C2sec irisk

Understand Your Cyber Exposure as Easy as a Google Search.

Data Enrichment & Threat Intelligence · C2sec irisk

Details

ID	`C2sec irisk`
Provider	C2Sec
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use the C2sec irisk integration to scan domains and return scan results.

C2sec irisk Playbooks

C2SEC-Domain Scan - scans domains and waits for the full response from the C2sec irisk service.

Configure C2sec irisk on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for C2sec irisk.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API URL (e.g. https://api.c2sec.com/api)
- API Key
- Default domain name
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Add a domain to a portfolio: irisk-add-domain
Get the status of a scan: irisk-get-scan-status
Re-scan a domain: irisk-rescan-domain
Get the issues for a domain: irisk-get-domain-issues
Get the results of a scan: irisk-get-scan-results

1. Add a domain to a portfolio

Adds a domain to a portfolio.

Base Command

irisk-add-domain

Input

Argument Name	Description	Required
domain	Domain to add to the portfolio. If empty, the default domain will be used.	Optional
newscan	Flag to indicate whether a new scan is always initiated for the specified domain.	Required

Context Output

Path	Type	Description
C2Sec.Domain.result	string	Result status of adding the new company.
C2Sec.Domain.Name	string	The name of the searched domain.

Command Example

!irisk-add-domain newscan=false domain=demisto.com

Human Readable Output

2. Get the status of a scan

Queries the status of a scan.

Base Command

irisk-get-scan-status

Input

Argument Name	Description	Required
id	Domain workitemid for which to check the status.	Required

Context Output

Path	Type	Description
C2sec.Domain.Scan.domain	string	The name of the scanned domain.
C2sec.Domain.Scan.workitemid	number	The ID of the current scan.
C2sec.Domain.Scan.completeTime	date	The time that the scan was completed.
C2sec.Domain.Scan.creationTime	date	The time that the scan was initiated.
C2sec.Domain.Scan.status	number	The status of the current scan (“processing”/“completed”).

Command Example

!irisk-get-scan-status id=1247

Human Readable Output

3. Re-scan a domain

Initiates a re-scan for a domain within a portfolio.

Base Command

irisk-rescan-domain

Input

Argument Name	Description	Required
domain	Domain to re-scan. If empty, the default domain will be used.	Optional

Context Output

Path	Type	Description
C2sec.Domain.Scan.domain	string	The name of the scanned domain.
C2sec.Domain.Scan.workitemid	number	Scan ID.
C2sec.Domain.Scan.result	string	The scan result status.

Command Example

!irisk-rescan-domain domain=demisto.com

Human Readable Output

4. Get the issues for a domain

Returns the issues located under the specified domain.

Base Command

irisk-get-domain-issues

Input

Argument Name	Description	Required
domain	The domain to query. If empty, the default domain it will be used.	Optional
severity	Filter query results by issue severity…	Optional

Context Output

Path	Type	Description
C2sec.Domain.Name	string	The name of the domain against which it was checked.
C2sec.Domain.Issue.ID	string	Issue ID.
C2sec.Domain.Issue.Asset	string	Asset associated with the issues. For example, IP addresses, website URLs, and so on.
C2sec.Domain.Issue.Component	string	The component used in the issue.
C2sec.Domain.Issue.ComponentDisplay	string	The display name of the component being used.
C2sec.Domain.Issue.Details	string	The details for the issue.
C2sec.Domain.Issue.Issue	string	The name of the issue.
C2sec.Domain.Issue.Severity	string	The severity of the issue.

Command Example

!irisk-get-domain-issues domain=google.com

Human Readable Output

5. Get the results of a scan

Queries data for a specific component for companies in the portfolio.

Base Command

irisk-get-scan-results

Input

Argument Name	Description	Required
domain	The domain to query. If empty, default domain will be used.	Required
component	The component to query.	Required

Context Output

Path	Type	Description
C2sec.Domain.application.result	string	Query status.
C2sec.Domain.application.Domain	string	The domain name being queried.
C2sec.Domain.application.data.appdetail	string	Details about the application being checked.
C2sec.Domain.application.data.info	string	Information regarding the data being processed.
C2sec.Domain.application.data.website	string	Website address being processed.
C2sec.Domain.credential.result	string	Query status.
C2sec.Domain.credential.Domain	string	The domain name being queried.
C2sec.Domain.credential.data.user	string	User name.
C2sec.Domain.credential.data.pw	string	User password.
C2sec.Domain.network.result	string	Query status.
C2sec.Domain.network.Domain	string	The domain name being queried.
C2sec.Domain.network.data.firewall	string	Firewall status.
C2sec.Domain.network.data.port	string	Port number.
C2sec.Domain.network.data.IP	string	IP address.
C2sec.Domain.network.data.Name	string	Name of the user.
C2sec.Domain.network.data.service	string	Name of the service being used.
C2sec.Domain.network.data.protocol	string	Name of the protocol being used.
C2sec.Domain.network.data.state	string	State of the network application (“open” or “closed”).

Command Example

!irisk-get-scan-results component=application domain=demisto.com

Human Readable Output

Configuration parameters

endpointURL — API URL (e.g. https://api.c2sec.com/api) (required)
apikey — API Key
apikey_creds —
domainName — Default domain name (required)
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (5)

irisk-add-domain
Adds a domain to portfolio.
irisk-get-domain-issues
Returns the issues located under the specified domain.
irisk-get-scan-results
Query Data for specific component for companies in the portfolio
irisk-get-scan-status
Queries the status of a scan.
irisk-rescan-domain
Initiates a re-scan for a domain within a portfolio.

Source

C2sec.py C2sec.yml C2sec_description.md

Download History Raw

commonfields:
  id: C2sec irisk
  version: -1
name: C2sec irisk
display: C2sec irisk
fromversion: 5.0.0
category: Data Enrichment & Threat Intelligence
provider: C2Sec
description: Understand Your Cyber Exposure as Easy as a Google Search.
configuration:
- display: API URL (e.g. https://api.c2sec.com/api)
  name: endpointURL
  defaultvalue: ""
  type: 0
  required: true
- display: API Key
  name: apikey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- name: apikey_creds
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: Default domain name
  name: domainName
  type: 0
  required: true
  defaultvalue: ''
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8

  required: false
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: irisk-add-domain
    arguments:
    - name: domain
      description: Domain to add to the portfolio. If empty, default domain will be used.
    - name: newscan
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Flag to indicate whether a new scan is always initiated for the specified domain.
      defaultValue: "true"
    outputs:
    - contextPath: C2Sec.Domain.result
      description: Result status of adding the new company.
    - contextPath: C2Sec.Domain.Name
      description: The name of the searched domain.
    description: Adds a domain to portfolio.
  - name: irisk-get-scan-status
    arguments:
    - name: id
      required: true
      description: Domain workitemid for which to check the status.
    outputs:
    - contextPath: C2sec.Domain.Scan.domain
      description: The name of the scanned domain.
      type: string
    - contextPath: C2sec.Domain.Scan.workitemid
      description: The ID of the current scan.
      type: number
    - contextPath: C2sec.Domain.Scan.completeTime
      description: The time that the scan was completed.
      type: date
    - contextPath: C2sec.Domain.Scan.creationTime
      description: The time that the scan was initiated.
      type: date
    - contextPath: C2sec.Domain.Scan.status
      description: The status of the current scan ("processing"/"completed").
      type: number
    description: Queries the status of a scan.
  - name: irisk-rescan-domain
    arguments:
    - name: domain
      description: Domain to re-scan. If empty, the default domain will be used.
    outputs:
    - contextPath: C2sec.Domain.Scan.domain
      description: The name of the scanned domain.
      type: string
    - contextPath: C2sec.Domain.Scan.workitemid
      description: Scan ID.
      type: number
    - contextPath: C2sec.Domain.Scan.result
      description: The scan result status.
      type: string
    description: Initiates a re-scan for a domain within a portfolio.
  - name: irisk-get-domain-issues
    arguments:
    - name: domain
      description: The domain to query. If empty, the default domain it will be used.
    - name: severity
      description: Filter query results by issue severity..
    outputs:
    - contextPath: C2sec.Domain.Name
      description: The name of the domain against which it was checked.
      type: string
    - contextPath: C2sec.Domain.Issue.ID
      description: Issue ID.
      type: string
    - contextPath: C2sec.Domain.Issue.Asset
      description: Asset associated with the issues. For example, IP addresses, website URLs, and so on.
      type: string
    - contextPath: C2sec.Domain.Issue.Component
      description: The component used in the issue.
      type: string
    - contextPath: C2sec.Domain.Issue.ComponentDisplay
      description: The display name of the component being used.
      type: string
    - contextPath: C2sec.Domain.Issue.Details
      description: The details for the issue.
      type: string
    - contextPath: C2sec.Domain.Issue.Issue
      description: The name of the issue.
      type: string
    - contextPath: C2sec.Domain.Issue.Severity
      description: The severity of the issue.
      type: string
    description: Returns the issues located under the specified domain.
  - name: irisk-get-scan-results
    arguments:
    - name: domain
      required: true
      description: The domain to query. If empty, default domain will be used.
    - name: component
      required: true
      auto: PREDEFINED
      predefined:
      - credential
      - network
      - application
      description: The component to query.
    outputs:
    - contextPath: C2sec.Domain.application.result
      description: Query status.
      type: string
    - contextPath: C2sec.Domain.application.Domain
      description: The domain name being queried.
      type: string
    - contextPath: C2sec.Domain.application.data.appdetail
      description: Details about the application being checked.
      type: string
    - contextPath: C2sec.Domain.application.data.info
      description: Information regarding the data being processed.
      type: string
    - contextPath: C2sec.Domain.application.data.website
      description: Website address being processed.
      type: string
    - contextPath: C2sec.Domain.credential.result
      description: Query status.
      type: string
    - contextPath: C2sec.Domain.credential.Domain
      description: The domain name being queried.
      type: string
    - contextPath: C2sec.Domain.credential.data.user
      description: User name.
      type: string
    - contextPath: C2sec.Domain.credential.data.pw
      description: User password.
      type: string
    - contextPath: C2sec.Domain.network.result
      description: Query status.
      type: string
    - contextPath: C2sec.Domain.network.Domain
      description: The domain name being queried.
      type: string
    - contextPath: C2sec.Domain.network.data.firewall
      description: Firewall status.
      type: string
    - contextPath: C2sec.Domain.network.data.port
      description: Port number.
      type: string
    - contextPath: C2sec.Domain.network.data.IP
      description: IP address.
      type: string
    - contextPath: C2sec.Domain.network.data.Name
      description: Name of the user.
      type: string
    - contextPath: C2sec.Domain.network.data.service
      description: Name of the service being used.
      type: string
    - contextPath: C2sec.Domain.network.data.protocol
      description: Name of the protocol being used.
      type: string
    - contextPath: C2sec.Domain.network.data.state
      description: State of the network application ("open" or "closed").
      type: string
    description: Query Data for specific component for companies in the portfolio
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)