DragosWorldview.yml

category: Data Enrichment & Threat Intelligence
commonfields:
  id: Dragos Worldview
  version: -1
configuration:
- defaultvalue: https://portal.dragos.com
  display: Server URL (e.g. https://portal.dragos.com)
  name: url
  required: true
  type: 0
- display: API Token
  name: credential_token
  required: false
  type: 9
  displaypassword: API Token
  hiddenusername: true
- display: API Key
  name: credential_key
  required: false
  type: 9
  displaypassword: API Key
  hiddenusername: true
- display: API Token
  name: apitoken
  required: false
  type: 4
  hidden: true
- display: API Key
  name: apikey
  required: false
  type: 4
  hidden: true
- display: First fetch time
  name: first_fetch
  required: false
  type: 0
  defaultvalue: 3 days
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  defaultvalue: '1'
- display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  required: false
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Fetch Limit
  name: max_fetch
  type: 0
  required: false
  defaultvalue: '50'
description: 'Custom integration designed to pull in reports from the Dragos Worldview API as incidents.'
display: Dragos Worldview
name: Dragos Worldview
script:
  commands:
  - arguments:
    - description: Exclude indicators that are only associated with Suspect Domain Reports (API default false).
      name: exclude_suspect_domain
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Page number to start at (API default 1).
      name: page
    - description: Page size (API default 500) (must be less than 1001).
      name: page_size
    - description: UTC timestamp in YYYY-mm-dd (optionally with HH:mm:ss) to filter to recent indicators (default is within the last 48 hours).
      name: updated_after
    - description: Search for indicators that match a specific value.
      name: value
    - auto: PREDEFINED
      description: Search for indicators of a specific type.
      name: type
      predefined:
      - domain
      - filename
      - hostname
      - ip
      - md5
      - sha1
      - sha256
    - description: List of Dragos report serial number to get indicators from.
      isArray: true
      name: serial
    - description: List of tags to search for indicators.
      isArray: true
      name: tags
    description: Get Indicators from the Dragos WorldView API, if no arguments are provided the command will retrieve all indicators from the last 48 hours.
    name: dragos-get-indicators
    outputs:
    - contextPath: Dragos.Indicators.activity_groups
      description: A list of activity groups.
    - contextPath: Dragos.Indicators.attack_techniques
      description: A list of attack techniques.
    - contextPath: Dragos.Indicators.category
      description: The Dragos Indicator's category.
      type: string
    - contextPath: Dragos.Indicators.comment
      description: The Dragos Indicator's comment.
      type: string
    - contextPath: Dragos.Indicators.confidence
      description: The Dragos Indicator's confidence.
      type: string
    - contextPath: Dragos.Indicators.first_seen
      description: The first time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.ics_attack_techniques
      description: A list of ics attack techniques.
    - contextPath: Dragos.Indicators.indicator_id
      description: The Dragos Indicator's id.
      type: number
    - contextPath: Dragos.Indicators.indicator_type
      description: The Dragos Indicator's type.
      type: string
    - contextPath: Dragos.Indicators.kill_chain
      description: The Dragos Indicator's kill chain.
      type: string
    - contextPath: Dragos.Indicators.kill_chains
      description: A list of kill chains.
    - contextPath: Dragos.Indicators.last_seen
      description: The last time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.pre_attack_techniques
      description: A list of pre-attack techniques.
    - contextPath: Dragos.Indicators.products
      description: A list of dictionaries, usually containing the serial numbers of related Dragos reports.
    - contextPath: Dragos.Indicators.products.serial
      description: The serial numbers of related Dragos reports.
    - contextPath: Dragos.Indicators.severity
      description: The Dragos Indicator's severity.
      type: string
    - contextPath: Dragos.Indicators.status
      description: The Dragos Indicator's status.
      type: string
    - contextPath: Dragos.Indicators.threat_groups
      description: A list of threat groups.
    - contextPath: Dragos.Indicators.updated_at
      description: The last time the Indicator was updated in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.uuid
      description: The Dragos Indicator's uuid.
      type: string
    - contextPath: Dragos.Indicators.value
      description: The Dragos Indicator's value.
      type: string
  - arguments:
    - description: Serial number for the report to retrieve.
      name: serial
      required: true
    description: Get the report file from the given serial number.
    name: dragos-get-full-report
  - arguments:
    - description: Serial number of the report from which to get the file.
      name: serial
      required: true
    description: Get csv file with indicators from a given report.
    name: dragos-get-ioc-csv
  - arguments:
    - description: Serial number of the report from which to retrieve the file.
      name: serial
      required: true
    description: Get the stix2 json bundle of indicators from a given report.
    name: dragos-get-stix2
  dockerimage: demisto/python3:3.10.13.78960
  isFetchSamples: true
  isfetch: true
  script: ''
  subtype: python3
  type: python
  runonce: false
fromversion: 6.2.0
tests:
- No tests (auto formatted)