ACTI Indicator Feed

Fetches indicators from a ACTI feed. You can filter returned indicators by indicator type, indicator severity, threat type, confidence, and malware family (each of these are an integration parameter).

Data Enrichment & Threat Intelligence · Accenture CTI Feed · Feed

Details

ID	`ACTI Indicator Feed`
Provider	Accenture
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Fetches indicators from an Accenture CTI feed. You can filter returned indicators by indicator type, indicator severity, threat type, confidence, and malware family (each of these are an integration parameter).
Ingesting the indicator is being done in an incremental manner.
This feed integration was integrated and tested with version v2.93.0 of ACTI.

Configure ACTI Indicator Feed in Cortex

Parameter	Description	Required
feed	Fetch indicators	False
api_token	API Key	True
feedReputation	Indicator Reputation	False
feedReliability	Source Reliability	True
tlp_color	Traffic Light Protocol Color	False
feedExpirationPolicy		False
feedExpirationInterval		False
feedFetchInterval	Feed Fetch Interval	False
feedIncremental	Incremental Feed	False
fetch_time	First fetch timestamp (`<number>` `<time unit>`, e.g., 12 hours, 7 days)	False
indicator_type	Indicator Type	True
severity	Indicator Severity	False
threat_type	Threat Type	False
confidence_from	Confidence	False
malware_family	Malware Family	False
feedBypassExclusionList	Bypass exclusion list	False
feedTags	Tags	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

acti-get-indicators

Gets the feed indicators.

Base Command

acti-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of results to return. The default value is 50.	Optional

Context Output

There is no context output for this command.

Command Example

!acti-get-indicators limit=10

Context Example

There is no context output for this command.

Indicators

value type rawJSON

http://example.com URL confidence: 50
display_text: http://example.com
index_timestamp: 2020-12-13T23:31:03.848Z
key: http://example.com
last_modified: 2020-12-13T23:29:13.000Z
last_published: 2020-12-07T14:50:44.000Z
last_seen: 2020-12-13T20:08:24.000Z
last_seen_as: MALWARE_DOWNLOAD
malware_family:
replication_id: xxx
severity: 3
threat_types: Cyber Crime
type: url
uuid: xxx

value	type	rawJSON
http://example.com	URL	confidence: 50 display_text: http://example.com index_timestamp: 2020-12-13T23:31:03.848Z key: http://example.com last_modified: 2020-12-13T23:29:13.000Z last_published: 2020-12-07T14:50:44.000Z last_seen: 2020-12-13T20:08:24.000Z last_seen_as: MALWARE_DOWNLOAD malware_family: replication_id: xxx severity: 3 threat_types: Cyber Crime type: url uuid: xxx

Configuration parameters

feed — Fetch indicators
api_token — (required)
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedIncremental — Incremental Feed
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
indicator_type — Indicator Type (required)
severity — Indicator Severity
threat_type — Threat Type
confidence_from — Confidence
malware_family — Malware Family
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

acti-get-indicators
Gets the feed indicators.

Source

ACTIIndicatorFeed.py ACTIIndicatorFeed_test.py ACTIIndicatorFeed.yml ACTIIndicatorFeed_description.md

Download History Raw

Fetch indicators from a Accenture CTI feed. You can apply filters to the feed to focus which indicators you want to ingest, for example, indicator severity, confidence, threat type and malware family. By default, the feed fetches three indicator types: IP, Domain and URL. 

## Get Your API Key
 This feed requires that you have an ACTI API key. To get your API key refer to the **Obtain API token** section in the [Accenture CTI documentation](https://intelgraph.idefense.com/#/docs/view#page-section-2-0).