Cofense Triage Deprecated

Deprecated. Use the Cofense Triage v2 integration instead.

Data Enrichment & Threat Intelligence · Cofense Triage

Details

IDCofense Triage
ProviderCofense
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.8.3.8715
Supported ModulesAgentix XSIAM

README

Deprecated. Use the Cofense Triage v2 integration instead.

Configure Cofense Triage on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Cofense Triage.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL (e.g., https://192.168.0.1)
    • User
    • API Token
    • Fetch incidents
    • Incident type
    • First fetch time ( , e.g., 12 hours, 7 days, 3 months, 1 year)
    • Category ID to fetch - corresponds to the ranking that determines the Cofense Triage prioritization (1-5)
    • Match Priority - the highest match priority based on rule hits for the report
    • Tags - CSV list of tags of processed reports by which to filter
    • Maximum number of incidents to fetch each time
    • Trust any certificate (not secure)
    • Use system proxy
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Search reports: cofense-search-reports
  2. Get an attachment: cofense-get-attachment
  3. Get the reporter email address: cofense-get-reporter
  4. Get a report: cofense-get-report-by-id

1. Search reports

Runs a query for reports.

Base Command

cofense-search-reports

Input
Argument Name Description Required
file_hash File hash, MD5 or SHA256. Optional
url The reported URLs. Optional
subject Report subject. Optional
reported_at Retrieve reports that were reported after this time, for example: "2 hours, 4 minutes, 6 month, 1 day". Optional
created_at Retrieve reports that were created after this time, for example: "2 hours, 4 minutes, 6 month, 1 day". Optional
reporter Name or ID of the reporter. Optional
max_matches Maximum number of matches to fetch. Default is 30. Optional
verbose Returns all fields of a report. Optional

 

Context Output
Path Type Description
Report.ID unknown ID number of the report.
Report.EmailAttachments unknown Email attachments.
Report.EmailAttachments.id unknown Email attachment ID.
Report.Tags string Report tags.
Report.ClusterId number Cluster ID number.
Report.CategoryId number Report category.
Report.CreatedAt date Report creation date.
Report.ReportedAt string Reporting time.
Report.MatchPriority number The highest match priority based on rule hits for the report.
Report.ReporterId number Reporter ID.
Report.Location string Location of the report.
Report.Reporter string Reporter email address.
Report.SuspectFromAddress string Suspect from address.
Report.ReportSubject string Report subject.
Report.ReportBody string Report body.
Report.Md5 number MD5 hash of the file.
Report.Sha256 unknown SHA256 hash of the file.

 

Command Example
cofense-search-reports max_matches=30 created_at="60 days" reported_at="60 days" reporter=5328
Context Example
{
    "Cofense.Report": [
        {
            "ReportBody": "Good day\n\n\nPlease arrange to provide the best offer for below attached Purchase Order\nThe requirement for our green field project in Berghofen,Dortmund.\nKindly get back to us\n\n \n\n\n1) Proforma invoice with bank details\n\n2) Delivery date \n\n3) FOB/CIF Port\n\n \n\n \n \nRegards,\n\nkahn Gotze\nSales & Services Assistant\n",
            "ReportedAt": "2019-05-17T11:37:52.000Z",
            "ReporterId": 5328,
            "Tags": [],
            "ClusterId": null,
            "ID": 13232,
            "Location": "Processed",
            "EmailAttachments": [
                {
                    "content_type": "application/octet-stream; name=ORDER#t571BA80.rar",
                    "size_in_bytes": 219777,
                    "decoded_filename": "ORDER#t571BA80.rar",
                    "email_attachment_payload": {
                        "sha256": "1e2c4ac7be08888c72c953adaeb79254e7e9b821988bfdad5d75d75b2467def1",
                        "id": 7037,
                        "mime_type": "application/x-rar; charset=binary",
                        "md5": "e74c45a697651f3942f86fc5fce009df"
                    },
                    "id": 17831,
                    "report_id": 13232
                }
            ],
            "ReportSubject": "NEW ORDER",
            "MatchPriority": 5,
            "Sha256": "ca2579c53bd4ff0fa70fe38ae09a893c9332b8dfeab6ca7a13b89a709d54c0bb",
            "CategoryId": 3,
            "CreatedAt": "2019-05-17T16:57:16.343Z",
            "Md5": "f5a1766371c063414d8b6a616b19bad0"
        }
    ]
}
Human Readable Output

Reports:

Category Id Email Attachments Sha256 Created At Id Match Priority Location Report Body Report Subject Reported At Reporter Id Md5
3 {'id': 17831, 'report_id': 13232, 'decoded_filename': 'ORDER#t571BA80.rar', 'content_type': 'application/octet-stream; name=ORDER#t571BA80.rar', 'size_in_bytes': 219777, 'email_attachment_payload': {'id': 7037, 'md5': 'e74c45a697651f3942f86fc5fce009df', 'sha256': '1e2c4ac7be08888c72c953adaeb79254e7e9b821988bfdad5d75d75b2467def1', 'mime_type': 'application/x-rar; charset=binary'}} ca2579c53bd4ff0fa70fe38ae09a893c9332b8dfeab6ca7a13b89a709d54c0bb 2019-05-17T16:57:16.343Z 13232 5 Processed Good day


Please arrange to provide the best offer for below attached Purchase Order
The requirement for our green field project in Berghofen,Dortmund.
Kindly get back to us




1) Proforma invoice with bank details

2) Delivery date 

3) FOB/CIF Port





Regards,

kahn Gotze
Sales & Services Assistant		 NEW ORDER 2019-05-17T11:37:52.000Z 5328 f5a1766371c063414d8b6a616b19bad0

 

2. Get an attachment

Retrieves an attachment by the attachment ID number.

Base Command

cofense-get-attachment

Input
Argument Name Description Required
attachment_id ID of the attachment. Required

 

Context Output
Path Type Description
Attachment.ID string The ID number of the report that contains the attachment.
File.Size string The date and time (in UTC) when the threat was found on the device.
File.EntryID string The file path where the threat was found on the device.
File.Name string The name of the threat.
File.SHA1 string The SHA1 hash of the threat.
File.SHA256 string The SHA256 hash of the threat.
File.MD5 string The MD5 hash of the threat.

 

Command Example
cofense-get-attachment attachment_id=8195
Context Example
{
    "Cofense.Attachment": {
        "ID": "8195"
    }
}

3. Get the reporter email address

Retrieves the email address of the reporter, by reporter ID.

Base Command

cofense-get-reporter

Input
Argument Name Description Required
reporter_id ID of the reporter. Required

 

Context Output
Path Type Description
Report.ID unknown ID of the reporter.
Report.Email unknown Reporter email address.

 

Command Example
cofense-get-reporter reporter_id=5328
Context Example
{
    "Cofense.Reporter": {
        "Email": "vishnuetp16@gmail.com",
        "ID": "5328"
    }
}
Human Readable Output

Reporter: vishnuetp16@gmail.com

4. Get a report

Retrieves a report by the report ID.

Base Command

cofense-get-report-by-id

Input
Argument Name Description Required
report_id ID of the report. Required

 

Context Output
Path Type Description
Report.ID unknown ID number of the report.
Report.EmailAttachments unknown Email attachments.
Report.EmailAttachments.id unknown Email attachment ID.
Report.Tags string Report tags.
Report.ClusterId number Cluster ID number.
Report.CategoryId number Report category.
Report.CreatedAt date Report creation date.
Report.ReportedAt string Reporting time.
Report.MatchPriority number The highest match priority based on rule hits for the report.
Report.ReporterId number Reporter ID.
Report.Location string Location of the report.
Report.Reporter string Reporter email address.
Report.SuspectFromAddress string Suspect from address.
Report.ReportSubject string Report subject.
Report.ReportBody string Report body.
Report.Md5 number MD5 hash of the file.
Report.Sha256 unknown SHA256 hash of the file.

 

Command Example
cofense-get-report-by-id report_id=5760
Context Example
{
    "Cofense.Report": [
        {
            "ReportedAt": "2019-04-17T16:54:57.000Z",
            "ReporterId": 3280,
            "Reporter": "no-reply@server.com",
            "Tags": [],
            "ClusterId": null,
            "ID": 5760,
            "Location": "Processed",
            "EmailAttachments": [],
            "ReportSubject": "example.gmail.com Reset password instruction",
            "MatchPriority": 0,
            "Sha256": "4f6bc0d9c1217a2a6f327423e16b7a6e9294c68cfb33864541bd805fe4ab2d72",
            "CategoryId": 4,
            "CreatedAt": "2019-04-17T20:53:02.090Z",
            "Md5": "f13bbc172fe7d394828ccabb25c3c99e"
        }
    ]
}
Human Readable Output

Cofense HTML Report:

HTML report download request has been completed

Report Summary:

Category Id Sha256 Created At Id Match Priority Location Report Subject Reported At Reporter Id Md5 Reporter
4 4f6bc0d9c1217a2a6f327423e16b7a6e9294c68cfb33864541bd805fe4ab2d72 2019-04-17T20:53:02.090Z 5760 0 Processed example.gmail.com password i

Configuration parameters

  • host — Server URL (e.g., https://192.168.0.1) (required)
  • user — User (required)
  • token — API Token (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • date_range — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • category_id — Category ID to fetch - corresponds to the ranking that determines the Cofense Triage prioritization (1-5)
  • match_priority — Match Priority - the highest match priority based on rule hits for the report
  • tags — Tags - CSV list of tags of processed reports by which to filter
  • max_fetch — Maximum number of incidents to fetch each time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (4)

  • cofense-get-attachment

    Retrieves an attachment by the attachment ID number.

  • cofense-get-report-by-id

    Retrieves a report by the report ID number.

  • cofense-get-reporter

    Retrieves Email address of the reporter by ID

  • cofense-search-reports

    Runs a query for reports.

Source

CofenseTriage.py CofenseTriage.yml CofenseTriage_description.md
Download History Raw 
commonfields:
  id: Cofense Triage
  version: -1
name: Cofense Triage
description: Deprecated. Use the Cofense Triage v2 integration instead.
display: Cofense Triage (Deprecated)
deprecated: true
category: Data Enrichment & Threat Intelligence
provider: Cofense
configuration:
- display: Server URL (e.g., https://192.168.0.1)
  name: host
  defaultvalue: ""
  type: 0
  required: true
- display: User
  name: user
  defaultvalue: ""
  type: 0
  required: true
- display: API Token
  name: token
  defaultvalue: ""
  type: 4
  required: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: date_range
  defaultvalue: 3 days
  type: 0
  required: false
- display: Category ID to fetch - corresponds to the ranking that determines the Cofense Triage prioritization (1-5)
  name: category_id
  defaultvalue: ""
  type: 0
  required: false
- display: Match Priority - the highest match priority based on rule hits for the report
  name: match_priority
  defaultvalue: ""
  type: 0
  required: false
- display: 'Tags - CSV list of tags of processed reports by which to filter '
  name: tags
  defaultvalue: ""
  type: 0
  required: false
- display: Maximum number of incidents to fetch each time
  name: max_fetch
  defaultvalue: "30"
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: cofense-search-reports
    arguments:
    - name: file_hash
      description: File hash, MD5 or SHA256.
    - name: url
      description: The reported URLs.
    - name: subject
      description: Report's subject
    - name: reported_at
      description: 'Retrieve reports that were reported after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: created_at
      description: 'Retrieve reports that were created after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: reporter
      description: Name or ID of the reporter.
    - name: max_matches
      default: true
      description: Maximum number of matches to fetch. Default is 30.
      defaultValue: "30"
    - name: verbose
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Returns all fields of a report.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report.
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: 'Runs a query for reports.'
  - name: cofense-get-attachment
    arguments:
    - name: attachment_id
      required: true
      description: ID of the attachment.
    outputs:
    - contextPath: Cofense.Attachment.ID
      description: The ID number of the report that contains the attachment.
      type: string
    - contextPath: Cofense.File.Size
      description: The date and time (in UTC) when the threat was found on the device.
      type: string
    - contextPath: Cofense.File.EntryID
      description: The file path where the threat was found on the device.
      type: string
    - contextPath: Cofense.File.Name
      description: The name of the threat.
      type: string
    - contextPath: Cofense.File.SHA1
      description: The SHA1 hash of the threat.
      type: string
    - contextPath: Cofense.File.SHA256
      description: The SHA256 hash of the threat.
      type: string
    - contextPath: Cofense.File.MD5
      description: The MD5 hash of the threat.
      type: string
    description: 'Retrieves an attachment by the attachment ID number. '
  - name: cofense-get-reporter
    arguments:
    - name: reporter_id
      required: true
      description: ID of the reporter.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID of the reporter.
    - contextPath: Cofense.Report.Email
      description: Reporter email address.
    description: Retrieves Email address of the reporter by ID
  - name: cofense-get-report-by-id
    arguments:
    - name: report_id
      required: true
      description: ID of the report
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: 'Retrieves a report by the report ID number. '
  dockerimage: demisto/python3:3.8.3.8715
  isfetch: true
tests:
- No test
fromversion: 5.0.0