### Example Input for Get Installed Software (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/microsoft_atp/help.md

Demonstrates the required JSON input structure for the 'Get Installed Software' action. It shows the expected format for providing the `machine` parameter (IP, hostname, or ID).

```JSON
{
  "machine": "2df36d707c1ee5084cef77f3dbfc95db65bc4a73"
}
```

--------------------------------

### Example Output for Get Installed Software (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/microsoft_atp/help.md

Provides an example of the JSON output structure for the 'Get Installed Software' action. It shows the structure for a list of software objects, including vendor, name, ID, exploit status, weaknesses, and impact score.

```JSON
{
  "software": [
    {
      "activeAlert": false,
      "exposedMachines": 1,
      "id": "microsoft-_-windows_10",
      "impactScore": 63.8,
      "name": "windows_10",
      "publicExploit": true,
      "vendor": "microsoft",
      "weaknesses": 1056
    },
    {
      "activeAlert": false,
      "exposedMachines": 0,
      "id": "microsoft-_-edge_chromium-based",
      "impactScore": 0,
      "name": "edge_chromium-based",
      "publicExploit": false,
      "vendor": "microsoft",
      "weaknesses": 0
    }
  ]
}
```

--------------------------------

### Example Output for Get Device Software Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/automox/help.md

This JSON object shows an example of the output returned by the 'Get Device Software' action. It contains a list of software objects installed on the specified device, including details like name, version, and installation status.

```JSON
{
  "software": [
    {
      "create_time": "2021-12-20T16:21:21+0000",
      "display_name": "Feedback Assistant",
      "id": 1234,
      "installed": true,
      "name": "com.apple.appleseed.FeedbackAssistant",
      "organization_id": 1234,
      "os_name": "OS X",
      "os_version": "12.2",
      "os_version_id": 1234,
      "package_id": 1234,
      "package_version_id": 1234,
      "repo": "Apple-System",
      "server_id": 1234,
      "software_id": 1234,
      "version": "5.1"
    },
    {
      "create_time": "2021-12-26T17:23:19+0000",
      "display_name": "Calculator",
      "id": 1234,
      "installed": true,
      "name": "com.apple.calculator",
      "organization_id": 1234,
      "os_name": "OS X",
      "os_version": "12.2",
      "os_version_id": 1234,
      "package_id": 1234,
      "package_version_id": 1234,
      "repo": "Apple-System",
      "server_id": 1234,
      "software_id": 1234,
      "version": "10.16"
    }
  ]
}
```

--------------------------------

### Example Google Compute Engine Start Instance Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_cloud_compute/help.md

This JSON snippet provides an example of the required input payload for the 'Start Instance' action. It specifies the name of the instance to be started and the zone where it is located.

```JSON
{
  "instance": "my-instance-1",
  "zone": "us-central1-a"
}
```

--------------------------------

### Example Input for Get All URL Lists

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/netskope/help.md

An example JSON object showing the input parameters for the 'Get All URL Lists' action, specifying the desired status.

```JSON
{
  "status": "any"
}
```

--------------------------------

### Output Example for Get Scan Config Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON output for the 'Get Scan Config' action, providing details about a scan configuration, including name, description, errors, and links.

```JSON
{
  "app_id": "78c85b01-2a23-404d-ac5a-18324d8e3bda",
  "attack_template_id": "11111111-0000-0000-0000-000000000000",
  "config_description": "testing update",
  "config_name": "update_test",
  "errors": [
    "Seed URL list must not be empty",
    "Crawling Scope Constraint list must not be empty"
  ],
  "id": "a709c972-cb1f-4790-bfce-6ab74653900c",
  "links": [
    {
      "href": "https://us.api.insight.rapid7.com:443/ias/v1/scan-configs/a709c972-cb1f-4790-bfce-6ab74653900c",
      "rel": "self"
    }
  ]
}
```

--------------------------------

### Example Input JSON for Get Policy Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/palo_alto_pan_os/help.md

Provides an example JSON structure for the 'Get Policy' action, specifying the device, policy name, and virtual system.

```JSON
{
  "device_name": "localhost.localdomain",
  "policy_name": "InsightConnect Block Policy",
  "virtual_system": "vsys1"
}
```

--------------------------------

### Input Example for Get Scan Configs Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the 'Get Scan Configs' action, used for paginating scan configurations. It includes optional parameters for index, size, and sort.

```JSON
{
  "index": 0,
  "size": 0,
  "sort": "scanconfig.name,DESC"
}
```

--------------------------------

### Example Output for Install Policy Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/checkpoint_ngfw/help.md

Example JSON response indicating the success status of the policy installation action.

```JSON
{
  "success": true
}
```

--------------------------------

### Example Output for Get Device Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/microsoft_intune/help.md

Provides an example JSON structure representing the detailed information returned for a device by the Get Device action.

```JSON
{
  "device": {
    "id": "9e8fd111-6c41-1111-85b9-11395662e111",
    "userId": "9de5069c-5afe-602b-2ea0-a04b66beb2c0",
    "deviceName": "INTUNE-W10-C",
    "managedDeviceOwnerType": "personal",
    "enrolledDateTime": "2021-06-24T00:37:04.5885438Z",
    "lastSyncDateTime": "2023-08-23T09:05:10.1997623Z",
    "operatingSystem": "Windows",
    "complianceState": "compliant",
    "jailBroken": "Unknown",
    "managementAgent": "mdm",
    "osVersion": "10.0.19044.3084",
    "easActivated": true,
    "easDeviceId": "FD80418A34D1234567E08E82604E1111",
    "easActivationDateTime": "2021-06-24T08:37:10.2303995Z",
    "azureADRegistered": true,
    "deviceEnrollmentType": "userEnrollment",
    "emailDddress": "user@example.com",
    "azureADDeviceId": "9de5069c-5afe-602b-2ea0-a04b66beb2c0",
    "deviceRegistrationState": "registered",
    "isSupervised": false,
    "exchangeLastSuccessfulSyncDateTime": "0001-01-01T00:00:00Z",
    "exchangeAccessState": "none",
    "exchangeAccessStateReason": "none",
    "isEncrypted": false,
    "userPrincipalName": "user@example.com",
    "model": "VMware Virtual Platform",
    "manufacturer": "VMware, Inc.",
    "complianceGracePeriodExpirationDateTime": "9999-12-31T23:59:59.9999999Z",
    "serialNumber": "VMware-42146feae7654321-123456304825cc11",
    "userDisplayName": "Example User",
    "totalStorageSpaceInBytes": 33773584384,
    "freeStorageSpaceInBytes": 1660944384,
    "partnerReportedThreatState": "unknown",
    "managementCertificateExpirationDate": "2024-02-13T19:33:06Z",
    "ethernetMacAddress": "005056949D3E",
    "physicalMemoryInBytes": 0,
    "deviceActionResults": [
      {
        "actionName": "windowsDefenderUpdateSignatures",
        "actionState": "done",
        "startDateTime": "2022-04-26T13:19:45.3008934Z",
        "lastUpdatedDateTime": "2022-04-26T13:25:27Z"
      },
      {
        "@odata.type": "#microsoft.graph.windowsDefenderScanActionResult",
        "actionName": "windowsDefenderScan",
        "actionState": "done",
        "startDateTime": "2023-08-23T08:20:27.9731659Z",
        "lastUpdatedDateTime": "2023-08-23T09:04:07Z",
        "scanType": "Full Scan"
      },
      {
        "@odata.type": "#microsoft.graph.windowsDefenderScanActionResult",
        "actionName": "windowsDefenderScan",
        "actionState": "done",
        "startDateTime": "2023-08-23T08:21:02.3882789Z",
        "lastUpdatedDateTime": "2023-08-23T09:04:07Z",
        "scanType": "Quick scan"
      }
    ]
  }
}
```

--------------------------------

### Setup Connection Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/joe_sandbox/help.md

Example JSON input for configuring the Joe Sandbox Cloud connection with the required API key and the optional API URL.

```json
{
  "api_key": "8e8786182c66e8bc2abdab9198f1385691987bfe2a4917be1268e915e457dbc5",
  "url": "https://jbxcloud.joesecurity.org/api"
}
```

--------------------------------

### Get Agents Action Input Example

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/threatstack/help.md

Example JSON input for the 'Get Agents' action, allowing filtering of agents by an optional start and end date.

```JSON
{
  "end": "2018-01-01",
  "start": "2018-01-01"
}
```

--------------------------------

### Example Input for Starting a Virtual Machine - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/azure_compute/help.md

Shows the JSON input structure required to start a virtual machine. It specifies the resource group, subscription ID, and the name of the virtual machine.

```JSON
{
  "resourceGroup": "ExampleResourceGroupName",
  "subscriptionId": "5cdad72f-c848-4df0-8aaa-ffe033e75d57",
  "vm": "ExampleVirtualMachineName"
}
```

--------------------------------

### Infoblox Plugin Connection Setup Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/infoblox/help.md

Example JSON input demonstrating the required parameters for configuring the Infoblox plugin connection, including API version, credentials, SSL verification toggle, and the Infoblox instance URL.

```JSON
{
  "api_version": 2.7,
  "credentials": {
    "password": "pass",
    "username": "user"
  },
  "ssl_verify": true,
  "url": "https://192.168.1.2"
}
```

--------------------------------

### Get Alert List Input Example JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/trendmicro_visionone/help.md

Example JSON input for the 'Get Alert List' action, specifying the start and end date/time for filtering alerts.

```JSON
{
  "end_date_time": "2020-06-15 12:00:00+00:00",
  "start_date_time": "2020-06-15 10:00:00+00:00"
}
```

--------------------------------

### Example Connection Setup Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/palo_alto_pan_os/help.md

Example JSON structure for configuring the connection to the Palo Alto Networks device, including credentials, server URL, and certificate verification setting.

```json
{
  "credentials": {
    "password": "password",
    "username": "username"
  },
  "server": "http://www.example.com",
  "verify_cert": true
}
```

--------------------------------

### Example Input: Get Jobs JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/cortex_v2/help.md

This JSON object represents an example input payload for the 'Get Jobs' action. It includes parameters for filtering by analyzer, data value, data type, and controlling pagination with limit and start index.

```JSON
{
  "analyzerFilter": "Hipposcore_1_0",
  "dataFilter": "domain",
  "dataTypeFilter": "domain",
  "limit": 10,
  "start": 0
}
```

--------------------------------

### Example Output for Create Site

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightvm/help.md

Example JSON response after successfully creating a site, providing the ID of the newly created site and related hypermedia links.

```JSON
{
  "id": 15,
  "links": []
}
```

--------------------------------

### Example Output for Get Endpoint Data Action - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/trendmicro_visionone/help.md

This JSON object represents example output from the 'Get Endpoint Data' action. It contains an array of endpoint data objects, each detailing information like agent GUID, login account, network details, and OS information.

```json
{
  "endpoint_data": [
    {
      "agent_guid": "35fa11da-a24e-40cf-8b56-baf8828cc151",
      "endpoint_name": {
        "updated_date_time": "2024-02-05T20:58:22Z",
        "value": "MSEDGEWIN10"
      },
      "installed_product_codes": [
        "xes"
      ],
      "ip": {
        "updated_date_time": "2024-02-05T20:58:22Z",
        "value": [
          "10.211.55.36"
        ]
      },
      "login_account": {
        "updated_date_time": "2024-02-05T20:58:22Z",
        "value": [
          "MSEDGEWIN10\\IEUser"
        ]
      },
      "mac_address": {
        "updated_date_time": "2024-02-05T20:58:22Z",
        "value": [
          "00:1c:42:be:22:5f"
        ]
      },
      "os_description": "Windows 10 Enterprise Evaluation (64 bit) build 17763",
      "os_name": "Linux",
      "os_version": "10.0.17763",
      "product_code": "sao"
    }
  ]
}
```

--------------------------------

### PagerDuty Plugin Setup Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/pagerduty/help.md

Example JSON input for configuring the PagerDuty plugin connection, providing the necessary API key.

```JSON
{
  "api_key": "stRbCzL92kpAfwCkSiA9"
}
```

--------------------------------

### Example Input for Get Alerts (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/threatstack/help.md

This JSON object shows an example input for the action that retrieves alerts based on filters. It includes optional `start` and `end` date parameters.

```JSON
{
  "end": "2018-01-01",
  "start": "2018-01-01"
}
```

--------------------------------

### Example Input for Show Configuration Action - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/palo_alto_pan_os/help.md

An example JSON object demonstrating the required input structure for the 'Show' action, which retrieves configuration based on an XPath.

```json
{
  "xpath": "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']"
}
```

--------------------------------

### Input for Get All Domain Users Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON input for the 'Get All Domain Users' action. It requires the 'domain' field to specify the domain from which to retrieve the user list.

```JSON
{
  "domain": "example.com"
}
```

--------------------------------

### Output for Get All Domain Users Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON output from the 'Get All Domain Users' action. It returns an array of user objects, each containing 'email' and 'name' fields for users in the specified domain.

```JSON
{
  "users":[
    {
      "email":"user@example.com",
      "name":"Joe Tester"
    },
    {
      "email":"user@example.com",
      "name":"Bob Testerson"
    }
  ]
}
```

--------------------------------

### Example Output for Starting a Virtual Machine - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/azure_compute/help.md

Provides an example of the JSON output structure after successfully initiating the start action for a virtual machine. It typically includes the HTTP status code.

```JSON
{
  "status_code": 202
}
```

--------------------------------

### Example Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/netmiko/help.md

Shows the required JSON format for providing input to the action, specifying the command and an optional target host.

```JSON
{
  "command": "ls -la",
  "host": "example.com"
}
```

--------------------------------

### Input for Get User Contact by Email Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON input for the 'Get User's Contact Information' action (by email). It requires the 'email' field to specify the user whose contact details are needed.

```JSON
{
  "email": "user@example.com"
}
```

--------------------------------

### Input for Get User Contact by Name Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON input for the 'Get User's Contact Information by Name' action. It requires the 'full_name' field to specify the user whose contact details are needed.

```JSON
{
  "full_name": "Example User"
}
```

--------------------------------

### Example Input for FireEye HX Connection Setup

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/fireeye_hx/help.md

This JSON snippet shows an example configuration for setting up the connection to the FireEye HX appliance, including SSL verification, the appliance URL, and username/password credentials.

```JSON
{
  "ssl_verify": true,
  "url": "https://example.com",
  "username_password": {
    "username": "user",
    "password": "password"
  }
}
```

--------------------------------

### Example Input for Get Alerts JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/sophos_central/help.md

This JSON snippet demonstrates the required format for the input payload when calling the 'Get Alerts' action. It specifies the 'from_date' parameter, which is a string representing a Unix timestamp in UTC, indicating the starting point for retrieving alerts.

```JSON
{
  "from_date": "2019-09-23T12:02:01.700Z"
}
```

--------------------------------

### Create User - Example Output JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightvm/help.md

Example JSON response received after successfully creating a user account, including the new user's ID and links.

```json
{
  "id": 83,
  "links": []
}
```

--------------------------------

### Start Scan Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightvm_cloud/help.md

Example JSON input required to initiate a new scan in Rapid7 InsightVM, specifying assets by ID, hostname, or IP address, and providing a scan name.

```JSON
{
  "asset_ids": [
    "abc978-5678-abc-a5a94a1234b8-asset"
  ],
  "hostnames": [
    "rapid7.com"
  ],
  "ips": [
    "2001:db8:1:1:1:1:1:1"
  ],
  "name": "test cloud scan"
}
```

--------------------------------

### Example Input for Get Scans - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the Get Scans action, demonstrating optional pagination (index, size) and sorting parameters.

```JSON
{
  "index": 0,
  "size": 50,
  "sort": "scan.submit_time,DESC"
}
```

--------------------------------

### Example Connection Configuration JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/smb/help.md

This JSON snippet shows an example structure for configuring the SMB plugin connection, including credentials (username and password), domain, host address, port, and connection timeout.

```JSON
{
  "credentials": {
    "password": "mypassword",
    "username": "user@example.com"
  },
  "domain": "example.com",
  "host": "198.51.100.1",
  "port": 445,
  "timeout": 60
}
```

--------------------------------

### Example Input: Get Scan Execution Details JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the 'Get Scan Execution Details' action, requiring the scan UUID.

```JSON
{
  "scan_id": "c762adbe-1636-4c70-9787-5f22c2dc5af8"
}
```

--------------------------------

### Connection Setup Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/happyfox/help.md

Example JSON input structure for configuring the HappyFox connection in Rapid7 InsightConnect. It requires the API key, auth code, and subdomain.

```json
{
  "apiKey": "3395856ce81f2b7382dee72602f798b6",
  "authCode": "44d88612fea8a8f36de82e1278abb02f",
  "subdomain": "example-company"
}
```

--------------------------------

### Example Input: Get Scan Engine Events JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the 'Get Scan Engine Events' action, requiring the scan UUID.

```JSON
{
  "scan_id": "c762adbe-1636-4c70-9787-5f22c2dc5af8"
}
```

--------------------------------

### Setup Connection Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/automox/help.md

Example JSON input for configuring the Automox plugin connection. Requires the organization API key.

```JSON
{
  "api_key": "abc12345-abc1-2345-abc1-abc123456789"
}
```

--------------------------------

### Setup Connection Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/anomali_threatstream/help.md

Example JSON input for configuring the Anomali ThreatStream connection in InsightConnect, including API key, SSL verification setting, instance URL, and username.

```JSON
{
  "api_key": "9de5069c5afe602b2ea0a04b66beb2c0",
  "ssl_verify": true,
  "url": "https://ts.example.com",
  "username": "user1"
}
```

--------------------------------

### Input Example for Get Scan Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the 'Get Scan' action, which retrieves information about a specific scan. It requires the `scan_id` parameter.

```JSON
{
  "scan_id": "b0b343aa-7fc2-4a9a-bc18-5ac64df7791a"
}
```

--------------------------------

### Create User - Example Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightvm/help.md

Example JSON payload demonstrating the required input parameters for creating a new user account.

```json
{
  "access_all_asset_groups": false,
  "access_all_sites": false,
  "authentication_id": 1234,
  "authentication_type": "ldap",
  "email": "user@example.com",
  "enabled": true,
  "login": "jdoe24",
  "name": "John Doe",
  "role_id": "global-admin"
}
```

--------------------------------

### Example Input for Get Vulnerabilities - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the Get Vulnerabilities action, demonstrating optional pagination (index, pageToken, size) and sorting parameters.

```JSON
{
  "index": 1,
  "pageToken": "NDM0NTk0NTIyOjo6X1M6OjpiYW5hbmFz",
  "size": 1,
  "sort": "vulnerability.severity,DESC"
}
```

--------------------------------

### Output for Get User Contact by Name Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON output from the 'Get User's Contact Information by Name' action. It provides the user's contact details including addresses, phone numbers, and email addresses within a 'contact' object.

```JSON
{
  "contact": {
    "addresses": [
      {
        "country": "England",
        "street": "1 Test street"
      },
      {
        "country": "England",
        "postal_code": "31-222"
      },
      {
        "country": "England",
        "postal_code": "31-111",
        "street": "3 Test street"
      },
      {
        "postal_code": "31-333",
        "street": "4 Test street"
      }
    ],
    "phone_numbers": [
      "111111111",
      "222222222",
      "333333333"
    ],
    "email_addresses": [
      "user@example.com",
      "user2@example.com",
      "user3@example.com"
    ]
  }
}
```

--------------------------------

### Zendesk Connection Configuration Example Input

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/zendesk/help.md

Example JSON input demonstrating the required and optional parameters for configuring a connection to the Zendesk API, including API key, credentials, and subdomain.

```JSON
{
  "api_key": "A6yLhgioJiF2wOP1omP9sTa5yWSTvucx2U7yg67u",
  "credentials": {
    "password": "password",
    "username": "user@example.com"
  },
  "subdomain": "example-subdomain"
}
```

--------------------------------

### Output for Get User Contact by Email Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

Example JSON output from the 'Get User's Contact Information' action (by email). It provides the user's contact details including addresses, phone numbers, and email addresses within a 'contact' object. Note: The structure is identical to the output for the 'Get User Contact by Name' action.

```JSON
{
  "contact":{
    "addresses":[
       {
          "country":"England",
          "street":"1 Test street"
       },
       {
          "country":"England",
          "postal_code":"31-222"
       },
       {
          "country":"England",
          "postal_code":"31-111",
          "street":"3 Test street"
       },
       {
          "postal_code":"31-333",
          "street":"4 Test street"
       }
    ],
    "phone_numbers":[
       "111111111",
       "222222222",
       "333333333"
    ],
    "email_addresses":[
       "user@example.com",
       "user2@example.com",
       "user3@example.com"
    ]
  }
}
```

--------------------------------

### TheHive Plugin Setup Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/thehive/help.md

Example JSON input for configuring the TheHive plugin connection. It includes parameters like API key, host, port, protocol, proxy, and certificate verification.

```json
{
  "api_key": "9de5069c5afe602b2ea0a04b66beb2c0",
  "credentials": {},
  "host": "thehive.company.com or 10.3.4.50",
  "port": 9000,
  "protocol": "http",
  "proxy": {},
  "verify": true
}
```

--------------------------------

### Example Input for Get Scan Platform Events - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the Get Scan Platform Events action, demonstrating the required scan UUID parameter.

```JSON
{
  "scan_id": "c762adbe-1636-4c70-9787-5f22c2dc5af8"
}
```

--------------------------------

### Example Network Device Connection Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/netmiko/help.md

This JSON object provides an example structure for configuring the connection to a network device plugin. It demonstrates how to provide credentials (username and password), specify the device type, and set the target host address.

```JSON
{
  "credentials": {
    "password": "mypassword",
    "username": "user@example.com"
  },
  "device_type": "linux",
  "host": "example.com"
}
```

--------------------------------

### Output Example for Get Scan Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON output for the 'Get Scan' action, providing detailed information about a scan, including ID, status, times, and links.

```JSON
{
  "scan": {
    "app_id": "78c85b01-2a23-404d-ac5a-18324d8e3bda",
    "completion_time": "2019-01-08T22:53:38.385",
    "failure_reason": "",
    "id": "b0b343aa-7fc2-4a9a-bc18-5ac64df7791a",
    "links": [
      {
        "href": "https://us.api.insight.rapid7.com:443/ias/v1/scans/b0b343aa-7fc2-4a9a-bc18-5ac64df7791a",
        "rel": "self"
      }
    ],
    "scan_config_id": "a709c972-cb1f-4790-bfce-6ab74653900c",
    "status": "COMPLETE",
    "submit_time": "2019-01-08T22:04:46.402",
    "submitter": {
      "id": "5b278d63-8fac-4910-978e-8e281039b790",
      "type": "USER"
    }
  }
}
```

--------------------------------

### Okta Connection Setup Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/okta/help.md

Example JSON input for configuring the Okta connection, showing the required `oktaKey` (credential secret) and `oktaUrl` parameters.

```JSON
{
  "oktaKey": {
    "secretKey": "123456789abcdef987654321GHIjklm0123456789A"
  },
  "oktaUrl": "example.okta.com"
}
```

--------------------------------

### Example Output for Get URL Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/get_url/help.md

Example JSON payload showing the expected output from the Get URL action, including the downloaded content as bytes and the HTTP status code.

```JSON
{
  "bytes": "UmFwaWQ3IEluc2lnaHRDb25uZWN0Cg==",
  "status_code": 200
}
```

--------------------------------

### Example Output: Get Scan Engine Events JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON output for the 'Get Scan Engine Events' action, providing an array of event logs with timestamps and event descriptions.

```JSON
{
  "events": [
    {
      "event": "Scan is awaiting scheduling",
      "time": "2019-01-09T20:18:39.536"
    }
  ]
}
```

--------------------------------

### Example Google Admin Directory Connection Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_directory/help.md

This JSON object provides an example structure for the input required to configure the Google Admin Directory plugin connection. It demonstrates how to format the necessary authentication credentials and scope.

```JSON
{
  "admin_user": "user@example.com",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "client_email": "user@example.com",
  "client_id": 102790495738030000000,
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/user@example.com",
  "oauth_scope": "https://www.googleapis.com/auth/admin.directory.user"
}
```

--------------------------------

### Example Connection Configuration (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/ivanti_service_manager/help.md

Example JSON object showing the required parameters for configuring the Ivanti Service Manager connection, including credentials, SSL verification setting, and the API access URL.

```JSON
{
  "credentials": "1A2B3CC4D5E67F8901G2HI345J6K7L89",
  "ssl_verify": true,
  "url": "https://ivanti.example.com"
}
```

--------------------------------

### Input Example for Get Scan Config Action

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

Example JSON input for the 'Get Scan Config' action, used to retrieve details of a specific scan configuration. It requires the `scan_config_id` parameter.

```JSON
{
  "scan_config_id": "6a33ae79-5ebd-44a9-9a0a-f269876e90c9"
}
```

--------------------------------

### Example Input for Create Site

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightvm/help.md

Example JSON payload for creating a new site, specifying parameters like name, description, engine ID, included/excluded addresses and asset groups, importance, and scan template ID.

```JSON
{
  "description": "example description",
  "engine_id": 1234,
  "excluded_addresses": [],
  "excluded_asset_groups": [],
  "importance": "normal",
  "included_addresses": [],
  "included_asset_groups": [],
  "name": "example name",
  "scan_template_id": "12345-abcd"
}
```

--------------------------------

### Get Assessment Input Example - AttackerKB Plugin - JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_attackerkb/help.md

Example JSON input for the 'Get Assessment' action, requiring the assessment ID.

```JSON
{
  "id": "a2c54f3d-48d0-48c4-b056-3a78181d777c"
}
```

--------------------------------

### Example Output for Get User (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/grafana/help.md

Example JSON response showing the structure of the user details returned by the Get User action.

```json
{
  "user": {
    "name": "admin2",
    "email": "admin@localhost",
    "login": "admin",
    "orgId": 1,
    "isGrafanaAdmin": true,
    "theme": ""
  }
}
```

--------------------------------

### Freshservice Connection Configuration Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/freshservice/help.md

This JSON object provides an example of the required input format for configuring the Freshservice connection, demonstrating the structure for providing the API key and subdomain.

```JSON
{
  "apiKey": "44d88612fea8a8f36de82e1278abb02f",
  "subdomain": "example-company"
}
```

--------------------------------

### Example Get Accounts Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/cloudflare/help.md

Example JSON input for the 'Get Accounts' action, demonstrating optional pagination and filtering parameters.

```JSON
{
  "direction": "desc",
  "name": "Example Account",
  "page": 1,
  "perPage": 10
}
```

--------------------------------

### Example Input for Connection Setup (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/azure_ad_admin/help.md

Example JSON input showing the required parameters (application_id, application_secret, tenant_id) for configuring the Azure AD Admin plugin connection.

```JSON
{
  "application_id": "6731de76-14a6-49ae-97bc-6eba6914391e",
  "application_secret": "JqQX2PNo9bpM0uEihUPzyrh",
  "tenant_id": "5ceea899-ae8c-4ff1-fffe-353646eeeff0"
}
```

--------------------------------

### Example Input for Get URL Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/get_url/help.md

Example JSON payload demonstrating the required and optional inputs for the Get URL action, including URL, checksum, verification flag, timeout, and user agent.

```JSON
{
  "checksum": "0800fc577294c34e0b28ad2839435945",
  "is_verify": true,
  "timeout": 60,
  "url": "https://example.com",
  "user_agent": "Mozilla/5.0"
}
```

--------------------------------

### Sophos Central Connection Setup Example Input (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/sophos_central/help.md

Example JSON input demonstrating the required and optional parameters for configuring the Sophos Central connection within Rapid7 InsightConnect. It includes client ID, client secret, region, and tenant ID.

```JSON
{
  "client_id": "8a9jbad0-12ab-88be-cad4-3b4cad6f78e0",
  "client_secret": "a1e263620c12382b36054cf34512ef836854e61d27ab2d079dda27af903a5b6eec396416b2dc40aabce6edfg670b0790d9a90",
  "region": "US East",
  "tenant_id": "5b0eba20-ab12-34cd-88be-3a4cdc6a70f8"
}
```

--------------------------------

### Example Output for Get Vulnerability Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/rapid7_insightappsec/help.md

This JSON object represents the structure and example data returned by the 'Get Vulnerability' action. It includes details about the vulnerability itself, associated links, and pagination metadata.

```JSON
{
  "data": [
    {
      "app": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
      },
      "firstDiscovered": "2021-08-03T14:07:37",
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "insightUiUrl": "sample.com",
      "lastDiscovered": "2021-08-03T14:07:37",
      "links": [
        {
          "href": "example.com",
          "name": "example",
          "profile": "example",
          "rel": "example"
        }
      ],
      "newlyDiscovered": true,
      "rootCause": {
        "method": "GET",
        "parameter": "example",
        "url": "example.com"
      },
      "severity": "SAFE",
      "status": "UNREVIEWED",
      "variances": [
        {
          "attack": {
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
          },
          "attackExchanges": [
            {
              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
              "request": "example",
              "response": "example"
            }
          ],
          "attackValue": "example",
          "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
          "message": "example",
          "module": {
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
          },
          "originalExchange": {
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
            "request": "example",
            "response": "example"
          },
          "originalValue": "example",
          "proof": "example",
          "proofDescription": "example"
        }
      ],
      "vectorString": "example",
      "vulnerabilityScore": 1.5
    }
  ],
  "links": [
    {
      "href": "example.com",
      "name": "example",
      "profile": "example",
      "rel": "example"
    }
  ],
  "metadata": {
    "index": 1,
    "pageToken": "NDM0NTk0NTIyOjo6X1M6OjpiYW5hbmFz",
    "size": 1,
    "sort": "scan.submit_time,DESC,scan.status",
    "totalData": 1,
    "totalPages": 1
  }
}
```

--------------------------------

### Bitwarden Plugin Setup Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/bitwarden/help.md

Example JSON input for configuring the Bitwarden plugin connection, requiring the client ID and client secret.

```JSON
{
  "clientId": "organization.u8iid299-888p-12sp-1234-es123456s987",
  "clientSecret": "KuHDkd3Pfhe4Scms6kEHdPPA5dAJDX"
}
```

--------------------------------

### Example Input for List Locations and Branches Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/topdesk/help.md

Example JSON payload demonstrating the input parameters for the 'List Locations and Branches' action, specifying page size and a query filter.

```JSON
{
  "pageSize": 100,
  "query": "branch.name=='Example Branch'"
}
```

--------------------------------

### Connection Setup Input Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/azure_blob_storage/help.md

Example JSON input for configuring the Azure Blob Storage connection with account details, client ID, client secret, and tenant ID.

```JSON
{
  "account": "myaccount",
  "client_id": "c163eff0-d1a1-4618-ee2a-453534f43cee",
  "client_secret": {
    "secretKey": "9de5069c5afe602b2ea0a04b66beb2c0"
  },
  "tenant_id": "5ceea899-ae8c-4ff1-fffe-353646eeeff0"
}
```

--------------------------------

### Example Input for Get Endpoint Group

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/sophos_central/help.md

Example JSON input for the Get Endpoint Group action, specifying the group ID.

```JSON
{
  "groupId": "9de5069c-5afe-602b-2ea0-a04b66beb2c0"
}
```

--------------------------------

### Example Input for Get Blocked Items

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/sophos_central/help.md

Example JSON input for the Get Blocked Items action, specifying pagination parameters.

```JSON
{
  "page": 1,
  "pageSize": 50,
  "pageTotal": false
}
```

--------------------------------

### URLScan Plugin Connection Setup Example (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/urlscan/help.md

Example JSON input for configuring the URLScan plugin connection, including the optional API key.

```JSON
{
  "api_key": {
    "secretKey": "381cd93b-1946-9c73-1946-c916075eb9a3"
  }
}
```

--------------------------------

### Example Output JSON Structure

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/netmiko/help.md

This snippet shows an example of the JSON output returned by a plugin action. The 'results' field contains a string with the raw output from a command, formatted as a filesystem listing.

```JSON
{
  "results": "total 125088\ndrwxr-xr-x  9 vagrant vagrant      4096 Mar 31 19:24 .\ndrwxr-xr-x  3 root    root         4096 May 10  2020 ..\n-rw-------  1 vagrant vagrant     74883 Mar 31 19:24 .bash_history\n-rw-r--r--  1 vagrant vagrant       220 May 10  2020 .bash_logout\n-rw-r--r--  1 vagrant vagrant      3685 Sep 20  2020 .bashrc\ndrwxr-xr-x  6 vagrant vagrant      4096 Sep 20  2020 .cache\ndrwxr-xr-x  4 vagrant vagrant      4096 Sep 16  2020 .gem\n-rw-r--r--  1 vagrant vagrant        24 Sep 20  2020 .gitconfig\ndrwx------  3 vagrant vagrant      4096 Sep 16  2020 .gnupg\ndrwxr-xr-x 10 root    root         4096 May  6  2019 go\n-rw-r--r--  1 root    root    127938445 Sep 16  2020 go1.12.5.linux-amd64.tar.gz\ndrwxr-xr-x  4 vagrant vagrant      4096 Sep 20  2020 go_work\ndrwx------  4 vagrant vagrant      4096 Nov 25 00:51 .local\n-rw-r--r--  1 vagrant vagrant       807 May 10  2020 .profile\ndrwx------  2 vagrant vagrant      4096 Nov  2 16:16 .ssh\n-rw-------  1 vagrant vagrant     19449 Mar 23 20:33 .viminfo"
}
```

--------------------------------

### Example Input for Get Device Action (JSON)

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/microsoft_intune/help.md

Example JSON input payload for the Get Device action, requiring the device ID.

```json
{
  "deviceId": "9e8fd111-6c41-1111-85b9-11395662e111"
}
```

--------------------------------

### Get Page Action Example Input JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/google_search/help.md

Example JSON input for the Get Page action, specifying the URL to retrieve the content from.

```json
{
  "url": "https://example.com"
}
```

--------------------------------

### Example Output JSON

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/netmiko/help.md

Illustrates the JSON structure returned by the action, including the 'results' field containing the multi-line CLI output.

```JSON
{
  "results": "sudo -s\nroot@buster:/home/vagrant# ls -la\ntotal 125088\ndrwxr-xr-x  9 vagrant vagrant      4096 Mar 31 19:24 .\ndrwxr-xr-x  3 root    root         4096 May 10  2020 ..\n-rw-------  1 vagrant vagrant     74883 Mar 31 19:24 .bash_history\n-rw-r--r--  1 vagrant vagrant       220 May 10  2020 .bash_logout\n-rw-r--r--  1 vagrant vagrant      3685 Sep 20  2020 .bashrc\ndrwxr-xr-x  6 vagrant vagrant      4096 Sep 20  2020 .cache\ndrwxr-xr-x  4 vagrant vagrant      4096 Sep 16  2020 .gem\n-rw-r--r--  1 vagrant vagrant        24 Sep 20  2020 .gitconfig\ndrwx------  3 vagrant vagrant      4096 Sep 16  2020 .gnupg\ndrwxr-xr-x 10 root    root         4096 May  6  2019 go\n-rw-r--r--  1 root    root    127938445 Sep 16  2020 go1.12.5.linux-amd64.tar.gz\ndrwxr-xr-x  4 vagrant vagrant      4096 Sep 20  2020 go_work\ndrwx------  4 vagrant vagrant      4096 Nov 25 00:51 .local\n-rw-r--r--  1 vagrant vagrant       807 May 10  2020 .profile\ndrwx------  2 vagrant vagrant      4096 Nov  2 16:16 .ssh\n-rw-------  1 vagrant vagrant     19449 Mar 23 20:33 .viminfo\nroot@buster:/home/vagrant# "
}
```

--------------------------------

### Get User Action Input Example

Source: https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/github/help.md

Example JSON input for the 'Get User' action, requiring the GitHub username to retrieve information.

```json
{
  "username": "test_user"
}
```