Anomali ThreatStream Feed

Details

ID	`Anomali ThreatStream Feed`
Provider	Anomali
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`

README

Use the Anomali ThreatStream Feed Integration to fetch indicators from the Anomali ThreatStream.

Configure Anomali ThreatStream Feed in Cortex

Parameter	Description	Required
Fetch indicators	Enable this checkbox to automatically pull indicators from the Anomali ThreatStream at regular intervals.
Fetch by	Fetch by the modification or creation time of the indicators.	True
Server URL (e.g., https://www.test.com)	Confirm that the pre-filled URL matches the correct API endpoint for your Anomali ThreatStream instance.	True
Username		True
API Key		True
Feed Fetch Interval		False
Confidence Threshold	Will only return indicators above the confidence threshold.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. Indicator’s TLP will override the default value.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation. If not selected, Indicators’ verdicts are determined by their Dbot score from the API. The default is Unknown.	False
Indicator Expiration Method	The method by which to expire indicators from this feed for this integration instance.	False
Create relationships		False
Trust any certificate (not secure)		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

threatstream-feed-get-indicators

Gets indicators from the feed. This command is mainly used for testing and debugging purposes.

Base Command

threatstream-feed-get-indicators

Input

Argument Name	Description	Required
indicator_type	The indicator type to analyze. If not selected, indicators from all types are retrieved. Possible values are: domain, ip, md5, url, email.	Optional
limit	Maximum number of objects to return. Default is 10.	Optional
sort_by	Sort the records in descending order according to the Created or Modified Time. Possible values are: Created Time, Modified Time. Default is Modified Time.	Optional

Context Output

There is no context output for this command.

Command example

!threatstream-feed-get-indicators indicator_type="domain" limit="5" sort_by="Created Time"

Human Readable Output

Indicators from Anomali ThreatStream Feed

Source ThreatStreamID Domain Modified Confidence Creation Tags TrafficLightProtocol

Demisto 440576095 my.domainnn_test.com 2023-12-24T00:00:05.890Z 50 2023-06-20T08:07:33.841Z values: tag3452, tag23452

Demisto 440126275 my.domain_987.com 2023-12-24T00:00:05.877Z 50 2023-06-19T12:14:52.216Z values: tag3452, tag23452

Demisto 439658732 my.domain1357.com 2023-09-16T10:10:05.788Z 50 2023-06-18T10:02:07.876Z

dummydomain.com 284008208 test_domain_121.com 2025-04-05T01:48:33.997Z 0 2021-11-16T09:40:10.407Z values: tag4567 amber

Analyst 231953546 abc_test_domain1.com 2023-07-17T09:55:54.228Z 60 2021-04-06T09:36:09.122Z values: tag1356

Source	ThreatStreamID	Domain	Modified	Confidence	Creation	Tags	TrafficLightProtocol
Demisto	440576095	my.domainnn_test.com	2023-12-24T00:00:05.890Z	50	2023-06-20T08:07:33.841Z	*values*: tag3452, tag23452
Demisto	440126275	my.domain_987.com	2023-12-24T00:00:05.877Z	50	2023-06-19T12:14:52.216Z	*values*: tag3452, tag23452
Demisto	439658732	my.domain1357.com	2023-09-16T10:10:05.788Z	50	2023-06-18T10:02:07.876Z
dummydomain.com	284008208	test_domain_121.com	2025-04-05T01:48:33.997Z	0	2021-11-16T09:40:10.407Z	*values*: tag4567	amber
Analyst	231953546	abc_test_domain1.com	2023-07-17T09:55:54.228Z	60	2021-04-06T09:36:09.122Z	*values*: tag1356

Configuration parameters

feed — Fetch indicators
fetchBy — Fetch by (required)
url — Server URL (e.g., https://www.test.com) (required)
credentials — Username (required)
feedFetchInterval — Feed Fetch Interval
confidenceThreshold — Confidence Threshold
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedReputation — Indicator Reputation
feedExpirationPolicy —
createRelationships — Create relationships
insecure — Trust any certificate (not secure)

Commands (1)

threatstream-feed-get-indicators
Gets indicators from the feed. This command is mainly used for testing and debugging purposes.

Source

AnomaliThreatStreamFeed.py AnomaliThreatStreamFeed_test.py AnomaliThreatStreamFeed.yml AnomaliThreatStreamFeed_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Anomali
sectionorder:
- Connect
- Collect
commonfields:
  id: Anomali ThreatStream Feed
  version: -1
configuration:
- display: Fetch indicators
  defaultvalue: 'true'
  name: feed
  type: 8
  section: Collect
  additionalinfo: Enable this checkbox to automatically pull indicators from the Anomali ThreatStream at regular intervals.
- display: Fetch by
  name: fetchBy
  type: 15
  defaultvalue: "Modified Time"
  required: true
  options:
  - "Created Time"
  - "Modified Time"
  section: Collect
- display: Server URL (e.g., https://www.test.com)
  defaultvalue: https://api.threatstream.com
  name: url
  required: true
  type: 0
  section: Connect
  additionalinfo: Confirm that the pre-filled URL matches the correct API endpoint for your Anomali ThreatStream instance.
- display: Username
  name: credentials
  required: true
  type: 9
  displaypassword: API Key
  section: Connect
- display: Feed Fetch Interval
  defaultvalue: '240'
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- display: Confidence Threshold
  name: confidenceThreshold
  required: false
  advanced: true
  defaultvalue: '65'
  section: Collect
  type: 0
  additionalinfo: Will only return indicators above the confidence threshold.
- display: Source Reliability
  defaultvalue: C - Fairly reliable
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  advanced: true
  additionalinfo: Reliability of the source providing the intelligence data.
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. Indicator's TLP will override the default value.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  defaultvalue: WHITE
  required: false
  section: Collect
  advanced: true
- display: Indicator Reputation
  additionalinfo: Indicators from this integration instance will be marked with this reputation. If not selected, Indicators' verdicts are determined by their Dbot score from the API. The default is Unknown.
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  advanced: true
  required: false
  section: Collect
- defaultvalue: indicatorType
  display: ""
  name: feedExpirationPolicy 
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  advanced: true
  required: false
  section: Collect
- display: Create relationships 
  defaultvalue: 'true'
  name: createRelationships
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  defaultvalue: 'false'
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use the Anomali ThreatStream Feed Integration to fetch indicators from the Anomali ThreatStream.
display: Anomali ThreatStream Feed
name: Anomali ThreatStream Feed
script:
  commands:
  - arguments:
    - name: indicator_type 
      auto: PREDEFINED
      description: The indicator type to analyze. If not selected, indicators from all types are retrieved.
      isArray: false
      required: false
      predefined:
      - 'domain'
      - 'ip'
      - 'md5'
      - 'url'
      - 'email'
    - name: limit
      defaultValue: "10"
      description: Maximum number of objects to return.
      isArray: false
      required: false
      type: Number
    - name: sort_by 
      auto: PREDEFINED
      defaultValue: 'Modified Time'
      description: Sort the records in descending order according to the Created or Modified Time.
      isArray: false
      required: false
      predefined:
      - 'Created Time'
      - 'Modified Time'
    description: Gets indicators from the feed. This command is mainly used for testing and debugging purposes.
    name: threatstream-feed-get-indicators
  dockerimage: demisto/py3-tools:1.0.0.10120494
  runonce: false
  feed: true
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0