Cofense Triage v2

Use the Cofense Triage integration to ingest reported phishing indicators.

Data Enrichment & Threat Intelligence · Cofense Triage

Details

IDCofense Triage v2
ProviderCofense
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/chromium:149.0.7827.10133006
Supported ModulesAgentix XSIAM

README

Use the Cofense Triage integration to ingest reported phishing indicators.
This integration was integrated and tested with version 1.20 of Cofense Triage v2

Configure Cofense Triage v2 in Cortex

Parameter Description Required
host Server URL (e.g., https://192.168.0.1) True
user User True
token API Token True
isFetch Fetch incidents False
incidentType Incident type False
date_range First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) False
category_id Category ID to fetch False
match_priority Match Priority - the highest match priority based on rule hits for the report False
tags Tags - CSV list of tags of processed reports by which to filter False
max_fetch Maximum number of incidents to fetch each time False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cofense-search-reports

Runs a query for reports.

Base Command

cofense-search-reports

Input

Argument Name Description Required
file_hash File hash, MD5 or SHA256. Optional
url The reported URLs. Optional
subject Report’s subject Optional
reported_at Retrieve reports that were reported after this time, for example: “2 hours, 4 minutes, 6 month, 1 day”. Optional
created_at Retrieve reports that were created after this time, for example: “2 hours, 4 minutes, 6 month, 1 day”. Optional
reporter Address or ID of the reporter. Optional
max_matches Maximum number of matches to fetch. Default is 30. Optional
verbose Returns all fields of a report. Optional

Context Output

Path Type Description
Cofense.Report.ID unknown ID number of the report.
Cofense.Report.EmailAttachments unknown Email attachments.
Cofense.Report.EmailAttachments.id unknown Email attachment ID.
Cofense.Report.Tags string Report tags.
Cofense.Report.ClusterId number Cluster ID number.
Cofense.Report.CategoryId number Report category.
Cofense.Report.CreatedAt date Report creation date.
Cofense.Report.ReportedAt string Reporting time.
Cofense.Report.MatchPriority number The highest match priority based on rule hits for the report.
Cofense.Report.ReporterId number Reporter ID.
Cofense.Report.Location string Location of the report.
Cofense.Report.Reporter string Reporter email address.
Cofense.Report.SuspectFromAddress string Suspect from address.
Cofense.Report.ReportSubject string Report subject.
Cofense.Report.ReportBody string Report body.
Cofense.Report.Md5 number MD5 hash of the file.
Cofense.Report.Sha256 unknown SHA256 hash of the file.

Command Example

!cofense-search-reports reported_at="7 days" created_at="7 days" max_matches="1"

Context Example

{
    "Cofense": {
        "Report": {
            "CategoryId": 4,
            "ClusterId": null,
            "CreatedAt": "2020-06-04T13:42:26.173Z",
            "EmailAttachments": [
                {
                    "content_type": "image/png; name=image001.png",
                    "decoded_filename": "image001.png",
                    "email_attachment_payload": {
                        "id": 7095,
                        "md5": "5008fb6e6652f56cac5bdc5bf1cbe9c2",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "554aeaaace31c7038a09dd408945583e1035ec124a46b04e5c6c5b148dc96f68"
                    },
                    "id": 18087,
                    "report_id": 13429,
                    "size_in_bytes": 1397
                },
                {
                    "content_type": "image/png; name=image003.png",
                    "decoded_filename": "image003.png",
                    "email_attachment_payload": {
                        "id": 7097,
                        "md5": "731ffb7846c22e41e9de8de307c93ece",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "c911d07d1f7be624e00e44821148629d98cf6d0f2bfac112362c7c564522ea51"
                    },
                    "id": 18089,
                    "report_id": 13429,
                    "size_in_bytes": 1701
                },
                {
                    "content_type": "image/png; name=image006.png",
                    "decoded_filename": "image006.png",
                    "email_attachment_payload": {
                        "id": 7100,
                        "md5": "124bd437f87181fdfe3154b31fd2cf6b",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "3d804c705545bf2a1e5ac6b0ea9b93a41ceb16d7453adebc58fba5df75335b20"
                    },
                    "id": 18092,
                    "report_id": 13429,
                    "size_in_bytes": 1994
                },
                {
                    "content_type": "image/png; name=image002.png",
                    "decoded_filename": "image002.png",
                    "email_attachment_payload": {
                        "id": 7096,
                        "md5": "cc07463ceeaaed79783a7f2a607797f9",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "c6c2c95238f52648faaef4520fa9bba49c10ca0f1df9bfd1912be544f319b80b"
                    },
                    "id": 18088,
                    "report_id": 13429,
                    "size_in_bytes": 1430
                },
                {
                    "content_type": "image/png; name=image004.png",
                    "decoded_filename": "image004.png",
                    "email_attachment_payload": {
                        "id": 7098,
                        "md5": "95878e37974ed3cad67154d36dd58a9a",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "e0d478f6ce56721867a0584ddea0016d713b9b2ab758fd0c9be3f1409d6e2634"
                    },
                    "id": 18090,
                    "report_id": 13429,
                    "size_in_bytes": 1557
                },
                {
                    "content_type": "image/png; name=image005.png",
                    "decoded_filename": "image005.png",
                    "email_attachment_payload": {
                        "id": 7099,
                        "md5": "0e911498bf4dc5eddb544ab5ece4b06a",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "5f2046b3c55a874aadde052f9da4af3c17e2b5bf5baf704f58b1dd1eadf08544"
                    },
                    "id": 18091,
                    "report_id": 13429,
                    "size_in_bytes": 1609
                },
                {
                    "content_type": "application/pdf; name=\"XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf\"",
                    "decoded_filename": "XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf",
                    "email_attachment_payload": {
                        "id": 7110,
                        "md5": "fb7f083f4fb93a88ab8110d857312978",
                        "mime_type": "application/pdf; charset=binary",
                        "sha256": "15ab1b20ada04dfc6285caff5e4da4eab09a9157c2cbe32cd96113da6304a5ee"
                    },
                    "id": 18093,
                    "report_id": 13429,
                    "size_in_bytes": 49597
                }
            ],
            "ID": 13429,
            "Location": "Processed",
            "MatchPriority": 1,
            "Md5": "d312e79695d5de744436006aab6b4ec1",
            "ReportBody": "Testing PDF attachment\r\n\r\n\r\nTest User  |  Director\r\nTEST\r\nm. 123-456-7890\r\ne. test@test.com<mailto:test@test.com>\r\n\r\nConnect with Cofense:\r\n\r\n[signature_527626984]<https://cofense.com/>[signature_379086648]<https://facebook.com/cofense>[signature_426568440]<https://twitter.com/cofense>[signature_1467413640]<https://linkedin.com/company/cofense>[signature_749445379]<https://www.instagram.com/cofense/>[signature_1384270593]<https://www.themuse.com/profiles/cofense>\r\n\r\nUniting Humanity Against Phishing. Watch Our Video<https://cofense.com/project/uhap-video/>\r\n\r\n",
            "ReportSubject": "2020-06-04 XSOAR attachment test",
            "ReportedAt": "2020-06-04T13:40:29.000Z",
            "ReporterId": 5331,
            "Sha256": "ba77b5d984f7da97b6f96daa442535c79f47e4b6ea0055e3472b855ee8c244e4",
            "Tags": []
        }
    }
}

Human Readable Output

Reports

Category Id Created At Email Attachments Id Location Match Priority Md5 Report Body Report Subject Reported At Reporter Id Sha256
4 2020-06-04T13:42:26.173Z {‘id’: 18087, ‘report_id’: 13429, ‘decoded_filename’: ‘image001.png’, ‘content_type’: ‘image/png; name=image001.png’, ‘size_in_bytes’: 1397, ‘email_attachment_payload’: {‘id’: 7095, ‘md5’: ‘5008fb6e6652f56cac5bdc5bf1cbe9c2’, ‘sha256’: ‘554aeaaace31c7038a09dd408945583e1035ec124a46b04e5c6c5b148dc96f68’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18089, ‘report_id’: 13429, ‘decoded_filename’: ‘image003.png’, ‘content_type’: ‘image/png; name=image003.png’, ‘size_in_bytes’: 1701, ‘email_attachment_payload’: {‘id’: 7097, ‘md5’: ‘731ffb7846c22e41e9de8de307c93ece’, ‘sha256’: ‘c911d07d1f7be624e00e44821148629d98cf6d0f2bfac112362c7c564522ea51’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18092, ‘report_id’: 13429, ‘decoded_filename’: ‘image006.png’, ‘content_type’: ‘image/png; name=image006.png’, ‘size_in_bytes’: 1994, ‘email_attachment_payload’: {‘id’: 7100, ‘md5’: ‘124bd437f87181fdfe3154b31fd2cf6b’, ‘sha256’: ‘3d804c705545bf2a1e5ac6b0ea9b93a41ceb16d7453adebc58fba5df75335b20’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18088, ‘report_id’: 13429, ‘decoded_filename’: ‘image002.png’, ‘content_type’: ‘image/png; name=image002.png’, ‘size_in_bytes’: 1430, ‘email_attachment_payload’: {‘id’: 7096, ‘md5’: ‘cc07463ceeaaed79783a7f2a607797f9’, ‘sha256’: ‘c6c2c95238f52648faaef4520fa9bba49c10ca0f1df9bfd1912be544f319b80b’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18090, ‘report_id’: 13429, ‘decoded_filename’: ‘image004.png’, ‘content_type’: ‘image/png; name=image004.png’, ‘size_in_bytes’: 1557, ‘email_attachment_payload’: {‘id’: 7098, ‘md5’: ‘95878e37974ed3cad67154d36dd58a9a’, ‘sha256’: ‘e0d478f6ce56721867a0584ddea0016d713b9b2ab758fd0c9be3f1409d6e2634’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18091, ‘report_id’: 13429, ‘decoded_filename’: ‘image005.png’, ‘content_type’: ‘image/png; name=image005.png’, ‘size_in_bytes’: 1609, ‘email_attachment_payload’: {‘id’: 7099, ‘md5’: ‘0e911498bf4dc5eddb544ab5ece4b06a’, ‘sha256’: ‘5f2046b3c55a874aadde052f9da4af3c17e2b5bf5baf704f58b1dd1eadf08544’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18093, ‘report_id’: 13429, ‘decoded_filename’: ‘XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf’, ‘content_type’: ‘application/pdf; name=”XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf”’, ‘size_in_bytes’: 49597, ‘email_attachment_payload’: {‘id’: 7110, ‘md5’: ‘fb7f083f4fb93a88ab8110d857312978’, ‘sha256’: ‘15ab1b20ada04dfc6285caff5e4da4eab09a9157c2cbe32cd96113da6304a5ee’, ‘mime_type’: ‘application/pdf; charset=binary’}}		 13429 Processed 1 d312e79695d5de744436006aab6b4ec1 Testing PDF attachment


Test User | Director
COFENSE
m. 123-456-7890
e. test@test.comtest@test.com

Connect with Cofense:

[signature_527626984]https://cofense.com/[signature_379086648]https://facebook.com/cofense[signature_426568440]https://twitter.com/cofense[signature_1467413640]https://linkedin.com/company/cofense[signature_749445379]https://www.instagram.com/cofense/[signature_1384270593]https://www.themuse.com/profiles/cofense

Uniting Humanity Against Phishing. Watch Our Videohttps://cofense.com/project/uhap-video/

 2020-06-04 XSOAR attachment test 2020-06-04T13:40:29.000Z 5331 ba77b5d984f7da97b6f96daa442535c79f47e4b6ea0055e3472b855ee8c244e4

cofense-search-inbox-reports

Runs a query for reports from the inbox mailbox.

Base Command

cofense-search-reports

Input

Argument Name Description Required
file_hash File hash, MD5 or SHA256. Optional
url The reported URLs. Optional
subject Report’s subject Optional
reported_at Retrieve reports that were reported after this time, for example: “2 hours, 4 minutes, 6 month, 1 day”. Optional
created_at Retrieve reports that were created after this time, for example: “2 hours, 4 minutes, 6 month, 1 day”. Optional
reporter Address or ID of the reporter. Optional
max_matches Maximum number of matches to fetch. Default is 30. Optional
verbose Returns all fields of a report. Optional

Context Output

Path Type Description
Cofense.Report.ID unknown ID number of the report.
Cofense.Report.EmailAttachments unknown Email attachments.
Cofense.Report.EmailAttachments.id unknown Email attachment ID.
Cofense.Report.Tags string Report tags.
Cofense.Report.ClusterId number Cluster ID number.
Cofense.Report.CategoryId number Report category.
Cofense.Report.CreatedAt date Report creation date.
Cofense.Report.ReportedAt string Reporting time.
Cofense.Report.MatchPriority number The highest match priority based on rule hits for the report.
Cofense.Report.ReporterId number Reporter ID.
Cofense.Report.Location string Location of the report.
Cofense.Report.Reporter string Reporter email address.
Cofense.Report.SuspectFromAddress string Suspect from address.
Cofense.Report.ReportSubject string Report subject.
Cofense.Report.ReportBody string Report body.
Cofense.Report.Md5 number MD5 hash of the file.
Cofense.Report.Sha256 unknown SHA256 hash of the file.

Command Example

!cofense-search-inbox-reports reported_at="7 days" created_at="7 days" max_matches="1"

Context Example

{
    "Cofense": {
        "Report": {
            "CategoryId": 4,
            "ClusterId": null,
            "CreatedAt": "2020-06-04T13:42:26.173Z",
            "EmailAttachments": [
                {
                    "content_type": "image/png; name=image001.png",
                    "decoded_filename": "image001.png",
                    "email_attachment_payload": {
                        "id": 7095,
                        "md5": "5008fb6e6652f56cac5bdc5bf1cbe9c2",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "554aeaaace31c7038a09dd408945583e1035ec124a46b04e5c6c5b148dc96f68"
                    },
                    "id": 18087,
                    "report_id": 13429,
                    "size_in_bytes": 1397
                },
                {
                    "content_type": "image/png; name=image003.png",
                    "decoded_filename": "image003.png",
                    "email_attachment_payload": {
                        "id": 7097,
                        "md5": "731ffb7846c22e41e9de8de307c93ece",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "c911d07d1f7be624e00e44821148629d98cf6d0f2bfac112362c7c564522ea51"
                    },
                    "id": 18089,
                    "report_id": 13429,
                    "size_in_bytes": 1701
                },
                {
                    "content_type": "image/png; name=image006.png",
                    "decoded_filename": "image006.png",
                    "email_attachment_payload": {
                        "id": 7100,
                        "md5": "124bd437f87181fdfe3154b31fd2cf6b",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "3d804c705545bf2a1e5ac6b0ea9b93a41ceb16d7453adebc58fba5df75335b20"
                    },
                    "id": 18092,
                    "report_id": 13429,
                    "size_in_bytes": 1994
                },
                {
                    "content_type": "image/png; name=image002.png",
                    "decoded_filename": "image002.png",
                    "email_attachment_payload": {
                        "id": 7096,
                        "md5": "cc07463ceeaaed79783a7f2a607797f9",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "c6c2c95238f52648faaef4520fa9bba49c10ca0f1df9bfd1912be544f319b80b"
                    },
                    "id": 18088,
                    "report_id": 13429,
                    "size_in_bytes": 1430
                },
                {
                    "content_type": "image/png; name=image004.png",
                    "decoded_filename": "image004.png",
                    "email_attachment_payload": {
                        "id": 7098,
                        "md5": "95878e37974ed3cad67154d36dd58a9a",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "e0d478f6ce56721867a0584ddea0016d713b9b2ab758fd0c9be3f1409d6e2634"
                    },
                    "id": 18090,
                    "report_id": 13429,
                    "size_in_bytes": 1557
                },
                {
                    "content_type": "image/png; name=image005.png",
                    "decoded_filename": "image005.png",
                    "email_attachment_payload": {
                        "id": 7099,
                        "md5": "0e911498bf4dc5eddb544ab5ece4b06a",
                        "mime_type": "image/png; charset=binary",
                        "sha256": "5f2046b3c55a874aadde052f9da4af3c17e2b5bf5baf704f58b1dd1eadf08544"
                    },
                    "id": 18091,
                    "report_id": 13429,
                    "size_in_bytes": 1609
                },
                {
                    "content_type": "application/pdf; name=\"XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf\"",
                    "decoded_filename": "XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf",
                    "email_attachment_payload": {
                        "id": 7110,
                        "md5": "fb7f083f4fb93a88ab8110d857312978",
                        "mime_type": "application/pdf; charset=binary",
                        "sha256": "15ab1b20ada04dfc6285caff5e4da4eab09a9157c2cbe32cd96113da6304a5ee"
                    },
                    "id": 18093,
                    "report_id": 13429,
                    "size_in_bytes": 49597
                }
            ],
            "ID": 13429,
            "Location": "Inbox",
            "MatchPriority": 1,
            "Md5": "d312e79695d5de744436006aab6b4ec1",
            "ReportBody": "Testing PDF attachment\r\n\r\n\r\nTest User  |  Director\r\nTEST\r\nm. 123-456-7890\r\ne. test@test.com<mailto:test@test.com>\r\n\r\nConnect with Cofense:\r\n\r\n[signature_527626984]<https://cofense.com/>[signature_379086648]<https://facebook.com/cofense>[signature_426568440]<https://twitter.com/cofense>[signature_1467413640]<https://linkedin.com/company/cofense>[signature_749445379]<https://www.instagram.com/cofense/>[signature_1384270593]<https://www.themuse.com/profiles/cofense>\r\n\r\nUniting Humanity Against Phishing. Watch Our Video<https://cofense.com/project/uhap-video/>\r\n\r\n",
            "ReportSubject": "2020-06-04 XSOAR attachment test",
            "ReportedAt": "2020-06-04T13:40:29.000Z",
            "ReporterId": 5331,
            "Sha256": "ba77b5d984f7da97b6f96daa442535c79f47e4b6ea0055e3472b855ee8c244e4",
            "Tags": []
        }
    }
}

Human Readable Output

Reports

Category Id Created At Email Attachments Id Location Match Priority Md5 Report Body Report Subject Reported At Reporter Id Sha256
4 2020-06-04T13:42:26.173Z {‘id’: 18087, ‘report_id’: 13429, ‘decoded_filename’: ‘image001.png’, ‘content_type’: ‘image/png; name=image001.png’, ‘size_in_bytes’: 1397, ‘email_attachment_payload’: {‘id’: 7095, ‘md5’: ‘5008fb6e6652f56cac5bdc5bf1cbe9c2’, ‘sha256’: ‘554aeaaace31c7038a09dd408945583e1035ec124a46b04e5c6c5b148dc96f68’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18089, ‘report_id’: 13429, ‘decoded_filename’: ‘image003.png’, ‘content_type’: ‘image/png; name=image003.png’, ‘size_in_bytes’: 1701, ‘email_attachment_payload’: {‘id’: 7097, ‘md5’: ‘731ffb7846c22e41e9de8de307c93ece’, ‘sha256’: ‘c911d07d1f7be624e00e44821148629d98cf6d0f2bfac112362c7c564522ea51’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18092, ‘report_id’: 13429, ‘decoded_filename’: ‘image006.png’, ‘content_type’: ‘image/png; name=image006.png’, ‘size_in_bytes’: 1994, ‘email_attachment_payload’: {‘id’: 7100, ‘md5’: ‘124bd437f87181fdfe3154b31fd2cf6b’, ‘sha256’: ‘3d804c705545bf2a1e5ac6b0ea9b93a41ceb16d7453adebc58fba5df75335b20’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18088, ‘report_id’: 13429, ‘decoded_filename’: ‘image002.png’, ‘content_type’: ‘image/png; name=image002.png’, ‘size_in_bytes’: 1430, ‘email_attachment_payload’: {‘id’: 7096, ‘md5’: ‘cc07463ceeaaed79783a7f2a607797f9’, ‘sha256’: ‘c6c2c95238f52648faaef4520fa9bba49c10ca0f1df9bfd1912be544f319b80b’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18090, ‘report_id’: 13429, ‘decoded_filename’: ‘image004.png’, ‘content_type’: ‘image/png; name=image004.png’, ‘size_in_bytes’: 1557, ‘email_attachment_payload’: {‘id’: 7098, ‘md5’: ‘95878e37974ed3cad67154d36dd58a9a’, ‘sha256’: ‘e0d478f6ce56721867a0584ddea0016d713b9b2ab758fd0c9be3f1409d6e2634’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18091, ‘report_id’: 13429, ‘decoded_filename’: ‘image005.png’, ‘content_type’: ‘image/png; name=image005.png’, ‘size_in_bytes’: 1609, ‘email_attachment_payload’: {‘id’: 7099, ‘md5’: ‘0e911498bf4dc5eddb544ab5ece4b06a’, ‘sha256’: ‘5f2046b3c55a874aadde052f9da4af3c17e2b5bf5baf704f58b1dd1eadf08544’, ‘mime_type’: ‘image/png; charset=binary’}},
{‘id’: 18093, ‘report_id’: 13429, ‘decoded_filename’: ‘XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf’, ‘content_type’: ‘application/pdf; name=”XSOAR Attachment Test -Inquiry - Agent Tesla Keylogger.pdf”’, ‘size_in_bytes’: 49597, ‘email_attachment_payload’: {‘id’: 7110, ‘md5’: ‘fb7f083f4fb93a88ab8110d857312978’, ‘sha256’: ‘15ab1b20ada04dfc6285caff5e4da4eab09a9157c2cbe32cd96113da6304a5ee’, ‘mime_type’: ‘application/pdf; charset=binary’}}		 13429 Processed 1 d312e79695d5de744436006aab6b4ec1 Testing PDF attachment


Test User | Director
TEST
m. 123-456-7890
e. test@test.comtest@test.com

Connect with Cofense:

[signature_527626984]https://cofense.com/[signature_379086648]https://facebook.com/cofense[signature_426568440]https://twitter.com/cofense[signature_1467413640]https://linkedin.com/company/cofense[signature_749445379]https://www.instagram.com/cofense/[signature_1384270593]https://www.themuse.com/profiles/cofense

Uniting Humanity Against Phishing. Watch Our Videohttps://cofense.com/project/uhap-video/

 2020-06-04 XSOAR attachment test 2020-06-04T13:40:29.000Z 5331 ba77b5d984f7da97b6f96daa442535c79f47e4b6ea0055e3472b855ee8c244e4

cofense-get-attachment

Retrieves an attachment by the attachment ID number.

Base Command

cofense-get-attachment

Input

Argument Name Description Required
attachment_id ID of the attachment. Required

Context Output

Path Type Description
File.Size number File size.
File.Type string File type, for example: “PE”, “txt”
File.EntryID string The file entry ID.
File.Name string File name.
File.SHA1 string File SHA1 hash.
File.SHA256 string File SHA256 hash.
File.MD5 string File MD5 hash.

Command Example

!cofense-get-attachment attachment_id="13311"

Context Example

{
    "File": {
        "EntryID": "603@cc18bdc4-7c64-494c-879c-23c3aee60818",
        "Info": "text/plain",
        "MD5": "97ee1d575640245abadbba15c0672eec",
        "Name": "13311",
        "SHA1": "13395876300d0a575812878446e15b9bbddda0b2",
        "SHA256": "19d9c63bf4067a897950cfb72c14e8d05d8dcab0655979c6b60b925fb91e329f",
        "SHA512": "31df48f235cc82247c6edc05850f910d6a057717d5d5f6ce84a4bc6c6fc3cc1f6ebae706ac592ace106b0559753928a838a1aee7018bec5b4316b90d95f55bcf",
        "SSDeep": "24:nDBTBpJG4hbUWBFcXekJPkJ1WkJM8PWkJKckJvV/WskJvV28BesR1zvX0:nDNrHb1BWXekJPkJ1WkJfPWkJDkJvV/n",
        "Size": 988,
        "Type": "ASCII text, with CRLF line terminators"
    }
}

Human Readable Output

cofense-get-reporter

Retrieves Email address of the reporter by ID

Base Command

cofense-get-reporter

Input

Argument Name Description Required
reporter_id ID of the reporter. Required

Context Output

Path Type Description
Cofense.Reporter.ID number ID of the reporter.
Cofense.Reporter.Email string Reporter email address.
Cofense.Reporter.CreatedAt string Reporter creation date.
Cofense.Reporter.UpdatedAt string Reporter last-updated date.
Cofense.Reporter.CredibilityScore number Reporter credibility score.
Cofense.Reporter.ReportsCount number Number of reports.
Cofense.Reporter.LastReportedAt string Date of most recent report.
Cofense.Reporter.VIP bool Whether Reporter is a VIP.

Command Example

!cofense-get-reporter reporter_id="1"

Context Example

{
    "Cofense": {
        "Reporter": {
            "CreatedAt": "2019-04-12T02:58:17.401Z",
            "CredibilityScore": 0,
            "Email": "ha.oullette@example.com",
            "ID": 1,
            "LastReportedAt": "2016-02-18T00:24:45.000Z",
            "ReportsCount": 3,
            "UpdatedAt": "2019-04-12T02:59:22.287Z",
            "Vip": false
        }
    }
}

Human Readable Output

Integration log: cmel case attrs: {‘ID’: 1, ‘Email’: ‘ha.oullette@example.com’, ‘CreatedAt’: ‘2019-04-12T02:58:17.401Z’, ‘UpdatedAt’: ‘2019-04-12T02:59:22.287Z’, ‘CredibilityScore’: 0, ‘ReportsCount’: 3, ‘LastReportedAt’: ‘2016-02-18T00:24:45.000Z’, ‘Vip’: False}### Reporter Results:

Created At Credibility Score Email Id Last Reported At Reports Count Updated At Vip
2019-04-12T02:58:17.401Z 0 ha.oullette@example.com 1 2016-02-18T00:24:45.000Z 3 2019-04-12T02:59:22.287Z false

cofense-get-report-by-id

Retrieves a report by the report ID number.

Base Command

cofense-get-report-by-id

Input

Argument Name Description Required
report_id ID of the report Required

Context Output

Path Type Description
Cofense.Report.ID number ID number of the report.
Cofense.Report.EmailAttachments string Email attachments.
Cofense.Report.EmailAttachments.id string Email attachment ID.
Cofense.Report.Tags string Report tags.
Cofense.Report.ClusterId number Cluster ID number.
Cofense.Report.CategoryId number Report category.
Cofense.Report.CreatedAt string Report creation date.
Cofense.Report.ReportedAt string Reporting time.
Cofense.Report.MatchPriority number The highest match priority based on rule hits for the report.
Cofense.Report.ReporterId number Reporter ID.
Cofense.Report.Location string Location of the report.
Cofense.Report.Reporter string Reporter email address.
Cofense.Report.SuspectFromAddress string Suspect from address.
Cofense.Report.ReportSubject string Report subject.
Cofense.Report.ReportBody string Report body.
Cofense.Report.Md5 number MD5 hash of the file.
Cofense.Report.Sha256 unknown SHA256 hash of the file.

Command Example

!cofense-get-report-by-id report_id="5760"

Context Example

{
    "Cofense": {
        "Report": {
            "CategoryId": 4,
            "ClusterId": null,
            "CreatedAt": "2019-04-17T20:53:02.090Z",
            "EmailAttachments": [],
            "ID": 5760,
            "Location": "Processed",
            "MatchPriority": 0,
            "Md5": "f13bbc172fe7d394828ccabb25c3c99e",
            "ReportSubject": "test@test.net Reset password instruction",
            "ReportedAt": "2019-04-17T16:54:57.000Z",
            "ReporterId": 3280,
            "Sha256": "4f6bc0d9c1217a2a6f327423e16b7a6e9294c68cfb33864541bd805fe4ab2d72",
            "Tags": []
        }
    }
}

Human Readable Output

{“HumanReadable”:”### Cofense HTML Report:\nHTML report download request has been completed”,”name”:”5760-report.html”,”path”:”aaf1160b-9176-45d9-aab9-90efd278e05d”}### Report Summary:

Category Id Created At Id Location Match Priority Md5 Report Subject Reported At Reporter Id Sha256
4 2019-04-17T20:53:02.090Z 5760 Processed 0 f13bbc172fe7d394828ccabb25c3c99e test@test.nul Reset password instruction 2019-04-17T16:54:57.000Z 3280 4f6bc0d9c1217a2a6f327423e16b7a6e9294c68cfb33864541bd805fe4ab2d72

cofense-get-report-png-by-id

Retrieves a report by the report ID number and displays as PNG

Base Command

cofense-get-report-png-by-id

Input

Argument Name Description Required
report_id Report ID PNG output Required
set_white_bg Change background to white Optional

Context Output

There is no context output for this command.

Command Example

!cofense-get-report-png-by-id report_id="5760" set_white_bg="True"

Context Example

{
    "InfoFile": {
        "EntryID": "616@cc18bdc4-7c64-494c-879c-23c3aee60818",
        "Extension": "png",
        "Info": "image/png",
        "Name": "cofense_report_5760.png",
        "Size": 40692,
        "Type": "PNG image data, 400 x 369, 8-bit/color RGBA, non-interlaced"
    }
}

Human Readable Output

Cofense: PNG of Report 5760

cofense-get-threat-indicators

Threat Indicators that are designated by analysts as malicious, suspicious or benign

Base Command

cofense-get-threat-indicators

Input

Argument Name Description Required
type indicator type Optional
level indicator severity Optional
start_date designated start date tagged by analyst (format example: YYYY-MM-DD+HH:MM:SS). Default: 6 days ago. Optional
end_date designated end date from assignment (format example: YYYY-MM-DD+HH:MM:SS). Default: current date. Optional

Context Output

Path Type Description
Cofense.ThreatIndicators unknown Threat indicator output
Cofense.ThreatIndicators.ID number Threat indicator ID in Cofense Triage.
Cofense.ThreatIndicators.OperatorId number Cofense Triage operator who designated the threat indicator.
Cofense.ThreatIndicators.ReportId number Associated Report in Cofense Triage.
Cofense.ThreatIndicators.ThreatKey string Threat indicator type.
Cofense.ThreatIndicators.ThreatLevel string Threat indicator level.
Cofense.ThreatIndicators.ThreatValue string Value of the threat indicator.

Command Example

!cofense-get-threat-indicators type="URL" level="Malicious" start_date="2020-05-28"

Context Example

{
    "Cofense": {
        "ThreatIndicators": {
            "CreatedAt": "2020-05-28T22:14:52.690Z",
            "ID": 75,
            "OperatorId": 2,
            "ReportId": 5760,
            "ThreatKey": "URL",
            "ThreatLevel": "Malicious",
            "ThreatValue": "http://bold-air0example.com/notification.php?email=test@test.net"
        }
    }
}

Human Readable Output

Threat Indicators

Created At Id Operator Id Report Id Threat Key Threat Level Threat Value
2020-05-28T22:14:52.690Z 75 2 5760 URL Malicious http://bold-air0example.com/notification.php?email=test@test.net

Configuration parameters

  • host — Server URL (e.g., https://192.168.0.1) (required)
  • user — User (required)
  • token — API Token (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • mailbox_location — Mailbox Location (required)
  • date_range — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • category_id — Category ID to fetch
  • match_priority — Match Priority - the highest match priority based on rule hits for the report
  • tags — Tags - CSV list of tags of processed reports by which to filter
  • max_fetch — Maximum number of incidents to fetch each time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (7)

  • cofense-get-attachment

    Retrieves an attachment by the attachment ID number.

  • cofense-get-report-by-id

    Retrieves a report by the report ID number.

  • cofense-get-report-png-by-id

    Retrieves a report by the report ID number and displays as PNG.

  • cofense-get-reporter

    Retrieves Email address of the reporter by ID.

  • cofense-get-threat-indicators

    Threat Indicators that are designated by analysts as malicious, suspicious or benign.

  • cofense-search-inbox-reports

    Runs a query for reports from the `inbox` mailbox.

  • cofense-search-reports

    Runs a query for reports.

Source

CofenseTriagev2.py CofenseTriagev2_test.py CofenseTriagev2.yml CofenseTriagev2_description.md command_examples.txt
Download History Raw 
commonfields:
  id: Cofense Triage v2
  version: -1
name: Cofense Triage v2
fromversion: 5.0.0
display: Cofense Triage v2
category: Data Enrichment & Threat Intelligence
provider: Cofense
description: Use the Cofense Triage integration to ingest reported phishing indicators.
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL (e.g., https://192.168.0.1)
  name: host
  defaultvalue: ''
  type: 0
  required: true
  section: Connect
- display: User
  name: user
  defaultvalue: ''
  type: 0
  required: true
  section: Connect
- display: API Token
  name: token
  defaultvalue: ''
  type: 4
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Mailbox Location
  name: mailbox_location
  defaultvalue: Processed_Reports
  section: Collect
  type: 15
  required: true
  options:
  - Inbox_Reports
  - Processed_Reports
- display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: date_range
  defaultvalue: 3 days
  type: 0
  required: false
  section: Collect
- display: Category ID to fetch
  name: category_id
  additionalinfo: Corresponds to category IDs defined in Triage. Eg, "1".
  defaultvalue: ''
  type: 0
  required: false
  section: Collect
- display: Match Priority - the highest match priority based on rule hits for the report
  name: match_priority
  defaultvalue: ''
  type: 0
  required: false
  section: Collect
- display: 'Tags - CSV list of tags of processed reports by which to filter '
  name: tags
  defaultvalue: ''
  type: 0
  required: false
  section: Collect
- display: Maximum number of incidents to fetch each time
  name: max_fetch
  defaultvalue: '30'
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: 'false'
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: cofense-search-reports
    arguments:
    - name: file_hash
      description: File hash, MD5 or SHA256.
    - name: url
      description: The reported URLs.
    - name: subject
      description: Report's subject.
    - name: reported_at
      description: 'Retrieve reports that were reported after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: created_at
      description: 'Retrieve reports that were created after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: reporter
      description: Address or ID of the reporter.
    - name: max_matches
      default: true
      description: Maximum number of matches to fetch. Default is 30.
      defaultValue: '30'
    - name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Returns all fields of a report.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report.
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: Runs a query for reports.
  - name: cofense-search-inbox-reports
    arguments:
    - name: file_hash
      description: File hash, MD5 or SHA256.
    - name: url
      description: The reported URLs.
    - name: subject
      description: Report's subject.
    - name: reported_at
      description: 'Retrieve reports that were reported after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: created_at
      description: 'Retrieve reports that were created after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: reporter
      description: Address or ID of the reporter.
    - name: max_matches
      default: true
      description: Maximum number of matches to fetch. Default is 30.
      defaultValue: '30'
    - name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Returns all fields of a report.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report.
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: Runs a query for reports from the `inbox` mailbox.
  - name: cofense-get-attachment
    arguments:
    - name: attachment_id
      required: true
      description: ID of the attachment.
    outputs:
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.Type
      description: 'File type, for example: "PE", "txt".'
      type: string
    - contextPath: File.EntryID
      description: The file entry ID.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.SHA1
      description: File SHA1 hash.
      type: string
    - contextPath: File.SHA256
      description: File SHA256 hash.
      type: string
    - contextPath: File.MD5
      description: File MD5 hash.
      type: string
    description: 'Retrieves an attachment by the attachment ID number. '
  - name: cofense-get-reporter
    arguments:
    - name: reporter_id
      required: true
      description: ID of the reporter.
    outputs:
    - contextPath: Cofense.Reporter.ID
      description: ID of the reporter.
      type: number
    - contextPath: Cofense.Reporter.Email
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Reporter.CreatedAt
      description: Reporter creation date.
      type: string
    - contextPath: Cofense.Reporter.UpdatedAt
      description: Reporter last-updated date.
      type: string
    - contextPath: Cofense.Reporter.CredibilityScore
      description: Reporter credibility score.
      type: number
    - contextPath: Cofense.Reporter.ReportsCount
      description: Number of reports.
      type: number
    - contextPath: Cofense.Reporter.LastReportedAt
      description: Date of most recent report.
      type: string
    - contextPath: Cofense.Reporter.VIP
      description: Whether Reporter is a VIP.
      type: bool
    description: Retrieves Email address of the reporter by ID.
  - name: cofense-get-report-by-id
    arguments:
    - name: report_id
      required: true
      description: ID of the report.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report.
      type: number
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
      type: string
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
      type: string
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: string
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: 'Retrieves a report by the report ID number. '
  - name: cofense-get-report-png-by-id
    arguments:
    - name: report_id
      required: true
      description: Report ID PNG output.
    - name: set_white_bg
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: Change background to white.
      defaultValue: 'False'
    description: Retrieves a report by the report ID number and displays as PNG.
  - name: cofense-get-threat-indicators
    arguments:
    - name: type
      auto: PREDEFINED
      description: indicator type.
      predefined:
      - Domain
      - URL
      - MD5
      - SHA256
      - Subject
      - Sender
    - name: level
      auto: PREDEFINED
      description: indicator severity.
      predefined:
      - Malicious
      - Suspicious
      - Benign
    - name: start_date
      description: 'designated start date tagged by analyst (format example: YYYY-MM-DD+HH:MM:SS). Default: 6 days ago.'
    - name: end_date
      description: 'designated end date from assignment (format example: YYYY-MM-DD+HH:MM:SS). Default: current date.'
    outputs:
    - contextPath: Cofense.ThreatIndicators
      description: Threat indicator output.
    - contextPath: Cofense.ThreatIndicators.ID
      description: Threat indicator ID in Cofense Triage.
      type: number
    - contextPath: Cofense.ThreatIndicators.OperatorId
      description: Cofense Triage operator who designated the threat indicator.
      type: number
    - contextPath: Cofense.ThreatIndicators.ReportId
      description: Associated Report in Cofense Triage.
      type: number
    - contextPath: Cofense.ThreatIndicators.ThreatKey
      description: Threat indicator type.
      type: string
    - contextPath: Cofense.ThreatIndicators.ThreatLevel
      description: Threat indicator level.
      type: string
    - contextPath: Cofense.ThreatIndicators.ThreatValue
      description: Value of the threat indicator.
      type: string
    description: Threat Indicators that are designated by analysts as malicious, suspicious or benign.
  dockerimage: demisto/chromium:149.0.7827.10133006
  isfetch: true
tests:
- No test - partner integration (test pb exists - Cofense Triage Test)