forked from demisto/content
-
Notifications
You must be signed in to change notification settings - Fork 13
/
FeedCyCognito.yml
282 lines (263 loc) · 12.2 KB
/
FeedCyCognito.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
category: Data Enrichment & Threat Intelligence
commonfields:
id: FeedCyCognito
version: -1
configuration:
- additionalinfo: The API Key required to authenticate to the service.
display: API Key
name: api_key
required: true
type: 4
- additionalinfo: The type of assets to be retrieved.
display: Asset Type
name: asset_type
options:
- ip
- domain
- cert
- webapp
- iprange
required: true
type: 15
- additionalinfo: |-
The date or relative timestamp from where to start fetching assets.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
defaultvalue: 2 weeks
display: First Fetch Time
name: first_fetch
type: 0
required: false
- additionalinfo: The maximum number of assets to fetch every time. The maximum value is '1000'.
defaultvalue: "50"
display: Max Fetch
name: max_fetch
type: 0
required: false
- additionalinfo: Retrieves the assets attributed to a specific organization, subsidiary, or assignee. Supports comma-separated values.
display: Organizations
name: organizations
type: 0
required: false
- additionalinfo: |-
Filters the assets according to security grade.
Supported values:
A: Very strong,
B: Strong,
C: Less vulnerable,
D: Vulnerable,
F: Highly vulnerable
display: Security Grade
name: security_grade
options:
- "A: Very strong"
- "B: Strong"
- "C: Less vulnerable"
- "D: Vulnerable"
- "F: Highly vulnerable"
type: 16
required: false
- additionalinfo: |-
Filters the assets based on their hosting type.
Supported values: 'owned', 'cloud', 'undetermined'
display: Hosting Type
name: hosting_type
options:
- cloud
- owned
- undetermined
type: 16
required: false
- additionalinfo: |-
Filters the assets based on the geographic locations to which they belong. Multiple selection is supported.
Locations are available only for IP, Domain, and Certificate asset types.
display: Locations
name: locations
options: ["Afghanistan", "Aland Islands", "Albania", "Algeria", "American Samoa", "Andorra", "Angola", "Anguilla", "Antarctica", "Antigua and Barbuda", "Argentina", "Armenia", "Aruba", "Australia", "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", "Bermuda", "Bhutan", "Bolivia, Plurinational State of", "Bonaire, Sint Eustatius and Saba", "Bosnia and Herzegovina", "Botswana", "Bouvet Island", "Brazil", "British Indian Ocean Territory", "Brunei Darussalam", "Bulgaria", "Burkina Faso", "Burundi", "Cabo Verde", "Cambodia", "Cameroon", "Canada", "Cayman Islands", "Central African Republic", "Chad", "Chile", "China", "Christmas Island", "Cocos (Keeling) Islands", "Colombia", "Comoros", "Congo", "Congo, The Democratic Republic of the", "Cook Islands", "Costa Rica", "Cote d'Ivoire", "Croatia", "Cuba", "Curacao", "Cyprus", "Czechia", "Denmark", "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", "Estonia", "Eswatini", "Ethiopia", "Falkland Islands (Malvinas)", "Faroe Islands", "Fiji", "Finland", "France", "French Guiana", "French Polynesia", "French Southern Territories", "Gabon", "Gambia", "Georgia", "Germany", "Ghana", "Gibraltar", "Greece", "Greenland", "Grenada", "Guadeloupe", "Guam", "Guatemala", "Guernsey", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Heard Island and McDonald Islands", "Holy See", "Honduras", "Hong Kong", "Hungary", "Iceland", "India", "Indonesia", "Iran, Islamic Republic of", "Iraq", "Ireland", "Isle of Man", "Israel", "Italy", "Jamaica", "Japan", "Jersey", "Jordan", "Kazakhstan", "Kenya", "Kiribati", "Korea, Democratic People's Republic of", "Korea, Republic of", "Kuwait", "Kyrgyzstan", "Lao People's Democratic Republic", "Latvia", "Lebanon", "Lesotho", "Liberia", "Libya", "Liechtenstein", "Lithuania", "Luxembourg", "Macao", "Madagascar", "Malawi", "Malaysia", "Maldives", "Mali", "Malta", "Marshall Islands", "Martinique", "Mauritania", "Mauritius", "Mayotte", "Mexico", "Micronesia, Federated States of", "Moldova, Republic of", "Monaco", "Mongolia", "Montenegro", "Montserrat", "Morocco", "Mozambique", "Myanmar", "Namibia", "Nauru", "Nepal", "Netherlands", "New Caledonia", "New Zealand", "Nicaragua", "Niger", "Nigeria", "Niue", "Norfolk Island", "North Macedonia", "Northern Mariana Islands", "Norway", "Oman", "Pakistan", "Palau", "Palestine, State of", "Panama", "Papua New Guinea", "Paraguay", "Peru", "Philippines", "Pitcairn", "Poland", "Portugal", "Puerto Rico", "Qatar", "Reunion", "Romania", "Russian Federation", "Rwanda", "Saint Barthelemy", "Saint Helena, Ascension and Tristan da Cunha", "Saint Kitts and Nevis", "Saint Lucia", "Saint Martin (French part)", "Saint Pierre and Miquelon", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Sint Maarten (Dutch part)", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", "South Georgia and the South Sandwich Islands", "South Sudan", "Spain", "Sri Lanka", "Sudan", "Suriname", "Svalbard and Jan Mayen", "Sweden", "Switzerland", "Syrian Arab Republic", "Taiwan, Province of China", "Tajikistan", "Tanzania, United Republic of", "Thailand", "Timor-Leste", "Togo", "Tokelau", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", "Turks and Caicos Islands", "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "United Kingdom of Great Britain and Northern Ireland", "United States of America", "United States Minor Outlying Islands", "Uruguay", "Uzbekistan", "Vanuatu", "Venezuela, Bolivarian Republic of", "Vietnam", "Virgin Islands, British", "Virgin Islands, U.S.", "Wallis and Futuna", "Western Sahara", "Yemen", "Zambia", "Zimbabwe"]
type: 16
required: false
- defaultvalue: "true"
display: Fetch indicators
name: feed
type: 8
required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
defaultvalue: Good
display: Indicator Reputation
name: feedReputation
options:
- None
- Good
- Suspicious
- Bad
type: 18
required: false
- additionalinfo: Reliability of the source providing the intelligence data.
defaultvalue: B - Usually reliable
display: Source Reliability
name: feedReliability
options:
- A - Completely reliable
- B - Usually reliable
- C - Fairly reliable
- D - Not usually reliable
- E - Unreliable
- F - Reliability cannot be judged
required: true
type: 15
- defaultvalue: "1440"
display: Feed Fetch Interval
name: feedFetchInterval
type: 19
required: false
- name: feedExpirationPolicy
display: ""
options:
- never
- interval
- indicatorType
- suddenDeath
type: 17
required: false
- name: feedExpirationInterval
defaultvalue: "20160"
display: ""
type: 1
required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
defaultvalue: "false"
display: Bypass exclusion list
name: feedBypassExclusionList
type: 8
required: false
- additionalinfo: Supports CSV values.
display: Tags
name: feedTags
type: 0
required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
display: Traffic Light Protocol Color
name: tlp_color
options:
- RED
- AMBER
- GREEN
- WHITE
type: 15
required: false
- additionalinfo: When selected, all the incoming indicators will map to a CyCognito Asset indicator type.
display: Default Indicator Mapping
name: default_mapping
type: 8
required: false
- additionalinfo: |-
When selected, Fetches only live assets.
Note: This filter supports only IP and IP Range type of assets.
display: Fetch only Live Assets
name: only_alive
type: 8
defaultvalue: "true"
required: false
- additionalinfo: Indicates whether to allow connections without verifying the SSL certificate's validity.
defaultvalue: "false"
display: Trust any certificate (not secure)
name: insecure
type: 8
required: false
- additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API.
defaultvalue: "false"
display: Use system proxy settings
name: proxy
type: 8
required: false
description: The CyCognito Feed integration retrieves the discovered assets from the CyCognito platform based on user-specified filters. A comprehensive dashboard and layout are also included.
display: CyCognito Feed
name: FeedCyCognito
script:
commands:
- arguments:
- auto: PREDEFINED
description: |-
The type of asset to be retrieved.
Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'
name: asset_type
predefined:
- ip
- domain
- cert
- webapp
- iprange
required: true
- defaultValue: '50'
description: |-
The number of results to retrieve.
Maximum value is '1000'
name: count
- defaultValue: '0'
description: Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.
name: offset
- description: |-
An Advanced Search parameter to query the response.
Note: Retrieves all the occurrences that are included in the string.
name: search
- description: 'The name of the field by which to sort the results. The response fields available for sorting the data are found in the following documentation: https://docs.cycognito.com/reference/reference-getting-started'
name: sort_by
- auto: PREDEFINED
defaultValue: desc
description: |-
Specifies whether to sort the results in either ascending or descending order.
Supported values: 'asc', 'desc'
name: sort_order
predefined:
- asc
- desc
- description: |-
The date and time at which CyCognito first discovered and attributed the asset to the organization.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
name: first_seen
- description: |-
The date and time at which CyCognito most recently attributed the asset to the organization.
Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ
For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
name: last_seen
- description: Retrieves the assets attributed to a specific organization, subsidiary, or assignee. Supports comma-separated values.
name: organizations
- description: |-
Filters the assets according to their hosting type. Supports comma-separated values.
Supported values: 'owned', 'cloud', 'undetermined'
name: hosting_type
- description: |-
Filters the assets according to security rating. Supports comma-separated values.
Supported values: 'A', 'B', 'C', 'D', 'F'
Where:
A = Very strong
B = Strong
C = Less vulnerable
D = Vulnerable
F = Highly vulnerable
name: security_grade
- description: |-
Filters the assets according to their status. Supports comma-separated values.
Supported values: 'changed', 'new', 'normal'
name: status
- description: |-
The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries--e.g., IND, USA.
Locations are available only for IP, Domain, and Certificate asset types.
name: locations
- description: A keyword or phrase that can be added to an asset or issue metadata. Supports comma-separated values.
name: tags
description: Fetches a given limit of indicators from the CyCognito platform and displays them in human-readable format in the war room.
name: cycognito-get-indicators
dockerimage: demisto/pycountry:1.0.0.65943
feed: true
runonce: false
script: '-'
subtype: python3
type: python
tests:
- FeedCyCognito-Test
marketplaces:
- xsoar
- marketplacev2
fromversion: 6.2.0