat_Heartbeat": 1000833,
    "Syslog_-_Open_Collector_-_GCP_Audit": 1000817,
    "Syslog_-_Open_Collector_-_GCP_Cloud_Key_Management_Service": 1000820,
    "Syslog_-_Open_Collector_-_GCP_Http_Load_Balancer": 1000839,
    "Syslog_-_Open_Collector_-_GCP_Pub_Sub": 1000812,
    "Syslog_-_Open_Collector_-_GCP_Security_Command_Center": 1000816,
    "Syslog_-_Open_Collector_-_GCP_Virtual_Private_Cloud": 1000821,
    "Syslog_-_Open_Collector_-_Gmail_Message_Tracking": 1000823,
    "Syslog_-_Open_Collector_-_GMTBeat_Heartbeat": 1000834,
    "Syslog_-_Open_Collector_-_GSuite": 1000758,
    "Syslog_-_Open_Collector_-_GSuiteBeat_Heartbeat": 1000838,
    "Syslog_-_Open_Collector_-_Metricbeat": 1000841,
    "Syslog_-_Open_Collector_-_Okta_System_Log": 1000863,
    "Syslog_-_Open_Collector_-_OktaSystemLogBeat_Heartbeat": 1000865,
    "Syslog_-_Open_Collector_-_PubSubBeat_Heartbeat": 1000836,
    "Syslog_-_Open_Collector_-_S3Beat_Heartbeat": 1000835,
    "Syslog_-_Open_Collector_-_Sophos_Central": 1000814,
    "Syslog_-_Open_Collector_-_SophosCentralBeat_Heartbeat": 1000837,
    "Syslog_-_Open_Collector_-_Webhook": 1000850,
    "Syslog_-_Open_Collector_-_Webhook_OneLogin": 1000848,
    "Syslog_-_Open_Collector_-_Webhook_Zoom": 1000849,
    "Syslog_-_Open_Collector_-_WebhookBeat_Heartbeat": 1000851,
    "Syslog_-_Opengear_Console": 28,
    "Syslog_-_OpenLDAP": 1000305,
    "Syslog_-_Oracle_10g_Audit_Trail": 1000071,
    "Syslog_-_Oracle_11g_Audit_Trail": 1000223,
    "Syslog_-_OSSEC_Alerts": 1000218,
    "Syslog_-_Other": 92,
    "Syslog_-_Outpost24": 1000414,
    "Syslog_-_Palo_Alto_Cortex_XDR": 1000867,
    "Syslog_-_Palo_Alto_Custom_Pipe": 15,
    "Syslog_-_Palo_Alto_Firewall": 1000134,
    "Syslog_-_Palo_Alto_Traps_CEF": 1000729,
    "Syslog_-_Palo_Alto_Traps_Management_Service": 1000796,
    "Syslog_-_Password_Manager_Pro": 21,
    "Syslog_-_pfSense_Firewall": 1000740,
    "Syslog_-_PingFederate_7.2": 1000631,
    "Syslog_-_PingFederate_CEF": 1000770,
    "Syslog_-_Polycom": 1000362,
    "Syslog_-_Postfix": 1000105,
    "Syslog_-_Procera_PacketLogic": 9,
    "Syslog_-_Proofpoint_Spam_Firewall": 141,
    "Syslog_-_Protegrity_Defiance_DPS": 1000085,
    "Syslog_-_QLogic_Infiniband_Switch": 1000449,
    "Syslog_-_Quest_Defender": 1000328,
    "Syslog_-_Radiator_Radius": 4,
    "Syslog_-_RADiFlow_3180_Switch": 1000498,
    "Syslog_-_Radware_Alteon_Load_Balancer": 1000245,
    "Syslog_-_Radware_DefensePro": 1000241,
    "Syslog_-_Radware_Web_Server_Director_Audit_Log": 1000344,
    "Syslog_-_Raritan_KVM": 1000279,
    "Syslog_-_Raz-Lee": 1000428,
    "Syslog_-_RedSeal": 1000547,
    "Syslog_-_Riverbed": 1000156,
    "Syslog_-_RSA_ACE": 190,
    "Syslog_-_RSA_Authentication_Manager_v7.1": 1000233,
    "Syslog_-_RSA_Authentication_Manager_v8.x": 1000656,
    "Syslog_-_RSA_Web_Threat_Detection": 1000512,
    "Syslog_-_RSA_Web_Threat_Detection_5.1": 1000574,
    "Syslog_-_RuggedRouter": 1000093,
    "Syslog_-_Safenet": 1000074,
    "Syslog_-_Sailpoint": 1000640,
    "Syslog_-_Sauce_Labs": 1000704,
    "Syslog_-_SecureAuth_IdP": 1000443,
    "Syslog_-_SecureAuth_IdP_v9": 1000713,
    "Syslog_-_SecureLink": 1000793,
    "Syslog_-_SecureTrack": 1000249,
    "Syslog_-_SEL_3610_Port_Switch": 1000273,
    "Syslog_-_SEL_3620_Ethernet_Security_Gateway": 1000246,
    "Syslog_-_Sentinel_IPS": 1000460,
    "Syslog_-_SentinelOne_CEF": 1000712,
    "Syslog_-_Sguil": 1000719,
    "Syslog_-_Siemens_Scalance_X400": 1000473,
    "Syslog_-_Smoothwall_Firewall": 1000435,
    "Syslog_-_SnapGear_Firewall": 1000409,
    "Syslog_-_Snare_Windows_2003_Event_Log": 1000028,
    "Syslog_-_Snare_Windows_2008_Event_Log": 19,
    "Syslog_-_Snort_IDS": 1000019,
    "Syslog_-_Solaris_(Snare)": 120,
    "Syslog_-_Solaris_Host": 91,
    "Syslog_-_SonicWALL": 106,
    "Syslog_-_SonicWALL_SSL-VPN": 137,
    "Syslog_-_Sophos_Email_Encryption_Appliance": 1000336,
    "Syslog_-_Sophos_UTM": 113,
    "Syslog_-_Sophos_Web_Proxy": 1000399,
    "Syslog_-_Sophos_XG_Firewall": 1000792,
    "Syslog_-_Sourcefire_IDS_3D": 1000080,
    "Syslog_-_Sourcefire_RNA": 1000340,
    "Syslog_-_Spectracom_Network_Time_Server": 1000463,
    "Syslog_-_Splunk_API_-_Checkpoint_Firewall": 1000689,
    "Syslog_-_Splunk_API_-_Cisco_Netflow_V9": 1000697,
    "Syslog_-_Splunk_API_-_Nessus_Vulnerability_Scanner": 1000692,
    "Syslog_-_Squid_Proxy": 2,
    "Syslog_-_StealthBits_Activity_Monitor": 1000844,
    "Syslog_-_STEALTHbits_StealthINTERCEPT": 1000737,
    "Syslog_-_StoneGate_Firewall": 1000291,
    "Syslog_-_Stonesoft_IPS": 1000480,
    "Syslog_-_Stormshield_Network_Security_Firewall": 1000650,
    "Syslog_-_Sycamore_Networks_DNX-88": 1000588,
    "Syslog_-_Sygate_Firewall": 180,
    "Syslog_-_Symantec_Advanced_Threat_Protection_(ATP)_CEF": 1000798,
    "Syslog_-_Symantec_DLP_CEF": 181,
    "Syslog_-_Symantec_Endpoint_Server": 1000077,
    "Syslog_-_Symantec_Messaging_Gateway": 1000828,
    "Syslog_-_Symantec_PGP_Gateway": 1000387,
    "Syslog_-_Symbol_Wireless_Access_Point": 114,
    "Syslog_-_Tanium": 1000674,
    "Syslog_-_Temporary_LST-2": 1000699,
    "Syslog_-_Tenable_SecurityCenter": 1000534,
    "Syslog_-_Thycotic_Secret_Server": 1000519,
    "Syslog_-_Tipping_Point_IPS": 143,
    "Syslog_-_Tipping_Point_SSL_Reverse_Proxy": 1000339,
    "Syslog_-_Top_Layer_IPS": 1000048,
    "Syslog_-_Townsend_Alliance_LogAgent": 1000213,
    "Syslog_-_Trend_Micro_Control_Manager_CEF": 1000750,
    "Syslog_-_Trend_Micro_Deep_Discovery_Inspector": 1000580,
    "Syslog_-_Trend_Micro_Deep_Security_CEF": 1000388,
    "Syslog_-_Trend_Micro_Deep_Security_LEEF": 1000804,
    "Syslog_-_Trend_Micro_IWSVA": 1000330,
    "Syslog_-_Trend_Micro_Vulnerability_Protection_Manager": 1000803,
    "Syslog_-_Tripwire": 192,
    "Syslog_-_Trustwave_NAC": 1000596,
    "Syslog_-_Trustwave_Secure_Web_Gateway": 1000499,
    "Syslog_-_Trustwave_Web_Application_Firewall": 1000065,
    "Syslog_-_Tufin": 1000684,
    "Syslog_-_Tumbleweed_Mailgate_Server": 1000078,
    "Syslog_-_Ubiquiti_UniFi_Security_Gateway": 1000760,
    "Syslog_-_Ubiquiti_UniFi_Switch": 1000757,
    "Syslog_-_Ubiquiti_UniFi_WAP": 1000762,
    "Syslog_-_Untangle": 1000365,
    "Syslog_-_Vamsoft_ORF": 1000458,
    "Syslog_-_Vanguard_Active_Alerts": 1000694,
    "Syslog_-_Varonis_DatAlert": 1000544,
    "Syslog_-_Vasco_Digipass_Identikey_Server": 1000503,
    "Syslog_-_Vectra_Networks": 1000779,
    "Syslog_-_Versa_Networks_SD-WAN": 1000824,
    "Syslog_-_VMWare_ESX/ESXi_Server": 1000000,
    "Syslog_-_VMware_Horizon_View": 1000603,
    "Syslog_-_VMWare_NSX/NSX-T": 1000768,
    "Syslog_-_VMWare_Unified_Access_Gateway": 1000871,
    "Syslog_-_VMWare_vCenter_Server": 1000752,
    "Syslog_-_VMWare_vShield": 1000487,
    "Syslog_-_Voltage_Securemail": 1000543,
    "Syslog_-_Vormetric_CoreGuard": 1000210,
    "Syslog_-_Vormetric_Data_Security_Manager": 1000486,
    "Syslog_-_WALLIX_Bastion": 1000765,
    "Syslog_-_Watchguard_FireBox": 129,
    "Syslog_-_WS2000_Wireless_Access_Point": 1000076,
    "Syslog_-_Wurldtech_SmartFirewall": 198,
    "Syslog_-_Xirrus_Wireless_Array": 1000197,
    "Syslog_-_Zimbra_System_Log": 1000100,
    "Syslog_-_Zix_E-mail_Encryption": 1000654,
    "Syslog_-_Zscaler_Nano_Streaming_Service": 1000546,
    "Syslog_-_ZXT_Load_Balancer": 1000411,
    "Syslog_-_ZyWALL_VPN_Firewall": 1000666,
    "Syslog_Avaya_G450_Media_Gateway": 1000670,
    "Syslog_File_-_AIX_Host": 1000006,
    "Syslog_File_-_BSD_Format": 35,
    "Syslog_File_-_HP-UX_Host": 1000145,
    "Syslog_File_-_IRIX_Host": 1000295,
    "Syslog_File_-_Linux_Host": 103,
    "Syslog_File_-_LogRhythm_Syslog_Generator": 13,
    "Syslog_File_-_MS_2003_Event_Log_(Snare)": 1000039,
    "Syslog_File_-_Oracle_10g_Audit_Trail": 1000072,
    "Syslog_File_-_Oracle_11g_Audit_Trail": 1000222,
    "Syslog_File_-_Solaris_Host": 104,
    "UDLA_-_CA_Single_Sign-On": 1000636,
    "UDLA_-_Deepnet_DualShield": 1000286,
    "UDLA_-_Drupal": 1000496,
    "UDLA_-_Finacle_Core": 1000196,
    "UDLA_-_Finacle_Treasury_Logs": 1000178,
    "UDLA_-_Forcepoint": 1000020,
    "UDLA_-_Gallagher_Command_Centre": 1000810,
    "UDLA_-_iManage_Worksite": 1000732,
    "UDLA_-_ISS_Proventia_SiteProtector_-_IPS": 1000034,
    "UDLA_-_LogRhythm_Enterprise_Monitoring_Solution": 1000314,
    "UDLA_-_LREnhancedAudit": 1000548,
    "UDLA_-_McAfee_ePolicy_Orchestrator_-_Universal_ePOEvents": 1000788,
    "UDLA_-_McAfee_ePolicy_Orchestrator_3.6_-_Events": 158,
    "UDLA_-_McAfee_ePolicy_Orchestrator_4.0_-_ePOEvents": 1000079,
    "UDLA_-_McAfee_ePolicy_Orchestrator_4.5_-_ePOEvents": 1000175,
    "UDLA_-_McAfee_ePolicy_Orchestrator_5.0_-_ePOEvents": 1000531,
    "UDLA_-_McAfee_ePolicy_Orchestrator_5.1_-_ePOEvents": 1000550,
    "UDLA_-_McAfee_ePolicy_Orchestrator_5.3_-_ePOEvents": 1000696,
    "UDLA_-_McAfee_ePolicy_Orchestrator_5.9_-_ePOEvents": 1000761,
    "UDLA_-_McAfee_Network_Access_Control": 1000055,
    "UDLA_-_McAfee_Network_Security_Manager": 1000453,
    "UDLA_-_Microsoft_System_Center_2012_Endpoint_Protection": 1000587,
    "UDLA_-_ObserveIT": 1000605,
    "UDLA_-_Oracle_10g_Audit_Trail": 152,
    "UDLA_-_Oracle_11g_Audit_Trail": 1000171,
    "UDLA_-_Oracle_12C_Unified_Auditing": 1000658,
    "UDLA_-_Oracle_9i_Audit_Trail": 1000040,
    "UDLA_-_Other": 1000576,
    "UDLA_-_SEL_3530_RTAC": 1000285,
    "UDLA_-_SharePoint_2007_AuditData": 1000208,
    "UDLA_-_SharePoint_2010_EventData": 1000415,
    "UDLA_-_SharePoint_2013_EventData": 1000606,
    "UDLA_-_Siemens_Invision": 1000229,
    "UDLA_-_Sophos_Anti-Virus": 1000090,
    "UDLA_-_Sophos_Endpoint_Security_and_Control": 1000735,
    "UDLA_-_Symantec_CSP": 1000505,
    "UDLA_-_Symantec_SEP": 1000520,
    "UDLA_-_Symmetry_Access_Control": 1000270,
    "UDLA_-_VMWare_vCenter_Server": 1000378,
    "UDLA_-_VMWare_vCloud": 1000538,
    "VLS_-_Syslog_-_Infoblox_-_DNS_RPZ": 1000643,
    "VLS_-_Syslog_-_Infoblox_-_Threat_Protection": 1000642
}


class Client(BaseClient):
    def __init__(self, server_url, verify, proxy, headers, auth):
        super().__init__(base_url=server_url, verify=verify, proxy=proxy, headers=headers, auth=auth)

    def alarms_list_request(self, alarm_id=None, alarm_status=None, offset=None, count=None, alarm_rule_name=None,
                            entity_name=None, case_association=None, created_after=None):
        if alarm_id:
            response = self._http_request('GET', f'lr-alarm-api/alarms/{alarm_id}')
            alarms = [response.get('alarmDetails')]
        else:
            if alarm_status:
                alarm_status = next((id for id, status in ALARM_STATUS.items() if status == alarm_status))

            params = assign_params(alarmStatus=alarm_status, offset=offset, count=count,
                                   associatedCases=case_association,
                                   alarmRuleName=alarm_rule_name, entityName=entity_name, orderby='DateInserted')

            response = self._http_request('GET', 'lr-alarm-api/alarms/', params=params)
            alarms = response.get('alarmsSearchDetails')

            if created_after:
                filtered_alarms = []
                created_after = dateparser.parse(created_after)

                for alarm in alarms:
                    date_inserted = dateparser.parse(alarm.get('dateInserted'))
                    if date_inserted > created_after:
                        filtered_alarms.append(alarm)
                    else:
                        break

                alarms = filtered_alarms

        if alarms:
            for alarm in alarms:
                alarm['alarmStatus'] = ALARM_STATUS[alarm['alarmStatus']]

        return alarms, response

    def alarm_update_request(self, alarm_id, alarm_status, rbp):
        data = {"alarmStatus": alarm_status if alarm_status else None,
                "rBP": rbp if rbp else None}

        # delete empty values
        data = {k: v for k, v in data.items() if v}

        response = self._http_request('PATCH', f'lr-alarm-api/alarms/{alarm_id}', json_data=data)

        return response

    def alarm_add_comment_request(self, alarm_id, alarm_comment):
        data = {"alarmComment": alarm_comment}

        response = self._http_request('POST', f'lr-alarm-api/alarms/{alarm_id}/comment', json_data=data)

        return response

    def alarm_history_list_request(self, alarm_id, person_id, date_updated, type_, offset, count):
        params = assign_params(personId=person_id, dateUpdated=date_updated, type=type_, offset=offset, count=count)

        response = self._http_request('GET', f'lr-alarm-api/alarms/{alarm_id}/history', params=params)

        alarm_history = response.get('alarmHistoryDetails')
        return alarm_history, response

    def alarm_events_list_request(self, alarm_id):  # pragma: no cover
        response = self._http_request('GET', f'lr-alarm-api/alarms/{alarm_id}/events')

        alarm_events = response.get('alarmEventsDetails')
        return alarm_events, response

    def alarm_summary_request(self, alarm_id):  # pragma: no cover
        response = self._http_request('GET', f'lr-alarm-api/alarms/{alarm_id}/summary')

        alarm_summary = response.get('alarmSummaryDetails')
        return alarm_summary, response

    def cases_list_request(self, case_id=None, timestamp_filter_type=None, timestamp=None, priority=None, status=None,
                           owners=None, tags=None, text=None, evidence_type=None, reference_id=None, external_id=None,
                           offset=None, count=None):

        params = assign_params(priority=priority, statusNumber=status, ownerNumber=owners, tagNumber=tags, text=text,
                               evidenceType=evidence_type, referenceId=reference_id, externalId=external_id)
        headers = self._headers

        headers['orderBy'] = 'dateCreated'

        if timestamp_filter_type and timestamp:
            headers[timestamp_filter_type] = timestamp
        if offset:
            headers['offset'] = offset
        if count:
            headers['count'] = str(count)

        cases = self._http_request('GET', 'lr-case-api/cases', params=params, headers=headers)

        if case_id:
            cases = next((case for case in cases if case.get('id') == case_id), None)
        return cases

    def case_create_request(self, name, priority, external_id, due_date, summary):
        data = {"name": name, "priority": int(priority), "externalId": external_id, "dueDate": due_date,
                "summary": summary}

        # delete empty values
        data = {k: v for k, v in data.items() if v}

        response = self._http_request('POST', 'lr-case-api/cases', json_data=data)

        return response

    def case_update_request(self, case_id, name, priority, external_id, due_date, summary, entity_id, resolution):
        data = {"name": name, "externalId": external_id, "dueDate": due_date,
                "summary": summary, "entityId": int(entity_id) if entity_id else None,
                "resolution": int(resolution) if resolution else None,
                "priority": int(priority) if priority else None}

        # delete empty values
        data = {k: v for k, v in data.items() if v}

        response = self._http_request('PUT', f'lr-case-api/cases/{case_id}', json_data=data)

        return response

    def case_status_change_request(self, case_id, status):
        status_number = CASE_STATUS.get(status)

        data = {"statusNumber": status_number}

        response = self._http_request(
            'PUT', f'lr-case-api/cases/{case_id}/actions/changeStatus/', json_data=data)

        return response

    def case_evidence_list_request(self, case_id, evidence_number=None, evidence_type=None, status=None):
        params = assign_params(type=evidence_type, status=status)

        evidences = self._http_request('GET', f'lr-case-api/cases/{case_id}/evidence', params=params)

        if evidence_number:
            evidences = next((evidence for evidence in evidences if evidence.get('number') == int(evidence_number)), None)
        return evidences

    def case_alarm_evidence_add_request(self, case_id, alarm_numbers):  # pragma: no cover
        alarms = [int(alarm) for alarm in alarm_numbers]
        data = {"alarmNumbers": alarms}

        response = self._http_request(
            'POST', f'lr-case-api/cases/{case_id}/evidence/alarms', json_data=data)

        return response

    def case_note_evidence_add_request(self, case_id, note):  # pragma: no cover
        data = {"text": note}
        response = self._http_request(
            'POST', f'lr-case-api/cases/{case_id}/evidence/note', json_data=data)

        return response

    def case_file_evidence_add_request(self, case_id, entry_id):
        headers = self._headers
        headers['Content-Type'] = 'multipart/form-data; boundary=---------------------------'

        get_file_path_res = demisto.getFilePath(entry_id)
        file_path = get_file_path_res["path"]
        file_name = get_file_path_res["name"]
        with open(file_path, 'rb') as file:
            file_bytes = file.read()

        file_content = file_bytes.decode('iso-8859-1')
        content_type = mimetypes.guess_type(file_path)[0]

        data = '-----------------------------\n' \
               f'Content-Disposition: form-data; name="file"; filename="{file_name}"\n' \
               f'Content-Type: {content_type}\n\n' \
               f'{file_content}\n' \
               '-----------------------------\n' \
               'Content-Disposition: form-data; name="note"\n\n' \
               '-------------------------------'

        response = self._http_request('POST', f'lr-case-api/cases/{case_id}/evidence/file', data=data)

        return response

    def case_evidence_delete_request(self, case_id, evidence_number):  # pragma: no cover
        self._http_request('DELETE', f'lr-case-api/cases/{case_id}/evidence/{evidence_number}', resp_type='text')

    def case_file_evidence_download_request(self, case_id, evidence_number):  # pragma: no cover
        response = self._http_request(
            'GET', f'lr-case-api/cases/{case_id}/evidence/{evidence_number}/download/', resp_type='other')

        filename = re.findall("filename=\"(.+)\"", response.headers['Content-Disposition'])[0]
        return fileResult(filename, response.content)

    def case_tags_add_request(self, case_id, tag_numbers):  # pragma: no cover
        tags = [int(tag) for tag in tag_numbers]
        data = {"numbers": tags}

        response = self._http_request(
            'PUT', f'lr-case-api/cases/{case_id}/actions/addTags', json_data=data)

        return response

    def case_tags_remove_request(self, case_id, tag_numbers):
        tags = [int(tag) for tag in tag_numbers]
        data = {"numbers": tags}

        response = self._http_request(
            'PUT', f'lr-case-api/cases/{case_id}/actions/removeTags', json_data=data)

        return response

    def tags_list_request(self, tag_name, offset, count):
        params = assign_params(tag=tag_name)
        headers = self._headers

        if offset:
            headers['offset'] = offset
        if count:
            headers['count'] = count

        response = self._http_request('GET', 'lr-case-api/tags', params=params, headers=headers)

        return response

    def case_collaborators_list_request(self, case_id):
        return self._http_request('GET', f'lr-case-api/cases/{case_id}/collaborators')

    def case_collaborators_update_request(self, case_id, owner, collaborators):
        collaborators = [int(collaborator) for collaborator in collaborators]

        data = {"owner": int(owner),
                "collaborators": collaborators}

        response = self._http_request(
            'PUT', f'lr-case-api/cases/{case_id}/collaborators', json_data=data)

        return response

    def entities_list_request(self, entity_id, parent_entity_id, offset, count):
        params = assign_params(parentEntityId=parent_entity_id, offset=offset, count=count)

        entities = self._http_request('GET', 'lr-admin-api/entities', params=params)
        if entity_id:
            entities = next((entity for entity in entities if entity.get('id') == int(entity_id)), None)
        return entities

    def hosts_list_request(self, host_name=None, entity_name=None, record_status=None, offset=None,
                           count=None, endpoint_id_list=None, endpoint_hostname_list=None):
        params = assign_params(name=host_name, entity=entity_name, recordStatus=record_status, offset=offset, count=count)

        hosts = self._http_request('GET', 'lr-admin-api/hosts', params=params)

        if endpoint_id_list:
            endpoint_id_list = [int(id_) for id_ in endpoint_id_list]
            hosts = list(filter(lambda host: host.get('id') in endpoint_id_list, hosts))

        if endpoint_hostname_list:
            hosts = list(filter(lambda host: host.get('name') in endpoint_hostname_list, hosts))

        return hosts

    def users_list_request(self, user_ids, entity_ids, user_status, offset, count):
        params = assign_params(id=user_ids, entityIds=entity_ids, userStatus=user_status, offset=offset, count=count)

        response = self._http_request('GET', 'lr-admin-api/users', params=params)

        return response

    def lists_get_request(self, list_type, list_name, can_edit):
        headers = self._headers

        if list_type:
            headers['listType'] = list_type

        if list_name:
            headers['name'] = list_name

        if can_edit:
            headers['canEdit'] = can_edit

        response = self._http_request('GET', 'lr-admin-api/lists', headers=headers)

        return response

    def list_summary_create_update_request(self, list_type, name, enabled, use_patterns, replace_existing, read_access,
                                           write_access, restricted_read, entity_name, need_to_notify, does_expire, owner):
        data = {"autoImportOption": {"enabled": enabled, "replaceExisting": replace_existing, "usePatterns": use_patterns},
                "doesExpire": does_expire, "entityName": entity_name, "owner": int(owner),
                "listType": list_type, "name": name, "needToNotify": need_to_notify, "readAccess": read_access,
                "restrictedRead": restricted_read, "writeAccess": write_access}

        response = self._http_request('POST', 'lr-admin-api/lists', json_data=data)

        return response

    def list_details_and_items_get_request(self, list_id, max_items):
        raw_response = self._http_request('GET', f'lr-admin-api/lists/{list_id}')
        response = raw_response.copy()
        if max_items and response.get('items'):
            items = response.get('items')[:int(max_items)]
            response['items'] = items
        return response, raw_response

    def list_items_add_request(self, list_id, items):
        if type(items) is dict:
            items = [items]
        data = {"items": items}
        response = self._http_request('POST', f'lr-admin-api/lists/{list_id}/items', json_data=data)

        return response

    def list_items_remove_request(self, list_id, items):
        if type(items) is dict:
            items = [items]
        data = {"items": items}

        response = self._http_request('DELETE', f'lr-admin-api/lists/{list_id}/items', json_data=data)

        return response

    def execute_search_query_request(self, number_of_days, source_type, host_name, username, subject, sender,
                                     recipient, hash_, url, process_name, object_, ipaddress, max_message,
                                     query_timeout, entity_id):
        # Create filter query
        query = []

        arguments = locals().copy()

        for field_key, field_val in arguments.items():
            if field_val and QUERY_TYPES_MAP.get(field_key):
                query_type = QUERY_TYPES_MAP[field_key]
                filter_type = query_type.get('filter_type')
                value_type = query_type.get('value_type')

                if field_key == 'source_type' and field_val != 'all':
                    query.append(self.generate_query_item(filter_type, value_type, SOURCE_TYPE_MAP[field_val]))
                else:
                    query.append(self.generate_query_item(filter_type, value_type, field_val))

        # Search and get TaskID
        data = {
            "maxMsgsToQuery": int(max_message),
            "logCacheSize": 10000,
            "queryTimeout": int(query_timeout),
            "queryRawLog": True,
            "queryEventManager": False,
            "dateCriteria": {
                "useInsertedDate": False,
                "lastIntervalValue": int(number_of_days),
                "lastIntervalUnit": 4
            },
            "queryLogSources": [],
            "queryFilter": {
                "msgFilterType": 2,
                "isSavedFilter": False,
                "filterGroup": {
                    "filterItemType": 1,
                    "fieldOperator": 1,
                    "filterMode": 1,
                    "filterGroupOperator": 0,
                    "filterItems": query
                }
            }
        }

        response = self._http_request('POST', 'lr-search-api/actions/search-task', json_data=data)

        return response

    def generate_query_item(self, filter_type, value_type, value):
        if value_type == 2:
            value = int(value)
        elif value_type == 5:
            value = str(value)
        else:
            value = {
                "value": value,
                "matchType": 2
            }

        query = {
            "filterItemType": 0,
            "fieldOperator": 1,
            "filterMode": 1,
            "values": [
                {
                    "filterType": filter_type,
                    "valueType": value_type,
                    "value": value
                }
            ]
        }

        return query

    def get_query_result_request(self, task_id, page_size):
        data = {
            'data': {
                'searchGuid': task_id,
                'search': {
                    'sort': [],
                    'groupBy': [
                        'string'
                    ],
                    'fields': []
                },
                'paginator': {
                    'origin': 0,
                    'page_size': int(page_size)
                }
            }
        }

        response = self._http_request('POST', 'lr-search-api/actions/search-result', json_data=data)

        return response

    def add_host_request(self, entity_id, entity_name, name, short_desc, long_desc, risk_level, threat_level,
                         threat_level_comments, status, host_zone, use_eventlog_credentials, os, os_type):
        data = {
            "id": -1,
            "entity": {
                "name": entity_name
            },
            "name": name,
            "shortDesc": short_desc,
            "longDesc": long_desc,
            "riskLevel": risk_level,
            "threatLevel": threat_level,
            "threatLevelComments": threat_level_comments,
            "recordStatusName": status,
            "hostZone": host_zone,
            "os": os,
            "useEventlogCredentials": use_eventlog_credentials,
            "osType": os_type
        }

        if entity_id:
            data['entity']['id'] = int(entity_id)

        # delete empty values
        data = {k: v for k, v in data.items() if isinstance(v, bool) or v}

        response = self._http_request('POST', 'lr-admin-api/hosts', json_data=data)

        return response

    def hosts_status_update(self, host_id, status):
        data = [{'hostId': int(host_id), 'status': status}]
        response = self._http_request('PUT', 'lr-admin-api/hosts/status', json_data=data)
        return response

    def networks_list_request(self, network_id, name, record_status, bip, eip, offset, count):
        if network_id:
            return self._http_request('GET', f'lr-admin-api/networks/{network_id}')
        else:
            params = assign_params(name=name, recordStatus=record_status, BIP=bip, EIP=eip, offset=offset, count=count)
            return self._http_request('GET', 'lr-admin-api/networks/', params=params)


def alarms_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    alarm_status = args.get('alarm_status')
    alarm_rule_name = args.get('alarm_rule_name')
    entity_name = args.get('entity_name')
    case_association = args.get('case_association')
    offset = args.get('offset')
    count = args.get('count')

    alarms, raw_response = client.alarms_list_request(alarm_id, alarm_status, offset, count, alarm_rule_name,
                                                      entity_name, case_association)

    if alarms:
        hr = tableToMarkdown('Alarms', alarms, headerTransform=pascalToSpace, headers=ALARM_HEADERS, removeNull=True)
    else:
        hr = 'No alarms were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Alarm',
        outputs_key_field='alarmId',
        outputs=alarms,
        raw_response=raw_response,
    )

    return command_results


def alarm_update_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    alarm_status = args.get('alarm_status')
    rbp = args.get('rbp')

    if not alarm_status and not rbp:
        raise DemistoException('alarm_status and rbp arguments are empty, please provide at least one of them.')

    response = client.alarm_update_request(alarm_id, alarm_status, rbp)
    command_results = CommandResults(
        readable_output=f'Alarm {alarm_id} has been updated.',
        raw_response=response,
    )

    return command_results


def alarm_add_comment_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    alarm_comment = args.get('alarm_comment')

    response = client.alarm_add_comment_request(alarm_id, alarm_comment)
    command_results = CommandResults(
        readable_output=f'Comment added successfully to the alarm {alarm_id}.',
        raw_response=response,
    )

    return command_results


def alarm_history_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    person_id = args.get('person_id')
    date_updated = args.get('date_updated')
    type_ = args.get('type')
    offset = args.get('offset')
    count = args.get('count')

    alarm_history, raw_response = client.alarm_history_list_request(alarm_id, person_id, date_updated, type_, offset, count)

    if alarm_history:
        hr = tableToMarkdown(f'History for alarm {alarm_id}', alarm_history, headerTransform=pascalToSpace)
    else:
        hr = f'No history records found for alarm {alarm_id}.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.AlarmHistory',
        outputs_key_field='',
        outputs=alarm_history,
        raw_response=raw_response,
    )

    return command_results


def alarm_events_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    if not alarm_id:
        raise DemistoException('Invalid alarm_id')

    alarm_events, raw_response = client.alarm_events_list_request(alarm_id)

    if alarm_events:
        hr = tableToMarkdown(f'Events for alarm {alarm_id}', alarm_events, headerTransform=pascalToSpace,
                             headers=ALARM_EVENTS_HEADERS)
    else:
        hr = f'No events found for alarm {alarm_id}.'

    [event.update({'alarmId': int(alarm_id)}) for event in alarm_events]

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.AlarmEvents',
        outputs_key_field='alarmId',
        outputs=alarm_events,
        raw_response=raw_response,
    )

    return command_results


def alarm_summary_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    alarm_id = args.get('alarm_id')
    if not alarm_id:
        raise DemistoException('Invalid alarm_id')

    alarm_summary, raw_response = client.alarm_summary_request(alarm_id)
    alarm_summary['alarmId'] = int(alarm_id)
    ec = alarm_summary.copy()

    alarm_event_summary = alarm_summary.get('alarmEventSummary')
    if alarm_event_summary:
        del alarm_summary['alarmEventSummary']
        hr = tableToMarkdown('Alarm summary', alarm_summary, headerTransform=pascalToSpace)
        hr = hr + tableToMarkdown('Alarm event summary', alarm_event_summary, headerTransform=pascalToSpace)
    else:
        hr = tableToMarkdown(f'Alarm {alarm_id} summary', alarm_summary, headerTransform=pascalToSpace)

    alarm_summary['alarmId'] = int(alarm_id)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.AlarmSummary',
        outputs_key_field='alarmId',
        outputs=ec,
        raw_response=raw_response,
    )

    return command_results


def cases_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    timestamp_filter_type = args.get('timestamp_filter_type')
    timestamp = args.get('timestamp')
    priority = args.get('priority')
    status = args.get('status')
    owners = args.get('owners')
    tags = args.get('tags')
    text = args.get('text')
    evidence_type = args.get('evidence_type')
    reference_id = args.get('reference_id')
    external_id = args.get('external_id')
    offset = args.get('offset')
    count = args.get('count')

    cases = client.cases_list_request(case_id, timestamp_filter_type, timestamp, priority, status, owners, tags,
                                      text, evidence_type, reference_id, external_id, offset, count)

    if cases:
        hr = tableToMarkdown('Cases', cases, headerTransform=pascalToSpace)
    else:
        hr = 'No cases found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=cases,
        raw_response=cases,
    )

    return command_results


def case_create_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    name = args.get('name')
    priority = args.get('priority')
    external_id = args.get('external_id')
    due_date = args.get('due_date')
    summary = args.get('summary')

    response = client.case_create_request(name, priority, external_id, due_date, summary)

    hr = tableToMarkdown('Case created successfully', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def case_update_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    name = args.get('name')
    priority = args.get('priority')
    external_id = args.get('external_id')
    due_date = args.get('due_date')
    summary = args.get('summary')
    entity_id = args.get('entity_id')
    resolution = args.get('resolution')

    response = client.case_update_request(case_id, name, priority, external_id, due_date, summary, entity_id, resolution)

    hr = tableToMarkdown(f'Case {case_id} updated successfully', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def case_status_change_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    status = args.get('status')

    response = client.case_status_change_request(case_id, status)

    hr = tableToMarkdown('Case status updated successfully', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def case_evidence_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    evidence_number = args.get('evidence_number')
    evidence_type = args.get('evidence_type')
    status = args.get('status')

    evidences = client.case_evidence_list_request(case_id, evidence_number, evidence_type, status)

    if evidences:
        hr = tableToMarkdown(f'Evidences for case {case_id}', evidences, headerTransform=pascalToSpace,
                             headers=CASE_EVIDENCES_HEADERS)
    else:
        hr = f'No evidences found for case {case_id}.'

    ec = {'CaseID': case_id, 'Evidences': evidences}

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.CaseEvidence',
        outputs_key_field='CaseID',
        outputs=ec,
        raw_response=evidences,
    )

    return command_results


def case_alarm_evidence_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    alarm_numbers = argToList(args.get('alarm_numbers'))

    evidences = client.case_alarm_evidence_add_request(case_id, alarm_numbers)

    hr = tableToMarkdown(f'Alarms added as evidence to case {case_id} successfully', evidences,
                         headerTransform=pascalToSpace, headers=CASE_EVIDENCES_HEADERS)

    ec = [{'CaseID': case_id, 'Evidences': evidences}]

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.AlarmEvidence',
        outputs_key_field='CaseID',
        outputs=ec,
        raw_response=evidences,
    )

    return command_results


def case_note_evidence_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    note = args.get('note')

    evidences = client.case_note_evidence_add_request(case_id, note)
    hr = tableToMarkdown(f'Note added as evidence to case {case_id} successfully', evidences,
                         headerTransform=pascalToSpace, headers=CASE_EVIDENCES_HEADERS)

    ec = [{'CaseID': case_id, 'Evidences': evidences}]

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.NoteEvidence',
        outputs_key_field='',
        outputs=ec,
        raw_response=evidences,
    )

    return command_results


def case_file_evidence_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    entry_id = args.get('entryId')

    evidences = client.case_file_evidence_add_request(case_id, entry_id)
    hr = tableToMarkdown(f'File added as evidence to case {case_id} successfully', evidences,
                         headerTransform=pascalToSpace, headers=CASE_EVIDENCES_HEADERS)

    ec = [{'CaseID': case_id, 'Evidences': evidences}]

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.FileEvidence',
        outputs_key_field='',
        outputs=ec,
        raw_response=evidences,
    )

    return command_results


def case_evidence_delete_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    evidence_number = args.get('evidence_number')

    client.case_evidence_delete_request(case_id, evidence_number)
    command_results = CommandResults(
        readable_output=f'Evidence deleted successfully from case {case_id}.',
    )

    return command_results


def case_file_evidence_download_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    evidence_number = args.get('evidence_number')

    return client.case_file_evidence_download_request(case_id, evidence_number)


def case_tags_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    tag_numbers = argToList(args.get('tag_numbers'))

    response = client.case_tags_add_request(case_id, tag_numbers)
    hr = tableToMarkdown(f'Tags added successfully to case {case_id}', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def case_tags_remove_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    tag_numbers = argToList(args.get('tag_numbers'))

    response = client.case_tags_remove_request(case_id, tag_numbers)
    hr = tableToMarkdown(f'Tags removed successfully from case {case_id}', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Case',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def tags_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    tag_name = args.get('tag_name')
    offset = args.get('offset')
    count = args.get('count')

    response = client.tags_list_request(tag_name, offset, count)
    if response:
        hr = tableToMarkdown('Tags', response, headerTransform=pascalToSpace, headers=TAG_HEADERS)
    else:
        hr = 'No tags were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Tag',
        outputs_key_field='number',
        outputs=response,
        raw_response=response,
    )

    return command_results


def case_collaborators_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')

    response = client.case_collaborators_list_request(case_id)
    collaborators = response.get('collaborators')

    hr = tableToMarkdown('Case owner', response.get('owner'), headerTransform=pascalToSpace)
    if collaborators:
        hr = hr + tableToMarkdown('Case collaborators', collaborators, headerTransform=pascalToSpace)

    ec = response.copy()
    ec['CaseID'] = case_id

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.CaseCollaborator',
        outputs_key_field='CaseID',
        outputs=ec,
        raw_response=response,
    )

    return command_results


def case_collaborators_update_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    case_id = args.get('case_id')
    owner = args.get('owner')
    collaborators = argToList(args.get('collaborators'))

    response = client.case_collaborators_update_request(case_id, owner, collaborators)
    collaborators = response.get('collaborators')

    hr = f'### Case {case_id} updated successfully\n'
    hr = hr + tableToMarkdown('Case owner', response.get('owner'), headerTransform=pascalToSpace)
    if collaborators:
        hr = hr + tableToMarkdown('Case collaborators', collaborators, headerTransform=pascalToSpace)

    ec = response.copy()
    ec['CaseID'] = case_id

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.CaseCollaborator',
        outputs_key_field='CaseID',
        outputs=ec,
        raw_response=response,
    )

    return command_results


def entities_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    entity_id = args.get('entity_id')
    parent_entity_id = args.get('parent_entity_id')
    offset = args.get('offset')
    count = args.get('count')

    response = client.entities_list_request(entity_id, parent_entity_id, offset, count)
    if response:
        hr = tableToMarkdown('Entities', response, headerTransform=pascalToSpace, headers=ENTITY_HEADERS)
    else:
        hr = 'No entities were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Entity',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def hosts_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    host_id = args.get('host_id')
    host_name = args.get('host_name')
    entity_name = args.get('entity_name')
    record_status = args.get('record_status')
    offset = args.get('offset')
    count = args.get('count')
    host_ids = [host_id] if host_id else []

    response = client.hosts_list_request(host_name, entity_name, record_status, offset, count, host_ids)
    if response:
        hr = tableToMarkdown('Hosts', response, headerTransform=pascalToSpace)
    else:
        hr = 'No hosts were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Host',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def users_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    user_ids = args.get('user_ids')
    entity_ids = args.get('entity_ids')
    user_status = args.get('user_status')
    offset = args.get('offset')
    count = args.get('count')

    response = client.users_list_request(user_ids, entity_ids, user_status, offset, count)
    if response:
        hr = tableToMarkdown('Users', response, headerTransform=pascalToSpace, headers=USER_HEADERS)
    else:
        hr = 'No users were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.User',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def lists_get_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    list_type = args.get('list_type')
    list_name = args.get('list_name')
    can_edit = args.get('can_edit')

    response = client.lists_get_request(list_type, list_name, can_edit)
    if response:
        hr = tableToMarkdown('Lists', response, headerTransform=pascalToSpace, headers=LIST_HEADERS)
    else:
        hr = 'No lists were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.List',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def list_summary_create_update_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    list_type = args.get('list_type')
    name = args.get('name')
    enabled = argToBoolean(args.get('enabled'))
    use_patterns = argToBoolean(args.get('use_patterns'))
    replace_existing = argToBoolean(args.get('replace_existing'))
    read_access = args.get('read_access')
    write_access = args.get('write_access')
    restricted_read = argToBoolean(args.get('restricted_read'))
    entity_name = args.get('entity_name')
    need_to_notify = argToBoolean(args.get('need_to_notify'))
    does_expire = argToBoolean(args.get('does_expire'))
    owner = args.get('owner')

    response = client.list_summary_create_update_request(
        list_type, name, enabled, use_patterns, replace_existing, read_access, write_access, restricted_read, entity_name,
        need_to_notify, does_expire, owner)

    hr = tableToMarkdown('List created successfully', response, headerTransform=pascalToSpace, headers=LIST_HEADERS)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.List',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def list_details_and_items_get_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    list_guid = args.get('list_guid')
    max_items = args.get('max_items')

    response, raw_response = client.list_details_and_items_get_request(list_guid, max_items)
    response = response.copy()
    list_items = response.get('items')
    response.pop('items', None)

    hr = tableToMarkdown(f'List {list_guid} details', response, headerTransform=pascalToSpace, headers=LIST_HEADERS)
    if list_items:
        hr = hr + tableToMarkdown('List items', list_items, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.ListDetails',
        outputs_key_field='guid',
        outputs=raw_response,
        raw_response=raw_response,
    )

    return command_results


def list_items_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    list_guid = args.get('list_guid')
    items_json = args.get('items')
    if not items_json:
        raise DemistoException('Invalid items_json')

    try:
        items = json.loads(items_json)
    except ValueError as e:
        demisto.error(f'Unable to parse the items arg in lr-list-items-add command: {e}')
        raise DemistoException('Unable to parse JSON string. Please verify the items argument is valid.')

    response = client.list_items_add_request(list_guid, items)
    hr = tableToMarkdown(f'The item added to the list {list_guid}.', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.ListItemsAdd',
        outputs_key_field='guid',
        outputs=response,
        raw_response=response,
    )

    return command_results


def list_items_remove_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    list_guid = args.get('list_guid')
    items_json = args.get('items')
    if not items_json:
        raise DemistoException('Invalid items_json')

    try:
        items = json.loads(items_json)
    except ValueError as e:
        demisto.error(f'Unable to parse the items arg in lr-list-items-remove command: {e}')
        raise DemistoException('Unable to parse JSON string. Please verify the items argument is valid.')

    response = client.list_items_remove_request(list_guid, items)
    hr = tableToMarkdown(f'The item deleted from the list {list_guid}.', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.ListItemsRemove',
        outputs_key_field='guid',
        outputs=response,
        raw_response=response,
    )

    return command_results


def execute_search_query_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    number_of_days = args.get('number_of_days')
    search_name = args.get('search_name')
    source_type = args.get('source_type')
    host_name = args.get('host_name')
    username = args.get('username')
    subject = args.get('subject')
    sender = args.get('sender')
    recipient = args.get('recipient')
    hash_ = args.get('hash')
    url = args.get('url')
    process_name = args.get('process_name')
    object_ = args.get('object')
    ipaddress = args.get('ip_address')
    max_message = args.get('max_message')
    query_timeout = args.get('query_timeout')
    entity_id = args.get('entity_id')
    page_size = args.get('page_size', 50)
    interval_in_secs = int(args.get('interval_in_seconds', 10))

    response = client.execute_search_query_request(number_of_days, source_type, host_name, username, subject, sender,
                                                   recipient, hash_, url, process_name, object_, ipaddress, max_message,
                                                   query_timeout, entity_id)
    task_id = response.get('TaskId')
    ec = {'TaskId': task_id, 'StatusMessage': response.get('StatusMessage')}

    if not search_name:
        search_name = f'LogRhythm search {datetime.now()}'
    ec['SearchName'] = search_name

    if not is_demisto_version_ge('6.2.0'):  # only 6.2.0 version and above support polling command.
        return CommandResults(
            readable_output=f'New search query created, Task ID={task_id}',
            outputs_prefix='LogRhythm.Search',
            outputs_key_field='TaskId',
            outputs=ec,
            raw_response=response,
        )

    get_results_args = {'task_id': task_id, 'page_size': page_size}
    query_results = client.get_query_result_request(task_id, page_size)
    items = query_results.get('Items', [])
    status = query_results.get('TaskStatus')

    if items:
        hr = tableToMarkdown(f'Search results for task {task_id}', items, headerTransform=pascalToSpace)
    else:
        hr = f'Task status: {status}'

    ec['TaskId'] = task_id
    ec['TaskStatus'] = status
    ec['Results'] = items

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Search',
        outputs_key_field='TaskId',
        outputs=ec,
        raw_response=query_results,
    )

    if status == 'Searching':
        scheduled_command = ScheduledCommand(command='lr-get-query-result', next_run_in_seconds=interval_in_secs,
                                             args=get_results_args, timeout_in_seconds=600)
        command_results.scheduled_command = scheduled_command
        return command_results

    return command_results


def get_query_result_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    task_id = args.get('task_id')
    page_size = args.get('page_size')

    response = client.get_query_result_request(task_id, page_size)

    items = response.get('Items')
    status = response.get('TaskStatus')
    if items:
        hr = tableToMarkdown(f'Search results for task {task_id}', items, headerTransform=pascalToSpace)
    else:
        hr = f'Task status: {status}'

    ec = [{'TaskId': task_id, 'TaskStatus': status, 'Results': items}]

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Search',
        outputs_key_field='TaskId',
        outputs=ec,
        raw_response=response,
    )

    return command_results


def add_host_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    entity_id = args.get('entity-id')
    entity_name = args.get('entity-name')
    name = args.get('name')
    short_desc = args.get('short-description')
    long_desc = args.get('long-description')
    risk_level = args.get('risk-level')
    threat_level = args.get('threat-level')
    threat_level_comments = args.get('threat-level-comments')
    status = args.get('host-status')
    host_zone = args.get('host-zone')
    use_eventlog_credentials = argToBoolean(args.get('use-eventlog-credentials'))
    os_type = args.get('os-type')
    os = args.get('os')

    response = client.add_host_request(entity_id, entity_name, name, short_desc, long_desc, risk_level, threat_level,
                                       threat_level_comments, status, host_zone, use_eventlog_credentials,
                                       os, os_type)

    hr = tableToMarkdown('Host added successfully', response, headerTransform=pascalToSpace)

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Host',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def hosts_status_update_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    host_id = args.get('host_id')
    status = args.get('host_status')

    response = client.hosts_status_update(host_id, status)
    command_results = CommandResults(
        readable_output=f'Host status updated successfully to {status}.',
        raw_response=response,
    )

    return command_results


def networks_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:  # pragma: no cover
    network_id = args.get('network_id')
    name = args.get('name')
    record_status = args.get('record_status')
    bip = args.get('bip')
    eip = args.get('eip')
    count = args.get('count')
    offset = args.get('offset')

    response = client.networks_list_request(network_id, name, record_status, bip, eip, offset, count)
    if response:
        hr = tableToMarkdown('Networks', response, headerTransform=pascalToSpace, headers=NETWORK_HEADERS)
    else:
        hr = 'No networks were found.'

    command_results = CommandResults(
        readable_output=hr,
        outputs_prefix='LogRhythm.Network',
        outputs_key_field='id',
        outputs=response,
        raw_response=response,
    )

    return command_results


def endpoint_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]:  # pragma: no cover
    endpoint_id_list = argToList(args.get('id'))
    endpoint_hostname_list = argToList(args.get('hostname'))

    endpoints = client.hosts_list_request(endpoint_id_list=endpoint_id_list,
                                          endpoint_hostname_list=endpoint_hostname_list)

    if type(endpoints) is dict:
        endpoints = [endpoints]

    command_results = []

    if endpoints:
        for endpoint in endpoints:

            hr = tableToMarkdown('Logrhythm endpoint', endpoint, headerTransform=pascalToSpace)

            endpoint_indicator = Common.Endpoint(
                id=endpoint.get('id'),
                hostname=endpoint.get('name'),
                os=endpoint.get('os'),
                os_version=endpoint.get('osVersion'),
                status='Online' if endpoint.get('recordStatusName') == "Active" else 'Offline')

            command_results.append(CommandResults(
                readable_output=hr,
                raw_response=endpoint,
                indicator=endpoint_indicator,
            ))

    else:
        command_results.append(CommandResults(
            readable_output="No endpoints were found.",
            raw_response=endpoints,
        ))
    return command_results


def test_module(client: Client, is_fetch: bool, fetch_type: str, cases_max_fetch: int, alarms_max_fetch: int,
                fetch_time: str) -> None:  # pragma: no cover
    client.lists_get_request(None, None, None)
    if is_fetch:
        fetch_incidents_command(client, fetch_type, cases_max_fetch, alarms_max_fetch, fetch_time)
    return_results('ok')


def fetch_incidents_command(client: Client, fetch_type: str, cases_max_fetch: int, alarms_max_fetch: int,
                            fetch_time: str, alarm_status_filter: str = '', alarm_rule_name_filter: str = '',
                            case_tags_filter: str = '', case_status_filter: str = '',
                            case_priority_filter: str = '', fetch_case_evidences=False):  # pragma: no cover
    if fetch_type == 'Both':
        case_incidents = fetch_cases(client, cases_max_fetch, fetch_time, fetch_case_evidences,
                                     case_tags_filter, case_status_filter, case_priority_filter)
        alarm_incidents = fetch_alarms(client, alarms_max_fetch, fetch_time,
                                       alarm_status_filter, alarm_rule_name_filter)
        return case_incidents + alarm_incidents
    elif fetch_type == 'Alarms':
        return fetch_alarms(client, alarms_max_fetch, fetch_time, alarm_status_filter, alarm_rule_name_filter)
    elif fetch_type == 'Cases':
        return fetch_cases(client, cases_max_fetch, fetch_time, fetch_case_evidences,
                           case_tags_filter, case_status_filter, case_priority_filter)


def fetch_alarms(client: Client, limit: int, fetch_time: str, alarm_status_filter: str,
                 alarm_rule_name_filter: str):  # pragma: no cover
    alarm_incidents = []
    last_run = demisto.getLastRun()
    alarm_last_run = last_run.get('AlarmLastRun')
    first_run = dateparser.parse(fetch_time).strftime("%Y-%m-%dT%H:%M:%S")

    alarms_list_args = {'count': limit}

    if alarm_last_run:
        alarms_list_args['created_after'] = alarm_last_run
    elif first_run:
        alarms_list_args['created_after'] = first_run

    # filter alerts
    if alarm_status_filter:
        alarms_list_args['alarm_status'] = alarm_status_filter  # type: ignore
    if alarm_rule_name_filter:
        alarms_list_args['alarm_rule_name'] = alarm_rule_name_filter  # type: ignore

    alarms, _ = client.alarms_list_request(**alarms_list_args)

    for alarm in alarms:
        alarm['incidentType'] = 'Alarm'
        incident = {
            'name': f'Alarm #{alarm.get("alarmId")} {alarm.get("alarmRuleName")}',
            'occurred': f'{alarm.get("dateInserted")}Z',
            'labels': [{'type': 'alarmId', 'value': str(alarm.get('alarmId'))}],
            'rawJSON': json.dumps(alarm)
        }
        alarm_incidents.append(incident)

    if alarms:
        last_run['AlarmLastRun'] = alarms[0].get('dateInserted')
        demisto.setLastRun(last_run)
    return alarm_incidents


def fetch_cases(client: Client, limit: int, fetch_time: str, fetch_case_evidences: bool,
                case_tags_filter: str, case_status_filter: str, case_priority_filter: str):  # pragma: no cover
    case_incidents = []
    last_run = demisto.getLastRun()
    case_last_run = last_run.get('CaseLastRun')
    first_run = dateparser.parse(fetch_time).strftime("%Y-%m-%dT%H:%M:%SZ")

    cases_list_args = {'count': limit}

    if case_last_run:
        cases_list_args['timestamp_filter_type'] = 'createdAfter'  # type: ignore
        cases_list_args['timestamp'] = case_last_run
    elif first_run:
        cases_list_args['timestamp_filter_type'] = 'createdAfter'  # type: ignore
        cases_list_args['timestamp'] = first_run

    # filter cases
    if case_tags_filter:
        cases_list_args['tags'] = case_tags_filter  # type: ignore
    if case_status_filter:
        cases_list_args['status'] = str(CASE_STATUS.get(case_status_filter))  # type: ignore
    if case_priority_filter:
        cases_list_args['priority'] = case_priority_filter  # type: ignore

    cases = client.cases_list_request(**cases_list_args)

    for case in cases:
        file_names = []
        case['incidentType'] = 'Case'

        if fetch_case_evidences:
            case_id = case.get('id')
            evidences = client.case_evidence_list_request(case_id)
            case['CaseEvidence'] = evidences
            for evidence in evidences:
                if evidence.get('type') == 'file':
                    file_result = client.case_file_evidence_download_request(case_id, evidence.get('number'))
                    file_names.append({
                        'path': file_result.get('FileID'),
                        'name': file_result.get('File')})

        incident = {
            'name': f'Case #{case.get("number")} {case.get("name")}',
            'occurred': case.get('dateCreated'),
            'attachment': file_names,
            'rawJSON': json.dumps(case)
        }
        case_incidents.append(incident)

    if cases:
        last_run['CaseLastRun'] = cases[-1].get('dateCreated')
        demisto.setLastRun(last_run)
    return case_incidents


def main() -> None:  # pragma: no cover
    params: Dict[str, Any] = demisto.params()
    args: Dict[str, Any] = demisto.args()
    url = params.get('url')
    verify_certificate: bool = not params.get('insecure', False)
    proxy = params.get('proxy', False)
    incidents_type = params.get('fetchType', 'Both')
    fetch_time = params.get('first_fetch', '7 days')
    is_fetch: bool = params.get('isFetch', False)
    alarms_max_fetch = params.get('alarmsMaxFetch', 100)
    cases_max_fetch = params.get('casesMaxFetch', 100)
    alarm_status_filter = params.get('alarm_status_filter', '')
    alarm_rule_name_filter = params.get('alarm_rule_name_filter', '')
    case_priority_filter = params.get('case_priority_filter', '')
    case_status_filter = params.get('case_status_filter', '')
    case_tags_filter = params.get('case_tags_filter', '')
    fetch_case_evidences = params.get('fetch_case_evidences', False)

    api_key = params.get('credentials', {}).get('password')
    headers = {'Authorization': f'Bearer {api_key}'}

    command = demisto.command()
    demisto.debug(f'Command being called is {command}')

    try:
        requests.packages.urllib3.disable_warnings()
        client: Client = Client(urljoin(url, ''), verify_certificate, proxy, headers=headers, auth=None)

        commands = {
            'lr-alarms-list': alarms_list_command,
            'lr-alarm-update': alarm_update_command,
            'lr-alarm-add-comment': alarm_add_comment_command,
            'lr-alarm-history-list': alarm_history_list_command,
            'lr-alarm-events-list': alarm_events_list_command,
            'lr-alarm-summary': alarm_summary_command,
            'lr-cases-list': cases_list_command,
            'lr-case-create': case_create_command,
            'lr-case-update': case_update_command,
            'lr-case-status-change': case_status_change_command,
            'lr-case-evidence-list': case_evidence_list_command,
            'lr-case-alarm-evidence-add': case_alarm_evidence_add_command,
            'lr-case-note-evidence-add': case_note_evidence_add_command,
            'lr-case-file-evidence-add': case_file_evidence_add_command,
            'lr-case-evidence-delete': case_evidence_delete_command,
            'lr-case-file-evidence-download': case_file_evidence_download_command,
            'lr-case-tags-add': case_tags_add_command,
            'lr-case-tags-remove': case_tags_remove_command,
            'lr-tags-list': tags_list_command,
            'lr-case-collaborators-list': case_collaborators_list_command,
            'lr-case-collaborators-update': case_collaborators_update_command,
            'lr-entities-list': entities_list_command,
            'lr-hosts-list': hosts_list_command,
            'lr-users-list': users_list_command,
            'lr-lists-get': lists_get_command,
            'lr-list-summary-create-update': list_summary_create_update_command,
            'lr-list-details-and-items-get': list_details_and_items_get_command,
            'lr-list-items-add': list_items_add_command,
            'lr-list-items-remove': list_items_remove_command,
            'lr-execute-search-query': execute_search_query_command,
            'lr-get-query-result': get_query_result_command,
            'lr-add-host': add_host_command,
            'lr-hosts-status-update': hosts_status_update_command,
            'lr-networks-list': networks_list_command,
            'endpoint': endpoint_command,
        }

        if command == 'test-module':
            test_module(client, is_fetch, incidents_type, cases_max_fetch, alarms_max_fetch, fetch_time)
        elif command == 'fetch-incidents':
            demisto.incidents(fetch_incidents_command(client, incidents_type, cases_max_fetch, alarms_max_fetch,
                                                      fetch_time, alarm_status_filter=alarm_status_filter,
                                                      alarm_rule_name_filter=alarm_rule_name_filter,
                                                      case_tags_filter=case_tags_filter,
                                                      case_status_filter=case_status_filter,
                                                      case_priority_filter=case_priority_filter,
                                                      fetch_case_evidences=fetch_case_evidences))
        elif command in commands:
            return_results(commands[command](client, args))
        else:
            raise NotImplementedError(f'{command} command is not implemented.')

    except Exception as e:
        return_error(str(e))


if __name__ in ['__main__', 'builtin', 'builtins']:
    main()
