Analyst1

This integration utilizes Analyst1's system to enrich XSOAR indicators with data provided by the Analyst1 REST API, such as actor and malware information, activity and reported dates, evidence and hit counts, and more.

Data Enrichment & Threat Intelligence · Analyst1

Configuration parameters

  • auth_method — Authentication Method (required)
  • credentials — Client ID/Username (required)
  • server — Domain of Analyst1 server to use (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • riskScoreLowest — Risk Score Mapping: Lowest
  • riskScoreLow — Risk Score Mapping: Low
  • riskScoreModerate — Risk Score Mapping: Moderate
  • riskScoreHigh — Risk Score Mapping: High
  • riskScoreCritical — Risk Score Mapping: Critical
  • riskScoreUnknown — Risk Score Mapping: Unknown
  • applyTags — Apply Analyst1 entity-type tags to indicators
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (20)

  • analyst1-batch-check

    Queries the Analyst1 REST API for indicator enrichment data based on a CSV input of multiple indicator values.

  • analyst1-batch-check-post

    Similar to analyst1-batch-check, however the inputs can be more complex. The 'values' input accepts comma or newline delimited text. This allows for more complex Indicators or larger Indicator sets to be searched. The 'values_array' allows for preformed array inputs or array-like inputs to be submitted. Output is the same.

  • analyst1-enrich-http-request

    Queries the Analyst1 REST API and enriches the given HTTP request with Analyst1 indicator data.

  • analyst1-enrich-ipv6

    Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data.

  • analyst1-enrich-mutex

    Queries the Analyst1 REST API and enriches the given mutex with Analyst1 indicator data.

  • analyst1-enrich-string

    Queries the Analyst1 REST API and enriches the given string with Analyst1 indicator data.

  • analyst1-evidence-file-fetch

    Download an evidence file from Analyst1 by its ID.

  • analyst1-evidence-search

    Search for evidence in Analyst1 using filters and search terms.

  • analyst1-evidence-status

    Check on the status of the analyst1-evidence-submit action by using its output UUID.

  • analyst1-evidence-submit

    Submits an 'Evidence' to Analyst1. Submission can be any text or attachment (PDF, JSON,DOCX...). The a1Bot will extract all relevant context. The 'Evidence' can from an external source (email attachment, secure download) or constructed text/JSON within XSOAR to communicate intelligence results back to Analyst1.

  • analyst1-get-sensor-config

    Queries the Analyst1 REST API for the current sensor config given a valid Sensor ID. This config file is meant to be directly provided to a device (IDS, IPS, Firewall, SNORT...) for configuration replacements.

  • analyst1-get-sensor-diff

    Gets the 'difference' from the last known Analyst1 Sensor version against the current. Returns all differences on the Sensor since the 'version' provided and includes the current version in the reply. Current version should be preserved to be used on next scheduled invocation.

  • analyst1-get-sensor-taskings

    Queries the Analyst1 REST API for the current sensor taskings given a valid Sensor ID. This can be used to start subscription to an Sensor ID. The result gives the version (which can later be used to invoke 'diff') and all current taskings. Note: This operation may trigger XSOAR to "oversize" the task built on this automation. If so, you may need to turn off quiet mode explicitly. The analyst1-get-sensor-config can alternatively be used to get a simple text file of current indicators or signatures.

  • analyst1-get-sensors

    Queries the Analyst1 REST API to retrieve a list of registered sensors.

  • analyst1-indicator-by-id

    Gets the full JSON for an Analyst1 Indicator given the internal Analyst1 Indicator ID. Use this when full Indicator context is required for additional processing. This always includes all sources, enrichments, and every piece of information available in the Analyst1 platform, including integrated system's original enrichment JSON or results.

  • domain

    Queries the Analyst1 REST API and enriches the given domain with Analyst1 Indicator data.

  • email

    Queries the Analyst1 REST API and enriches the given email with Analyst1 indicator data.

  • file

    Queries the Analyst1 REST API and enriches the given file with Analyst1 indicator data.

  • ip

    Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data.

  • url

    Queries the Analyst1 REST API and enriches the given URL with Analyst1 indicator data.