Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Private upload mode docs #11 #28838

Merged
merged 3 commits into from Aug 8, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Expand Up @@ -266,6 +266,7 @@
<h3>2. domain</h3>
<hr>
<p>Lookup a FQDN indicator in SlashNext Threat Intelligence database.</p>
<p>Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.</p>
<h5>Base Command</h5>
<p>
<code>domain</code>
Expand Down
Expand Up @@ -10,6 +10,7 @@ The SlashNext Phishing Incident Response integration app uses an API key to auth

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
- ***slashnext-url-reputation***
- ***slashnext-host-reputation***
See the vendor’s documentation for more details.
6 changes: 6 additions & 0 deletions Packs/SlashNextPhishingIncidentResponse/ReleaseNotes/1_3_6.md
@@ -0,0 +1,6 @@

#### Integrations

##### SlashNext Phishing Incident Response

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/SlashNextPhishingIncidentResponse/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "SlashNext Phishing Incident Response - Annual Subscription (Direct Subscription)",
"description": "This community edition of SlashNext Phishing Incident Response is intended for organization to try the world’s largest, real-time phishing intelligence database for accurate, definitive binary verdicts on suspicious URLs and download phishing forensics including webpage screenshots, HTML and text. \n\nThis edition is for organizations that need a direct annual subscription to SlashNext Phishing Incident Response, the world’s largest, real-time phishing intelligence database for accurate, definitive binary verdicts on suspicious URLs and download phishing forensics including webpage screenshots, HTML and text. \n\nFor more information go to: https://www.slashnext.com/technology-partners/cortex-xsoar/",
"support": "partner",
"currentVersion": "1.3.5",
"currentVersion": "1.3.6",
"author": "SlashNext",
"url": "https://www.slashnext.com",
"email": "support@slashnext.com",
Expand Down
1 change: 1 addition & 0 deletions Packs/SpyCloud/Integrations/SpyCloud/README.md
Expand Up @@ -140,6 +140,7 @@ Retrieves the breach details. While very similar to list-breaches, this command
***
Get all the data from a monitored domain and the breaches occurred that relates with it. Can be scoped by domain, type and severity

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

Expand Down
4 changes: 3 additions & 1 deletion Packs/SpyCloud/Integrations/SpyCloud/SpyCloud_description.md
@@ -1 +1,3 @@
Use the Spycloud API to collect the breach information from watchlists or based on domain information
Use the Spycloud API to collect the breach information from watchlists or based on domain information

Notice: Submitting indicators using the **spycloud-domain-data** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details.
6 changes: 6 additions & 0 deletions Packs/SpyCloud/ReleaseNotes/1_0_3.md
@@ -0,0 +1,6 @@

#### Integrations

##### SpyCloud

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/SpyCloud/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "SpyCloud",
"description": "Integration for retrieving data from the SpyCloud ATO API",
"support": "community",
"currentVersion": "1.0.2",
"currentVersion": "1.0.3",
"author": "Niels Heijmans",
"url": "",
"email": "",
Expand Down
2 changes: 2 additions & 0 deletions Packs/ThreatMiner/Integrations/ThreatMiner/README.md
Expand Up @@ -22,6 +22,8 @@ After you successfully execute a command, a DBot message appears in the War Room
***
Retrieves data from ThreatMiner about a specified domain.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down
@@ -0,0 +1 @@
Notice: Submitting indicators using the **domain** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details.
6 changes: 6 additions & 0 deletions Packs/ThreatMiner/ReleaseNotes/1_0_12.md
@@ -0,0 +1,6 @@

#### Integrations

##### ThreatMiner

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/ThreatMiner/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "ThreatMiner",
"description": "Data Mining for Threat Intelligence",
"support": "xsoar",
"currentVersion": "1.0.11",
"currentVersion": "1.0.12",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
4 changes: 4 additions & 0 deletions Packs/URLHaus/Integrations/URLHaus/README.md
Expand Up @@ -27,6 +27,8 @@ After you successfully execute a command, a DBot message appears in the War Room
***
Retrieves URL information from URLhaus.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down Expand Up @@ -151,6 +153,8 @@ Retrieves URL information from URLhaus.
***
Retrieves domain information from URLhaus.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down
5 changes: 5 additions & 0 deletions Packs/URLHaus/Integrations/URLHaus/URLHaus_description.md
Expand Up @@ -24,3 +24,8 @@ Determined by the blacklist spamhaus_dbl/surbl of the Domain.

Score is Malicious.


Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.
6 changes: 6 additions & 0 deletions Packs/URLHaus/ReleaseNotes/1_0_27.md
@@ -0,0 +1,6 @@

#### Integrations

##### URLhaus

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/URLHaus/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "URLhaus",
"description": "URLhaus has the goal of sharing malicious URLs that are being used for malware distribution.",
"support": "xsoar",
"currentVersion": "1.0.26",
"currentVersion": "1.0.27",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
5 changes: 4 additions & 1 deletion Packs/XForceExchange/.pack-ignore
Expand Up @@ -5,4 +5,7 @@ ignore=BA108,BA109
ignore=IM111

[file:XFE_image.png]
ignore=IM111
ignore=IM111

[known_words]
X-Force
4 changes: 4 additions & 0 deletions Packs/XForceExchange/Integrations/XFE_v2/README.md
Expand Up @@ -151,6 +151,8 @@ https://exchange.xforce.ibmcloud.com/ip/8.8.8.8
***
Check the given URL reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


##### Base Command

Expand Down Expand Up @@ -329,6 +331,8 @@ https://exchange.xforce.ibmcloud.com/malware/f2b8d790dab6d2c6945f9a0bce441921
***
Check domain reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


##### Base Command

Expand Down
31 changes: 18 additions & 13 deletions Packs/XForceExchange/Integrations/XFE_v2/XFE_v2_description.md
@@ -1,13 +1,18 @@
# Configure API Credentials

To configure the credentials of IBM X-Force Exchange, you should generate an API key and API password.
In order to generate those keys, you must have an IBM X-Force Exchange Account.
Then, follow the steps below:

1. Log in to the IBM X-Force Exchange website.
2. Click on the profile icon, and go to Settings.
3. Go to API Access tab, and generate an API key.
4. Copy your API key and API password, and enter it inside the API key and password fields.

**Note**: retain the API password for your records. You cannot request the API password again.
Also, provide a meaningful name for the API key.
# Configure API Credentials

To configure the credentials of IBM X-Force Exchange, you should generate an API key and API password.
In order to generate those keys, you must have an IBM X-Force Exchange Account.
Then, follow the steps below:

1. Log in to the IBM X-Force Exchange website.
2. Click on the profile icon, and go to Settings.
3. Go to API Access tab, and generate an API key.
4. Copy your API key and API password, and enter it inside the API key and password fields.

**Note**: retain the API password for your records. You cannot request the API password again.
Also, provide a meaningful name for the API key.

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.
6 changes: 6 additions & 0 deletions Packs/XForceExchange/ReleaseNotes/1_1_25.md
@@ -0,0 +1,6 @@

#### Integrations

##### IBM X-Force Exchange v2

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/XForceExchange/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "IBM X-Force Exchange",
"description": "IBM X-Force Exchange lets you receive threat intelligence about applications,\n IP addresses, URls and hashes",
"support": "xsoar",
"currentVersion": "1.1.24",
"currentVersion": "1.1.25",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down