# Scythe

PlexTrac supports importing CSV or JSON files from **Scythe**. Scythe is a cybersecurity company that provides a platform for simulating and testing cyber attacks against an organization's infrastructure, applications, and people. Scythe's platform allows security teams to create and run custom attack simulations, including phishing attacks, ransomware, and other types of malware. 

Below are the mappings of fields and any reference notes to provide context. If a field is not listed, PlexTrac does not currently import it.

<div align="left"><figure><img src="/files/WXDH9RWaPH8yMQJFWllq" alt=""><figcaption></figcaption></figure></div>

## Finding Field Mappings

| PlexTrac Field                          | Scythe Field or Path                                                                                                                              |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| finding.affected\_assets.asset.hostname | Endpoint                                                                                                                                          |
| finding.affected\_assets.asset.asset    | Endpoint                                                                                                                                          |
| finding.affected\_assets.asset.status   | if Status == "True" then "Open" else "Closed"                                                                                                     |
| finding.title                           | if Request is " " then use Module else use (Module + " " + Request)                                                                               |
| finding.tags                            | Tags + Campaign Name                                                                                                                              |
| finding.status                          | if Status == "True" then "Open" else "Closed"                                                                                                     |
| finding.severity                        | hard coded to "Medium"                                                                                                                            |
| finding.description                     | if a known scythe module then module.title + module.description. If not a known module then "They following Scythe module was conducted: + Module |
| finding.recommendations                 | if the module is not a known Scythe module then "You should review the security policies associated with this activity."                          |
| finding.references                      | hard coded to ""                                                                                                                                  |
| finding.exhibit.exhibitID               | if Module == "printscr" then data is concidered a finding.exhibit otherwise is a finding.code\_sample                                             |
| finding.exhibit.caption                 | "Timestamp: " + Timestamp                                                                                                                         |
| finding.exhibit.PID                     | Process ID                                                                                                                                        |
| finding.exhibit.User                    | User                                                                                                                                              |
| finding.exhibit.Module                  | Module                                                                                                                                            |
| finding.exhibit.Request                 | Request                                                                                                                                           |
| finding.exhibit.encoded                 | Response                                                                                                                                          |
| finding.exhibit.type                    | hard coded to"image/png"                                                                                                                          |
| finding.code\_sample.caption            | hard coded to "Activity Data"                                                                                                                     |
| finding.code\_sample.code               | hard coded to ""                                                                                                                                  |
| finding.code\_sample.timestamp          | Timestamp                                                                                                                                         |
| finding.code\_sample.PID                | Process ID                                                                                                                                        |
| finding.code\_sample.User               | User                                                                                                                                              |
| finding.code\_sample.Module             | Module                                                                                                                                            |
| finding.code\_sample.Request            | Request                                                                                                                                           |
| finding.code\_sample.Result             | Response                                                                                                                                          |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.plextrac.com/plextrac-documentation/product-documentation-1/integrations-and-file-imports/scythe.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.