-
Notifications
You must be signed in to change notification settings - Fork 1.6k
/
FeedCyCognito.yml
394 lines (375 loc) · 14.3 KB
/
FeedCyCognito.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
category: Data Enrichment & Threat Intelligence
commonfields:
id: FeedCyCognito
version: -1
configuration:
- additionalinfo: The API Key required to authenticate to the service.
display: API Key
name: api_key
required: true
type: 4
- additionalinfo: The type of assets to be retrieved.
display: Asset Type
hidden: false
name: asset_type
options:
- ip
- domain
- cert
- webapp
- iprange
required: true
type: 15
- additionalinfo: |-
The date or relative timestamp from where to start fetching assets.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
defaultvalue: 2 weeks
display: First Fetch Time
hidden: false
name: first_fetch
required: false
type: 0
- additionalinfo: The maximum number of assets to fetch every time. The maximum value is '1000'.
defaultvalue: "50"
display: Max Fetch
hidden: false
name: max_fetch
required: false
type: 0
- additionalinfo: Retrieves the assets attributed to a specific organization, subsidiary, or assignee. Supports comma-separated values.
display: Organizations
hidden: false
name: organizations
required: false
type: 0
- additionalinfo: |-
Filters the assets according to security grade.
Supported values:
A: Very strong,
B: Strong,
C: Less vulnerable,
D: Vulnerable,
F: Highly vulnerable
display: Security Grade
hidden: false
name: security_grade
options:
- "A: Very strong"
- "B: Strong"
- "C: Less vulnerable"
- "D: Vulnerable"
- "F: Highly vulnerable"
required: false
type: 16
- additionalinfo: |-
Filters the assets based on their hosting type.
Supported values: 'owned', 'cloud', 'undetermined'
display: Hosting Type
hidden: false
name: hosting_type
options:
- cloud
- owned
- undetermined
required: false
type: 16
- additionalinfo: |-
Filters the assets based on the geographic locations to which they belong. Multiple selection is supported.
Locations are available only for IP, Domain, and Certificate asset types.
display: Locations
hidden: false
name: locations
options: ["Afghanistan","Aland Islands","Albania","Algeria","American Samoa","Andorra","Angola","Anguilla",
"Antarctica","Antigua and Barbuda","Argentina","Armenia","Aruba","Australia","Austria","Azerbaijan",
"Bahamas","Bahrain","Bangladesh","Barbados","Belarus","Belgium","Belize","Benin","Bermuda","Bhutan",
"Bolivia, Plurinational State of","Bonaire, Sint Eustatius and Saba","Bosnia and Herzegovina","Botswana",
"Bouvet Island","Brazil","British Indian Ocean Territory","Brunei Darussalam","Bulgaria","Burkina Faso",
"Burundi","Cabo Verde","Cambodia","Cameroon","Canada","Cayman Islands","Central African Republic","Chad",
"Chile","China","Christmas Island","Cocos (Keeling) Islands","Colombia","Comoros","Congo",
"Congo, The Democratic Republic of the","Cook Islands","Costa Rica","Cote d'Ivoire","Croatia","Cuba",
"Curacao","Cyprus","Czechia","Denmark","Djibouti","Dominica","Dominican Republic","Ecuador","Egypt",
"El Salvador","Equatorial Guinea","Eritrea","Estonia","Eswatini","Ethiopia","Falkland Islands (Malvinas)",
"Faroe Islands","Fiji","Finland","France","French Guiana","French Polynesia","French Southern Territories",
"Gabon","Gambia","Georgia","Germany","Ghana","Gibraltar","Greece","Greenland","Grenada","Guadeloupe","Guam",
"Guatemala","Guernsey","Guinea","Guinea-Bissau","Guyana","Haiti","Heard Island and McDonald Islands",
"Holy See","Honduras","Hong Kong","Hungary","Iceland","India","Indonesia","Iran, Islamic Republic of",
"Iraq","Ireland","Isle of Man","Israel","Italy","Jamaica","Japan","Jersey","Jordan","Kazakhstan","Kenya",
"Kiribati","Korea, Democratic People's Republic of","Korea, Republic of","Kuwait","Kyrgyzstan",
"Lao People's Democratic Republic","Latvia","Lebanon","Lesotho","Liberia","Libya","Liechtenstein",
"Lithuania","Luxembourg","Macao","Madagascar","Malawi","Malaysia","Maldives","Mali","Malta",
"Marshall Islands","Martinique","Mauritania","Mauritius","Mayotte","Mexico",
"Micronesia, Federated States of","Moldova, Republic of","Monaco","Mongolia","Montenegro","Montserrat",
"Morocco","Mozambique","Myanmar","Namibia","Nauru","Nepal","Netherlands","New Caledonia","New Zealand",
"Nicaragua","Niger","Nigeria","Niue","Norfolk Island","North Macedonia","Northern Mariana Islands","Norway",
"Oman","Pakistan","Palau","Palestine, State of","Panama","Papua New Guinea","Paraguay","Peru","Philippines",
"Pitcairn","Poland","Portugal","Puerto Rico","Qatar","Reunion","Romania","Russian Federation","Rwanda",
"Saint Barthelemy","Saint Helena, Ascension and Tristan da Cunha","Saint Kitts and Nevis","Saint Lucia",
"Saint Martin (French part)","Saint Pierre and Miquelon","Saint Vincent and the Grenadines","Samoa",
"San Marino","Sao Tome and Principe","Saudi Arabia","Senegal","Serbia","Seychelles","Sierra Leone",
"Singapore","Sint Maarten (Dutch part)","Slovakia","Slovenia","Solomon Islands","Somalia","South Africa",
"South Georgia and the South Sandwich Islands","South Sudan","Spain","Sri Lanka","Sudan","Suriname",
"Svalbard and Jan Mayen","Sweden","Switzerland","Syrian Arab Republic","Taiwan, Province of China",
"Tajikistan","Tanzania, United Republic of","Thailand","Timor-Leste","Togo","Tokelau","Tonga",
"Trinidad and Tobago","Tunisia","Turkey","Turkmenistan","Turks and Caicos Islands","Tuvalu","Uganda",
"Ukraine","United Arab Emirates","United Kingdom of Great Britain and Northern Ireland",
"United States of America","United States Minor Outlying Islands","Uruguay","Uzbekistan","Vanuatu",
"Venezuela, Bolivarian Republic of","Vietnam","Virgin Islands, British","Virgin Islands, U.S.",
"Wallis and Futuna","Western Sahara","Yemen","Zambia","Zimbabwe"]
required: false
type: 16
- defaultvalue: "true"
display: Fetch indicators
name: feed
required: false
type: 8
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
defaultvalue: Good
display: Indicator Reputation
name: feedReputation
options:
- None
- Good
- Suspicious
- Bad
required: false
type: 18
- additionalinfo: Reliability of the source providing the intelligence data.
defaultvalue: B - Usually reliable
display: Source Reliability
name: feedReliability
options:
- A - Completely reliable
- B - Usually reliable
- C - Fairly reliable
- D - Not usually reliable
- E - Unreliable
- F - Reliability cannot be judged
required: true
type: 15
- defaultvalue: "1440"
display: Feed Fetch Interval
name: feedFetchInterval
required: false
type: 19
- name: feedExpirationPolicy
display: ""
options:
- never
- interval
- indicatorType
- suddenDeath
required: false
type: 17
- name: feedExpirationInterval
defaultvalue: "20160"
display: ""
required: false
type: 1
- additionalinfo:
When selected, the exclusion list is ignored for indicators from
this feed. This means that if an indicator from this feed is on the exclusion
list, the indicator might still be added to the system.
defaultvalue: "false"
display: Bypass exclusion list
name: feedBypassExclusionList
required: false
type: 8
- additionalinfo: Supports CSV values.
display: Tags
name: feedTags
required: false
type: 0
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
display: Traffic Light Protocol Color
name: tlp_color
options:
- RED
- AMBER
- GREEN
- WHITE
required: false
type: 15
- additionalinfo: When selected, all the incoming indicators will map to a CyCognito Asset indicator type.
display: Default Indicator Mapping
hidden: false
name: default_mapping
required: false
type: 8
- additionalinfo: |-
When selected, Fetches only live assets.
Note: This filter supports only IP and IP Range type of assets.
display: Fetch only Live Assets
hidden: false
name: only_alive
required: false
type: 8
defaultvalue: "true"
- additionalinfo: Indicates whether to allow connections without verifying the SSL certificate's validity.
defaultvalue: "false"
display: Trust any certificate (not secure)
name: insecure
required: false
type: 8
- additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API.
defaultvalue: "false"
display: Use system proxy settings
name: proxy
required: false
type: 8
description: The CyCognito Feed integration retrieves the discovered assets from
the CyCognito platform based on user-specified filters. A comprehensive dashboard and layout are also included.
display: CyCognito Feed
name: FeedCyCognito
script:
commands:
- arguments:
- auto: PREDEFINED
default: false
description: |-
The type of asset to be retrieved.
Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'
isArray: false
name: asset_type
predefined:
- ip
- domain
- cert
- webapp
- iprange
required: true
secret: false
- default: false
defaultValue: '50'
description: |-
The number of results to retrieve.
Maximum value is '1000'
isArray: false
name: count
required: false
secret: false
- default: false
defaultValue: '0'
description: Sets the starting index for the returned results. By specifying
offset, you retrieve a subset of records starting with the offset value.
isArray: false
name: offset
required: false
secret: false
- default: false
description: |-
An Advanced Search parameter to query the response.
Note: Retrieves all the occurrences that are included in the string.
isArray: false
name: search
required: false
secret: false
- default: false
description: 'The name of the field by which to sort the results. The response
fields available for sorting the data are found in the following documentation:
https://docs.cycognito.com/reference/reference-getting-started'
isArray: false
name: sort_by
required: false
secret: false
- auto: PREDEFINED
default: false
defaultValue: desc
description: |-
Specifies whether to sort the results in either ascending or descending order.
Supported values: 'asc', 'desc'
isArray: false
name: sort_order
predefined:
- asc
- desc
required: false
secret: false
- default: false
description: |-
The date and time at which CyCognito first discovered and attributed the asset to the organization.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
isArray: false
name: first_seen
required: false
secret: false
- default: false
description: |-
The date and time at which CyCognito most recently attributed the asset to the organization.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
isArray: false
name: last_seen
required: false
secret: false
- default: false
description: Retrieves the assets attributed to a specific organization, subsidiary,
or assignee. Supports comma-separated values.
isArray: false
name: organizations
required: false
secret: false
- default: false
description: |-
Filters the assets according to their hosting type. Supports comma-separated values.
Supported values: 'owned', 'cloud', 'undetermined'
isArray: false
name: hosting_type
required: false
secret: false
- default: false
description: |-
Filters the assets according to security rating. Supports comma-separated values.
Supported values: 'A', 'B', 'C', 'D', 'F'
Where:
A = Very strong
B = Strong
C = Less vulnerable
D = Vulnerable
F = Highly vulnerable
isArray: false
name: security_grade
required: false
secret: false
- default: false
description: |-
Filters the assets according to their status. Supports comma-separated values.
Supported values: 'changed', 'new', 'normal'
isArray: false
name: status
required: false
secret: false
- default: false
description: |-
The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries--e.g., IND, USA.
Locations are available only for IP, Domain, and Certificate asset types.
isArray: false
name: locations
required: false
secret: false
- default: false
description: A keyword or phrase that can be added to an asset or issue metadata. Supports comma-separated values.
isArray: false
name: tags
required: false
secret: false
deprecated: false
description: Fetches a given limit of indicators from the CyCognito platform and displays them in human-readable format in the war room.
execution: false
name: cycognito-get-indicators
dockerimage: demisto/pycountry:1.0.0.54603
feed: true
isfetch: false
longRunning: false
longRunningPort: false
runonce: false
script: '-'
subtype: python3
type: python
tests:
- FeedCyCognito-Test
marketplaces:
- xsoar
- marketplacev2
fromversion: 6.2.0