Cofense Triage v3

The integration uses the Cofense Triage v2 API that allows users to ingest phishing reports as incident alerts and execute commands such as threat indicators, reporters, categorize reports, and more.

Data Enrichment & Threat Intelligence · Cofense Triage

Details

IDCofense Triage v3
ProviderCofense
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Cofense Triage v3 integration uses the Cofense Triage v2 API (previous integrations were limited to Triage v1 API) that allows users to ingest phishing reports as incident alerts and execute commands.

Security teams can ingest data from Triage such as email reporters, email reports and clusters, threat indicators, and rule matching to name a few. In addition, ingest and create threat indicators, categorize reports, and obtain second stage threat indicators from malicious emails. This integration was integrated and tested with version 1.22.0 of Cofense Triage.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous of this integration, see Breaking Changes.

Configure Cofense Triage v3 in Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Cofense Triage v3.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Server URL Server URL to connect to Cofense Triage. True
Client ID Client ID and Client Secret associated with the Server URL to connect to Cofense Triage. True
Maximum number of incidents per fetch The maximum limit is 200. False
First fetch time interval Date or relative timestamp to start fetching incidents from. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc) False
Report Location Fetches the report based on the location within Cofense Triage. If not specified, it fetches all the reports. False
Match Priority Fetches reports based on the priority of the rules that match the reports. If not specified, it fetches all the reports. False
Category ID Fetches reports based on the unique identifier of the category. If not specified, it fetches all the reports. Note: Only the reports that have been processed will be retrieved. False
Tags Fetches reports based on the tags associated with the reports. If not specified, it fetches all the reports. Supports comma separated values. Note: Tags are associated with reports which are in Reconnaissance. False
Categorization Tags Fetches reports based on the tags assigned when the reported email was processed. If not specified, it fetches all the reports. Supports comma separated values. Note: Categorization tags are associated with the reports which are processed. False
Incident Mirroring Direction Choose the direction to mirror the incident: Incoming (from Cofens Triage to XSOAR). False
Advanced Filters Fetches incidents based on the advanced filters and type of the incident to be fetched. Specify the filters to filter the incidents by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Format accepted: {“attribute1_operator”: “value1, value2”, “attribute2_operator” : “value3, value4”} For example: {“updated_at_gt”:”2020-10-26T10:48:16.834Z”,”categorization_tags_any”:”test, snow”} False
Use system proxy settings   False
Trust any certificate (not secure)   False
Incident type   False
Fetch incidents   False
  1. Click Test to validate the URLs, token, and connection.

Integration Settings Preferences

If Inbox or Reconnaissance is provided as a filter for Report Location:

  • Category ID filter cannot be used.
  • Categorization Tags filter cannot be used.

If only Processed is provided as a filter for Report Location:

  • Tags filter cannot be used.

If Category ID is used as a filter for fetch incidents:

  • The Report Location cannot be Inbox or Reconnaissance.
  • Tags filter cannot be used.

If Categorization tags are provided in fetch incident parameters:

  • The Report Location must be Processed.

If Tags are provided in fetch incident parameters:

  • The Report Location must be Reconnaissance.

Filtering

For all the list commands provided filter_by argument to filter list by attribute values.
The general filtering syntax is as follows:

{\"attribute_operator\": \"value1, value2\"}

  • attribute is the name of the attribute that the filter will be applied against.
  • operator is the comparison operator to use when comparing the attribute to the specified value. The default is EQ. You can omit
    this parameter if you want to use the default. See Comparison Operators for the expected syntax for other comparison
    operators.
  • value is the value being checked for. You can specify multiple values as a comma-separated list. Doing so returns records
    that match ANY of the supplied values.
  • To specify multiple filters, use the comma ( , ) to separate them
    (for example, {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"}).
    Doing so returns only those records that match ALL the filters.
  • A filter can be applied against the same attribute (and operator) multiple times.

Comparison Operators

Standard Comparison Operators

  • eq: This is the default comparison operator if no operator is specified. Returns results when an attribute is equal to the supplied value.
  • not_eq: Returns results when an attribute is not equal to the supplied value.
  • lt: Returns results when an attribute is less than the supplied value.
  • lteq: Returns results when an attribute is less than or equal to the supplied value.
  • gt: Returns results when an attribute is greater than the supplied value.
  • gteq: Returns results when an attribute is greater than or equal to the supplied value.

String Comparison Operators

In addition to the standard comparison operators, string attributes can also use the following comparison operators:

  • start: Returns results when an attribute starts with the supplied value.
  • not_start: Returns results when an attribute does not start with the supplied value.
  • end: Returns results when an attribute ends with the supplied value.
  • not_end: Returns results when an attribute does not end with the supplied value.
  • cont: Returns results when an attribute contains the supplied value.
  • not_cont: Returns results when an attribute does not contain the supplied value.

Array Comparison Operators

Some resources have an array attribute that contains a list of values. Array attributes follow a common usage pattern, but the
filters supported will vary.

  • any_OP: Returns resources where any value in the array matches the standard or string comparison operator (OP).

Tag List Comparison Operators

Some resources have a tag_list attribute that contains a list of Triage tags that were applied to that resource.
Tag List attributes do not support the standard or string comparison operators. Attributes of this type support the following
comparison operators:

  • any: Returns results when a resource is tagged with any of the specified tags.
  • all: Returns results when a resource is tagged with all of the specified tags.
  • none: Returns results when a resource is not tagged with any of the specified tags.

Mirroring

The data in Cofense Triage Report can be mirrored to Cortex XSOAR to view the modifications when the report is updated.

For example: When the report is processed, the fields like Report Category ID and Report location get modified, and hence the user will be able to see the modified field’s value in XSOAR.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cofense-threat-indicator-list

Retrieves the list of threat indicators based on the provided parameters.
Threat indicators identify the threat level of an email’s subject, sender, domains, URLs, and MD5 and SHA256 attachment hash signatures.

Base Command

cofense-threat-indicator-list

Input

Argument Name Description Required
id Specify the ID of the threat indicator to retrieve a specific threat indicator. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of threat indicators to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the threat indicators. Default is 1. Optional
sort_by Specify the attributes to sort the threat indicators. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: threat_level, -created_at. Optional
filter_by Specify the filters to filter the list of threat indicators by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“threat_level_eq\”:\“Malicious,Benign\”, \“updated_at_gt\”:\“2020-10-26T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: threat_level, threat_type, threat_value. Optional
threat_level Specify the level of the threat to retrieve the threat indicators. Some possible values are: Malicious, Suspicious, Benign. Optional
threat_type Specify the type of the threat to retrieve the threat indicators. Some possible values are: Sender, Subject, Domain, URL, MD5, SHA256, Hostname, or Header. Optional
threat_value Specify the value corresponding to the type of threat indicated in threat_type to retrieve the threat indicators. Optional
threat_source Specify the value corresponding to the source of the threat indicator. Optional
created_at Specify the date and time of creation, from when to retrieve the threat indicators. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the threat indicators. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.ThreatIndicator.id String Unique identifier of the threat indicator.
Cofense.ThreatIndicator.type String Type of the resource of Cofense Triage.
Cofense.ThreatIndicator.links.self String Link of the resource.
Cofense.ThreatIndicator.attributes.threat_level String The level of the threat.
Cofense.ThreatIndicator.attributes.threat_type String The type of the threat.
Cofense.ThreatIndicator.attributes.threat_value String Value corresponding to the type of threat indicated in the type of the threat.
Cofense.ThreatIndicator.attributes.threat_source String Value corresponding to the source of the threat.
Cofense.ThreatIndicator.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.ThreatIndicator.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.ThreatIndicator.relationships.owner.links.self String Link to retrieve the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.links.related String Link to retrieve the detailed information of the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.type String Type of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.id String Unique identifier of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.self String Link to retrieve the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.related String Link to retrieve the detailed information of the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.self String Link to retrieve the comments containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.related String Link to retrieve the detailed information of the comments containing the threat indicator.

Command Example

!cofense-threat-indicator-list page_size=2

Context Example

{
    "Cofense": {
        "ThreatIndicator": [
            {
                "attributes": {
                    "created_at": "2020-10-26T10:47:09.675Z",
                    "threat_level": "Malicious",
                    "threat_source": "URL",
                    "threat_type": "SHA256",
                    "threat_value": "dummy_hash",
                    "updated_at": "2021-06-22T05:52:10.016Z"
                },
                "id": "1",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/threat_indicators/1"
                },
                "relationships": {
                    "comments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/1/comments",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/comments"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "3",
                            "type": "api_applications"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/1/owner",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/owner"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/1/reports",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/reports"
                        }
                    }
                },
                "type": "threat_indicators"
            },
            {
                "attributes": {
                    "created_at": "2020-10-26T13:46:47.553Z",
                    "threat_level": "Malicious",
                    "threat_source": "Triage-UI",
                    "threat_type": "URL",
                    "threat_value": "dummy_url",
                    "updated_at": "2020-10-26T13:46:47.559Z"
                },
                "id": "2",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/threat_indicators/2"
                },
                "relationships": {
                    "comments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/2/comments",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/2/relationships/comments"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "2",
                            "type": "operators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/2/owner",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/2/relationships/owner"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/threat_indicators/2/reports",
                            "self": "https://triage.example.com/api/public/v2/threat_indicators/2/relationships/reports"
                        }
                    }
                },
                "type": "threat_indicators"
            }
        ]
    }
}

Human Readable Output

Threat Indicator(s)

Threat Indicator ID Threat Level Threat Type Threat Value Threat Source Created At Updated At
1 Malicious SHA256 dummy_hash URL 2020-10-26T10:47:09.675Z 2021-06-22T05:52:10.016Z
2 Malicious URL dummy_url Triage-UI 2020-10-26T13:46:47.553Z 2020-10-26T13:46:47.559Z

cofense-report-list

Retrieves a report or a list of reports based on the filter values provided in the command arguments.

Base Command

cofense-report-list

Input

Argument Name Description Required
id Specify the ID of the report to retrieve a specific report. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of reports to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the reports. Default is 1. Optional
sort_by Specify the attributes to sort the reports. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -received_at, match_priority. Optional
filter_by Specify the filters to filter the list of reports by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“updated_at_gt\”:\“2020-10-26T10:48:16.834Z\”,\“categorization_tags_any\”:\“test, snow\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: location, from_address. Optional
match_priority Specify the priority to retrieve the reports based on the priority of the rules that match the reports. Possible values are: 0, 1, 2, 3, 4, 5. Optional
tags Specify the tags to retrieve the reports based on the tags associated with the reports. Optional
categorization_tags Specify the categorization tags to retrieve the reports based on the tags assigned when the reported email was processed. Optional
report_location Specify the location to retrieve the reports based on the location of the reported email within Cofense Triage. Some possible values are: inbox, reconnaissance, processed. Optional
category_id Specify the ID of the category to retrieve the reports based on the category of the reports. Note: When both category_id and cluster_id are provided, higher priority will be given to category_id. Note: To retrieve category_id, execute cofense-category-list command. Optional
created_at Specify the date and time of creation, from when to retrieve the reports. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the reports. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
cluster_id Specify the ID of the cluster to retrieve the reports present in the specific cluster. Note: When both category_id and cluster_id are provided, higher priority will be given to category_id. Note: To retrieve cluster_id, execute cofense-cluster-list command. Optional

Context Output

Path Type Description
Cofense.Report.id String Unique identifier of the report.
Cofense.Report.type String Type of the resource of Cofense Triage.
Cofense.Report.links.self String Link of the resource.
Cofense.Report.attributes.location String Location of the reported email within Triage. (Inbox, Reconnaissance, or Processed).
Cofense.Report.attributes.risk_score Number Risk score of the report.
Cofense.Report.attributes.from_address String Sender email address of the reported email.
Cofense.Report.attributes.subject String Subject of the reported email.
Cofense.Report.attributes.received_at Date Date and time, in ISO 8601 format, when the reporter received the email.
Cofense.Report.attributes.reported_at Date Date and time, in ISO 8601 format, when the reporter reported the email.
Cofense.Report.attributes.raw_headers String Headers of the reported email.
Cofense.Report.attributes.text_body String Text body of the reported email.
Cofense.Report.attributes.html_body String HTML body of the reported email.
Cofense.Report.attributes.md5 String MD5 hash signature of the reported email.
Cofense.Report.attributes.sha256 String SHA256 hash signature of the reported email.
Cofense.Report.attributes.match_priority Number Highest priority of a rule matching the reported email.
Cofense.Report.attributes.tags Unknown Tags associated with the report.
Cofense.Report.attributes.categorization_tags Unknown Tags assigned when the reported email was processed.
Cofense.Report.attributes.processed_at Date Date and time, in ISO 8601 format, when the reported email was processed. If the reported email is still in Inbox or Recon, the response contains a null value.
Cofense.Report.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Report.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Report.relationships.assignee.links.self String Link to retrieve the operator assigned to the report.
Cofense.Report.relationships.assignee.links.related String Link to retrieve the detailed information of the operator assigned to the report.
Cofense.Report.relationships.assignee.data.type String Type of the assignee associated with the report.
Cofense.Report.relationships.assignee.data.id String Unique identifier of the assignee associated with the report.
Cofense.Report.relationships.category.links.self String Link to retrieve the category assigned to the report.
Cofense.Report.relationships.category.links.related String Link to retrieve the detailed information of the category assigned to the report.
Cofense.Report.relationships.category.data.type String Type of the category associated with the report.
Cofense.Report.relationships.category.data.id String Unique identifier of the category associated with the report.
Cofense.Report.relationships.cluster.links.self String Link to retrieve the cluster of the report.
Cofense.Report.relationships.cluster.links.related String Link to retrieve the detailed information of the cluster of the report.
Cofense.Report.relationships.cluster.data.type String Type of the cluster context associated with the report.
Cofense.Report.relationships.cluster.data.id String Unique identifier of the cluster context associated with the report.
Cofense.Report.relationships.reporter.links.self String Link to retrieve the reporter of the report.
Cofense.Report.relationships.reporter.links.related String Link to retrieve the detailed information of the reporter of the report.
Cofense.Report.relationships.reporter.data.type String Type of the reporter associated with the report.
Cofense.Report.relationships.reporter.data.id String Unique identifier of the reporter associated with the report.
Cofense.Report.relationships.attachment_payloads.links.self String Link to retrieve the payloads of attachments associated with the report.
Cofense.Report.relationships.attachment_payloads.links.related String Link to retrieve the detailed information of the payloads of attachments associated with the report.
Cofense.Report.relationships.attachments.links.self String Link to retrieve the attachments to the reported email.
Cofense.Report.relationships.attachments.links.related String Link to retrieve the detailed information of the attachments to the reported email.
Cofense.Report.relationships.domains.links.self String Link to retrieve the domain of the report.
Cofense.Report.relationships.domains.links.related String Link to retrieve the detailed information of the domain of the report.
Cofense.Report.relationships.headers.links.self String Link to retrieve the headers of the report.
Cofense.Report.relationships.headers.links.related String Link to retrieve the detailed information of the headers of the report.
Cofense.Report.relationships.hostnames.links.self String Link to retrieve the hostnames of URLs associated with the report.
Cofense.Report.relationships.hostnames.links.related String Link to retrieve the detailed information of the hostnames of URLs associated with the report.
Cofense.Report.relationships.urls.links.self String Link to retrieve the URLs associated with the report.
Cofense.Report.relationships.urls.links.related String Link to retrieve the detailed information of the URLs associated with the report.
Cofense.Report.relationships.rules.links.self String Link to retrieve the rules matching the report.
Cofense.Report.relationships.rules.links.related String Link to retrieve the detailed information of the rules matching the report.
Cofense.Report.relationships.threat_indicators.links.self String Link to retrieve the threat indicators identified the report.
Cofense.Report.relationships.threat_indicators.links.related String Link to retrieve the detailed information of the threat indicators identified the report.
Cofense.Report.relationships.comments.links.self String Link to retrieve the comments of the report.
Cofense.Report.relationships.comments.links.related String Link to retrieve the detailed information of the comments of the report.
Cofense.Report.meta.risk_score_summary.integrations Number Number of integrations associated with the report.
Cofense.Report.meta.risk_score_summary.vip Number Number of VIP reporters of the report.
Cofense.Report.meta.risk_score_summary.reporter Number Number of reporters of the report.
Cofense.Report.meta.risk_score_summary.rules Number Number of the rules associated with the report.

Command Example

!cofense-report-list page_size=2

Context Example

{
    "Cofense": {
        "Report": [
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:23.444Z",
                    "html_body": "dummy html body",
                    "location": "Processed",
                    "match_priority": 0,
                    "md5": "12345727a75f1231be55c9d47513f510",
                    "processed_at": "2021-06-22T05:56:04.472Z",
                    "raw_headers": "dummy raw headers",
                    "received_at": "2019-11-08T17:28:19.000Z",
                    "reported_at": "2019-11-08T17:17:05.000Z",
                    "risk_score": 15,
                    "sha256": "123c12345c3131479335d5d118da42118e802a48f4bc91992b8e93f87ec95f5c",
                    "subject": "IBM X-Force Exchange Notifications",
                    "text_body": "dummy text body",
                    "updated_at": "2021-06-22T05:44:47.075Z"
                },
                "id": "4",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/reports/4"
                },
                "meta": {
                    "risk_score_summary": {
                        "integrations": 0,
                        "reporter": 15,
                        "rules": 0,
                        "vip": 0
                    }
                },
                "relationships": {
                    "assignee": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/assignee",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/assignee"
                        }
                    },
                    "attachment_payloads": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/attachment_payloads",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/attachment_payloads"
                        }
                    },
                    "attachments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/attachments",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/attachments"
                        }
                    },
                    "category": {
                        "data": {
                            "id": "1",
                            "type": "categories"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/category",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/category"
                        }
                    },
                    "cluster": {
                        "data": {
                            "id": "1",
                            "type": "clusters"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/cluster",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/cluster"
                        }
                    },
                    "comments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/comments",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/comments"
                        }
                    },
                    "domains": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/domains",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/domains"
                        }
                    },
                    "headers": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/headers",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/headers"
                        }
                    },
                    "hostnames": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/hostnames",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/hostnames"
                        }
                    },
                    "reporter": {
                        "data": {
                            "id": "4",
                            "type": "reporters"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/reporter",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/reporter"
                        }
                    },
                    "rules": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/rules",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/rules"
                        }
                    },
                    "threat_indicators": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/threat_indicators",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/threat_indicators"
                        }
                    },
                    "urls": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/4/urls",
                            "self": "https://triage.example.com/api/public/v2/reports/4/relationships/urls"
                        }
                    }
                },
                "type": "reports"
            },
            {
                "attributes": {
                    "categorization_tags": [
                        "testingPhantom"
                    ],
                    "created_at": "2020-10-21T20:54:25.974Z",
                    "html_body": "dummy html body",
                    "location": "Processed",
                    "match_priority": 0,
                    "md5": "123456f87ce51c42ef80b74e96a3b161",
                    "processed_at": "2021-06-15T10:03:02.941Z",
                    "raw_headers": "dummy raw header",
                    "received_at": "2019-11-08T20:00:25.000Z",
                    "reported_at": "2019-11-08T19:50:17.000Z",
                    "risk_score": 8,
                    "sha256": "f1d4ff19af66c7e04c5ac123456c961b2e2b0e837ddd33461fa3730e4f5ceab1",
                    "subject": "(Hey), Developer!",
                    "text_body": "dummy text body",
                    "updated_at": "2021-06-15T10:03:03.739Z"
                },
                "id": "6",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/reports/6"
                },
                "meta": {
                    "risk_score_summary": {
                        "integrations": 0,
                        "reporter": 8,
                        "rules": 0,
                        "vip": 0
                    }
                },
                "relationships": {
                    "assignee": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/assignee",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/assignee"
                        }
                    },
                    "attachment_payloads": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/attachment_payloads",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/attachment_payloads"
                        }
                    },
                    "attachments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/attachments",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/attachments"
                        }
                    },
                    "category": {
                        "data": {
                            "id": "1",
                            "type": "categories"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/category",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/category"
                        }
                    },
                    "cluster": {
                        "data": {
                            "id": "2",
                            "type": "clusters"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/cluster",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/cluster"
                        }
                    },
                    "comments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/comments",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/comments"
                        }
                    },
                    "domains": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/domains",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/domains"
                        }
                    },
                    "headers": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/headers",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/headers"
                        }
                    },
                    "hostnames": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/hostnames",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/hostnames"
                        }
                    },
                    "reporter": {
                        "data": {
                            "id": "6",
                            "type": "reporters"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/reporter",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/reporter"
                        }
                    },
                    "rules": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/rules",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/rules"
                        }
                    },
                    "threat_indicators": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/threat_indicators",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/threat_indicators"
                        }
                    },
                    "urls": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reports/6/urls",
                            "self": "https://triage.example.com/api/public/v2/reports/6/relationships/urls"
                        }
                    }
                },
                "type": "reports"
            }
        ]
    }
}

Human Readable Output

Report(s)

Report ID Subject Match Priority Location MD5 SHA256 Created At
4 IBM X-Force Exchange Notifications 0 Processed 12345727a75f1231be55c9d47513f510 123c12345c3131479335d5d118da42118e802a48f4bc91992b8e93f87ec95f5c 2020-10-21T20:54:23.444Z
6 (Hey), Developer! 0 Processed 123456f87ce51c42ef80b74e96a3b161 f1d4ff19af66c7e04c5ac123456c961b2e2b0e837ddd33461fa3730e4f5ceab1 2020-10-21T20:54:25.974Z

cofense-report-download

Downloads the raw email for the report that matches the specified report ID.

Base Command

cofense-report-download

Input

Argument Name Description Required
id Specify the ID of the report to download the email file. Note: To retrieve id, execute cofense-report-list command. Required

Context Output

Path Type Description
File.Size String File size in bytes.
File.SHA1 String SHA1 hash of file.
File.SHA256 String SHA256 hash of file.
File.SHA512 String SHA512 hash of file.
File.Name String File name.
File.SSDeep String SSDeep hash of the file.
File.EntryID Unknown The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String MD5 hash of the file.
File.Extension String The file extension.

Command Example

!cofense-report-download id=4

Context Example

{
    "File": {
        "EntryID": "12345@24e2b8bb-acd8-4ad6-8f7c-5140d65ea600",
        "Extension": "eml",
        "Info": "eml",
        "MD5": "12345727a75f1231be55c9d47513f510",
        "Name": "Report ID - 4.eml",
        "SHA1": "3db21fa900493764134a0fb93867cd712086ad1c",
        "SHA256": "123c12345c3131479335d5d118da42118e802a48f4bc91992b8e93f87ec95f5c",
        "SHA512": "d2e415d721796901ed9867570b62604ac5ee48e0c4a4541a0e5e12345678eaa89a2873ffff61b024ec867f9f0c4a45ddf6534be718393e087e6da017a071a723",
        "SSDeep": "12:sentTp60+VqTKBV+VUllVDVSm+s1C1609QfzYxVNtMt7JvVNtMtZTRVNtMtO6hFC:smVp6DJV+6ku8QfzYr",
        "Size": 10069,
        "Type": "HTML document, ASCII text, with CRLF line terminators"
    }
}

Human Readable Output

Uploaded file: Report ID - 4.eml Download

Property Value
Type eml
Size 10,069 bytes
Info HTML document, ASCII text, with CRLF line terminators
MD5 12345727a75f1231be55c9d47513f510
SHA1 3db21fa900493764134a0fb93867cd712086ad1c
SHA256 123c12345c3131479335d5d118da42118e802a48f4bc91992b8e93f87ec95f5c
SHA512 d2e415d721796901ed9867570b62604ac5ee48e0c4a4541a0e5e12345678eaa89a2873ffff61b024ec867f9f0c4a45ddf6534be718393e087e6da017a071a723
SSDeep 12:sentTp60+VqTKBV+VUllVDVSm+s1C1609QfzYxVNtMt7JvVNtMtZTRVNtMtO6hFC:smVp6DJV+6ku8QfzYr

cofense-report-categorize

Categorizes a report into a specific category provided by the user.

Base Command

cofense-report-categorize

Input

Argument Name Description Required
id Specify the ID of the report to be categorized. Note: To retrieve id, execute cofense-report-list command. Required
category_id Specify the ID of the category in which report is to be categorized. Note: To retrieve category_id, execute cofense-category-list command. Required
categorization_tags Specify the tags that are to be assigned to the report. Optional

Context Output

There is no context output for this command.

Command Example

!cofense-report-categorize category_id=1 id=4

Human Readable Output

Report with ID = 4 is categorized successfully.

cofense-report-attachment-payload-list

Retrieves attachment payloads based on provided report id in the command arguments.
Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email attachment.

Base Command

cofense-report-attachment-payload-list

Input

Argument Name Description Required
id Specify ID of the report to retrieve the attachment payloads. Required
page_size Specify the number of attachment payloads to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the attachment payloads. Default is 1. Optional
created_at Specify the date and time of creation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.AttachmentPayload.id String Unique identifier of the attachment payload.
Cofense.AttachmentPayload.type String Type of the resource of Cofense Triage.
Cofense.AttachmentPayload.links.self String Link of the resource.
Cofense.AttachmentPayload.attributes.mime_type String MIME type of the payload.
Cofense.AttachmentPayload.attributes.md5 String MD5 hash of the payload.
Cofense.AttachmentPayload.attributes.sha256 String SHA256 hash of the payload.
Cofense.AttachmentPayload.attributes.risk_score Number Risk score of the payload.
Cofense.AttachmentPayload.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.AttachmentPayload.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.AttachmentPayload.relationships.attachments.links.self String Link to retrieve the attachment containing the payload.
Cofense.AttachmentPayload.relationships.attachments.links.related String Link to retrieve the detailed information of the attachment containing the payload.
Cofense.AttachmentPayload.relationships.clusters.links.self String Link to retrieve the cluster of reports containing the payload.
Cofense.AttachmentPayload.relationships.clusters.links.related String Link to retrieve the detailed information of the cluster of reports containing the payload.
Cofense.AttachmentPayload.relationships.integration_submissions.links.self String Link to retrieve the integration submissions related to attachment.
Cofense.AttachmentPayload.relationships.integration_submissions.links.related String Link to retrieve the detailed information of the integration submissions related to attachment.
Cofense.AttachmentPayload.relationships.reports.links.self String Link to retrieve the report with attachments containing the payload.
Cofense.AttachmentPayload.relationships.reports.links.related String Link to retrieve the detailed information of the report with attachments containing the payload.

Command Example

!cofense-report-attachment-payload-list id=47024 page_size=2

Context Example

{
  "Cofense": {
    "AttachmentPayload": [
      {
        "attributes": {
          "created_at": "2020-10-21T20:57:56.750Z",
          "md5": "99a9eb2612d7e84c5402fde1114c53ee",
          "mime_type": "application/xml; charset=us-ascii",
          "risk_score": 0,
          "sha256": "22b3e2a4f41a0a0b6c93cd0da7b28b84a2375b815f787624e81acaaf32a5d191",
          "updated_at": "2022-03-08T20:20:32.561Z"
        },
        "id": "74",
        "links": {
          "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74"
        },
        "relationships": {
          "attachments": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/attachments",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/relationships/attachments"
            }
          },
          "clusters": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/clusters",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/relationships/clusters"
            }
          },
          "integration_submissions": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/integration_submissions",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/relationships/integration_submissions"
            }
          },
          "reports": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/reports",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/74/relationships/reports"
            }
          }
        },
        "type": "attachment_payloads"
      },
      {
        "attributes": {
          "created_at": "2020-10-21T20:57:56.940Z",
          "md5": "61da9c47fff9b04e59b951aa700c7980",
          "mime_type": "image/png; charset=binary",
          "sha256": "7757f5392a8971b280464ae0d760b04980b82a9a2a3105c2bd6c9293ff7f9b9a",
          "updated_at": "2020-10-21T20:57:56.940Z"
        },
        "id": "78",
        "links": {
          "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78"
        },
        "relationships": {
          "attachments": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/attachments",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/relationships/attachments"
            }
          },
          "clusters": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/clusters",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/relationships/clusters"
            }
          },
          "integration_submissions": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/integration_submissions",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/relationships/integration_submissions"
            }
          },
          "reports": {
            "links": {
              "related": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/reports",
              "self": "https://reltest6.phishmecloud.com/api/public/v2/attachment_payloads/78/relationships/reports"
            }
          }
        },
        "type": "attachment_payloads"
      }
    ]
  }
}

Human Readable Output

Attachment Payload(s)

Attachment Payload ID Mime Type MD5 SHA256 Risk Score Created At Updated At
74 application/xml; charset=us-ascii 99a9eb2612d7e84c5402fde1114c53ee 22b3e2a4f41a0a0b6c93cd0da7b28b84a2375b815f787624e81acaaf32a5d191 0 2020-10-21T20:57:56.750Z 2022-03-08T20:20:32.561Z
78 image/png; charset=binary 61da9c47fff9b04e59b951aa700c7980 7757f5392a8971b280464ae0d760b04980b82a9a2a3105c2bd6c9293ff7f9b9a   2020-10-21T20:57:56.940Z 2020-10-21T20:57:56.940Z

cofense-report-attachment-list

Retrieves attachments based on provided report id in the command arguments.
For reported emails that contain attachments, Cofense Triage captures the attachment’s filename and size.

Base Command

cofense-report-attachment-list

Input

Argument Name Description Required
id Specify ID of the report to retrieve the attachments. Required
page_size Specify the number of attachments to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the attachments. Default is 1. Optional
created_at Specify the date and time of creation, from when to retrieve the attachments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the attachments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Attachment.id String Unique identifier of the attachment.
Cofense.Attachment.type String Type of the resource of Cofense Triage.
Cofense.Attachment.links.self String Link of the resource.
Cofense.Attachment.attributes.filename String Name of the attachment file.
Cofense.Attachment.attributes.size Number Attachment size in bytes.
Cofense.Attachment.attributes.is_child Boolean Boolean value indicating that attachment is child or not.
Cofense.Attachment.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Attachment.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Attachment.relationships.attachment_payload.links.self String Link to retrieve the attachment payload associated with the attachment.
Cofense.Attachment.relationships.attachment_payload.links.related String Link to retrieve the detailed information of the attachment payload associated with the attachment.
Cofense.Attachment.relationships.attachment_payload.data.type String Type indicating attachment payload.
Cofense.Attachment.relationships.attachment_payload.data.id String Unique identifier of the attachment payload associated with the attachment.
Cofense.Attachment.relationships.parent.links.self String Link to retrieve the parent of the attachment.
Cofense.Attachment.relationships.parent.links.related String Link to retrieve the detailed information of the parent of the attachment.
Cofense.Attachment.relationships.parent.data.type String Type indicating the parent of the attachment.
Cofense.Attachment.relationships.parent.data.id String Unique identifier of the parent of the attachment.
Cofense.Attachment.relationships.reports.links.self String Link to retrieve the report associated with the attachment.
Cofense.Attachment.relationships.reports.links.related String Link to retrieve the detailed information of the report associated with the attachment.
Cofense.Attachment.relationships.reports.data.type String Type indicating report.
Cofense.Attachment.relationships.reports.data.id String Unique identifier of the report associated with the attachment.

Command Example

!cofense-report-attachment-list id=30339 page_size=2

Context Example

{
  "Cofense": {
    "Attachment": [
      {
        "id": "30339",
        "type": "attachments",
        "links": {
          "self": "https://triage.example.com/api/public/v2/attachments/30339"
        },
        "attributes": {
          "filename": "Invoice.xlsm",
          "size": 100000,
          "is_child": false,
          "created_at": "2023-04-09T13:25:28.540Z",
          "updated_at": "2023-04-09T13:25:28.540Z"
        },
        "relationships": {
          "attachment_payload": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30339/relationships/attachment_payload",
              "related": "https://triage.example.com/api/public/v2/attachments/30339/attachment_payload"
            },
            "data": {
              "type": "attachment_payloads",
              "id": "1452"
            }
          },
          "parent": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30339/relationships/parent",
              "related": "https://triage.example.com/api/public/v2/attachments/30339/parent"
            }
          },
          "report": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30339/relationships/report",
              "related": "https://triage.example.com/api/public/v2/attachments/30339/report"
            },
            "data": {
              "type": "reports",
              "id": "47024"
            }
          }
        }
      },
      {
        "id": "30340",
        "type": "attachments",
        "links": {
          "self": "https://triage.example.com/api/public/v2/attachments/30340"
        },
        "attributes": {
          "filename": "docProps/app.xml",
          "size": 700,
          "is_child": true,
          "created_at": "2023-04-09T13:25:29.249Z",
          "updated_at": "2023-04-09T13:25:29.249Z"
        },
        "relationships": {
          "attachment_payload": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30340/relationships/attachment_payload",
              "related": "https://triage.example.com/api/public/v2/attachments/30340/attachment_payload"
            },
            "data": {
              "type": "attachment_payloads",
              "id": "74"
            }
          },
          "parent": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30340/relationships/parent",
              "related": "https://triage.example.com/api/public/v2/attachments/30340/parent"
            },
            "data": {
              "type": "attachments",
              "id": "30339"
            }
          },
          "report": {
            "links": {
              "self": "https://triage.example.com/api/public/v2/attachments/30340/relationships/report",
              "related": "https://triage.example.com/api/public/v2/attachments/30340/report"
            },
            "data": {
              "type": "reports",
              "id": "47024"
            }
          }
        }
      }
    ]
  }
}

Human Readable Output

Attachment(s)

Attachment ID File Name File Size in Bytes Is Child Created At Updated At
30339 Invoice.xlsm 100000 false 2023-04-09T13:25:28.540Z 2023-04-09T13:25:28.540Z
30340 docProps/app.xml 700 true 2023-04-09T13:25:29.249Z 2023-04-09T13:25:29.249Z

cofense-report-attachment-download

Downloads the attachment for the specified attachment ID.

Base Command

cofense-report-attachment-download

Input

Argument Name Description Required
id Specify the ID of the attachment to download the attachment file.
Note: To retrieve id, execute cofense-report-attachment-list command.		 Required

Context Output

Path Type Description
File.Size String File size in bytes.
File.SHA1 String SHA1 hash of file.
File.SHA256 String SHA256 hash of file.
File.SHA512 String SHA512 hash of file.
File.Name String File name.
File.SSDeep String SSDeep hash of the file.
File.EntryID Unknown The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String MD5 hash of the file.
File.Extension String The file extension.

Command example

!cofense-report-attachment-download id=30

Context Example

{
    "File": {
        "EntryID": "3000@80068006-8006-8006-8006-800680068006",
        "Extension": "xml",
        "Type": "text/xml; charset=utf-8",
        "MD5": "11111111111111111111111111111111",
        "Name": "xl/sharedStrings.xml",
        "SHA1": "1111111111111111111111111111111111111111",
        "SHA256": "1111111111111111111111111111111111111111111111111111111111111111",
        "SHA512": "11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111",
        "SSDeep": "3:111111111111111111111111111111111111111111111111111111111111:111111111111111111111111",
        "Size": 206,
        "Info": "XML 1.0 document, ASCII text, with CRLF line terminators"
    }
}

Human Readable Output

Uploaded file: xl/sharedStrings.xml Download

Property Value
Type text/xml; charset=utf-8
Size 206 bytes
Info XML 1.0 document, ASCII text, with CRLF line terminators
MD5 11111111111111111111111111111111
SHA1 1111111111111111111111111111111111111111
SHA256 1111111111111111111111111111111111111111111111111111111111111111
SHA512 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
SSDeep 3:111111111111111111111111111111111111111111111111111111111111:111111111111111111111111

cofense-category-list

Retrieves categories based on the provided parameters.
Categories are applied while processing the email to indicate the type of threat (or non-threat) that reports and clusters pose to the organization.

Base Command

cofense-category-list

Input

Argument Name Description Required
id Specify the ID of the category to retrieve a specific category. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of categories to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the categories. Default is 1. Optional
sort_by Specify the attributes to sort the categories. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: score, -name. Optional
filter_by Specify the filters to filter the list of categories by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“score_gteq\”:\“2,10\”, \“updated_at_gt\”:\“2020-10-26T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: name, score. Optional
name Specify the name of the category to retrieve the category accordingly. Optional
is_malicious Specify that the categories to be retrieved should be malicious or not. Possible values are: true, false. Optional
score Specify the score of the categories to be retrieved. Optional
created_at Specify the date and time of creation, from when to retrieve the categories. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the categories. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Category.id String Unique identifier of the category.
Cofense.Category.type String Type of the resource of Cofense Triage.
Cofense.Category.links.self String Link of the resource.
Cofense.Category.attributes.name String Display name of the category.
Cofense.Category.attributes.score Number Value to add to a reporter’s reputation score when a report is processed with the category.
Cofense.Category.attributes.malicious Boolean Whether the category is used to classify malicious reports (true) or not (false). The default is true.
Cofense.Category.attributes.color String Color, represented as a hexadecimal value, to assign to the category.
Cofense.Category.attributes.archived Boolean Whether the category is archived (true) or not (false). The default is false.
Cofense.Category.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Category.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Category.relationships.one_clicks.links.self String Link to retrieve the one-click categorizations that process reports with the category.
Cofense.Category.relationships.one_clicks.links.related String Link to retrieve the detailed information of the one-click categorizations that process reports with the category.
Cofense.Category.relationships.reports.links.self String Link to retrieve the reports processed with the category.
Cofense.Category.relationships.reports.links.related String Link to retrieve the detailed information of the reports processed with the category.

Command Example

!cofense-category-list page_size=2

Context Example

{
    "Cofense": {
        "Category": [
            {
                "attributes": {
                    "archived": false,
                    "color": "#739d75",
                    "created_at": "2020-10-21T15:30:56.280Z",
                    "malicious": false,
                    "name": "Non-Malicious",
                    "score": -5,
                    "updated_at": "2020-10-21T15:30:56.280Z"
                },
                "id": "1",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/categories/1"
                },
                "relationships": {
                    "one_clicks": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/categories/1/one_clicks",
                            "self": "https://triage.example.com/api/public/v2/categories/1/relationships/one_clicks"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/categories/1/reports",
                            "self": "https://triage.example.com/api/public/v2/categories/1/relationships/reports"
                        }
                    }
                },
                "type": "categories"
            },
            {
                "attributes": {
                    "archived": false,
                    "color": "#58899a",
                    "created_at": "2020-10-21T15:30:56.280Z",
                    "malicious": false,
                    "name": "Spam",
                    "score": 0,
                    "updated_at": "2020-10-21T15:30:56.280Z"
                },
                "id": "2",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/categories/2"
                },
                "relationships": {
                    "one_clicks": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/categories/2/one_clicks",
                            "self": "https://triage.example.com/api/public/v2/categories/2/relationships/one_clicks"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/categories/2/reports",
                            "self": "https://triage.example.com/api/public/v2/categories/2/relationships/reports"
                        }
                    }
                },
                "type": "categories"
            }
        ]
    }
}

Human Readable Output

Categories

Category ID Name Malicious Archived Created At Updated At
1 Non-Malicious false false 2020-10-21T15:30:56.280Z 2020-10-21T15:30:56.280Z
2 Spam false false 2020-10-21T15:30:56.280Z 2020-10-21T15:30:56.280Z

cofense-rule-list

Retrieves rules based on the filter values provided in the command arguments.
Rules identify specific characteristics for categorizing the reported emails.

Base Command

cofense-rule-list

Input

Argument Name Description Required
id Specify the ID of the rule to retrieve a specific rule. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of rules to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the rules. Default is 1. Optional
sort_by Specify the attributes to sort the rules. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -name, priority. Optional
filter_by Specify the filters to filter the list of rules by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“priority_eq\”:\“2,3\”, \“name_cont\”:\“Test\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: name, description. Optional
name Specify the name of the rule to retrieve the rule. Optional
priority Specify the priority of the rule to retrieve the rule. Some possible values are: 1, 2, 3, 4, 5. Optional
tags Specify the tags associated with the rule to retrieve the rule. Optional
scope Specify the scope of the rule to retrieve the rule. Some possible values are: email, attachment, header, reporter email. Optional
active Specify if the rule is active or not. Possible values are: true, false. Optional
author_name Specify the author name of the rule to retrieve the rule. Optional
rule_context Specify the rule context of the rule to retrieve the rule. Some possible values are: internal safe, unwanted, threat hunting, phishing tactic, cleanup, unknown. Optional
created_at Specify the date and time of creation, from when to retrieve the rules. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the rules. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Rule.id String Unique identifier of the rule.
Cofense.Rule.type String Type of the resource of Cofense Triage.
Cofense.Rule.links.self String Link of the resource.
Cofense.Rule.attributes.name String Short display name of the rule.
Cofense.Rule.attributes.description String Expanded name or description of the rule.
Cofense.Rule.attributes.priority Number Priority of the rule. Priorities in Cofense Triage go from 1 to 5. Priority 5 is the highest, or most critical.
Cofense.Rule.attributes.tags Unknown Tags assigned to the rule.
Cofense.Rule.attributes.scope String Scope to determine which part of a report to apply the rule to (Email, Attachment, Header, or Reporter Email).
Cofense.Rule.attributes.author_name String Name of the author of the rule.
Cofense.Rule.attributes.rule_context String Description that best represents what the user wants the rule to do (Internal Safe, Unwanted, Threat Hunting, Phishing Tactic, or Cleanup).
Cofense.Rule.attributes.active Boolean Whether the rule is active (true) or not active (false).
Cofense.Rule.attributes.content String YARA-compliant meta, strings, and conditions that define the contents of the rule.
Cofense.Rule.attributes.time_to_live String Time period that best represents the useful lifespan of the rule (Forever, 1 Week, 1 Month, 1 Year).
Cofense.Rule.attributes.share_with_cofense Boolean Whether to share the rule content with the Cofense Triage Community Exchange (true) or not (false).
Cofense.Rule.attributes.reports_count Number Number of reports the rule matched.
Cofense.Rule.attributes.imported_at Date Date and time, in ISO 8601 format, when the rule was imported. If the rule was not imported, the response contains a null value.
Cofense.Rule.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Rule.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Rule.relationships.cluster_context.links.self String Link to retrieve the cluster from which the rule was created.
Cofense.Rule.relationships.cluster_context.links.related String Link to retrieve the detailed information of the cluster from which the rule was created.
Cofense.Rule.relationships.cluster_context.data.type String Type of the cluster context associated with the rule.
Cofense.Rule.relationships.cluster_context.data.id String Unique identifier of the cluster context associated with the rule.
Cofense.Rule.relationships.report_context.links.self String Link to retrieve the report from which the rule was created.
Cofense.Rule.relationships.report_context.links.related String Link to retrieve the detailed information of the report from which the rule was created.
Cofense.Rule.relationships.report_context.data.type String Type of the report context associated with the rule.
Cofense.Rule.relationships.report_context.data.id String Unique identifier of the report context associated with the rule.
Cofense.Rule.relationships.owner.links.self String Link to retrieve the owner who created the rule.
Cofense.Rule.relationships.owner.links.related String Link to retrieve the detailed information of the owner who created the rule.
Cofense.Rule.relationships.owner.data.type String Type of the owner associated with the rule.
Cofense.Rule.relationships.owner.data.id String Unique identifier of the owner associated with the rule.
Cofense.Rule.relationships.clusters.links.self String Link to retrieve the clusters that match the rule.
Cofense.Rule.relationships.clusters.links.related String Link to retrieve the detailed information of the clusters that match the rule.
Cofense.Rule.relationships.reports.links.self String Link to retrieve the reports that match the rule.
Cofense.Rule.relationships.reports.links.related String Link to retrieve the detailed information of the reports that match the rule.

Command Example

!cofense-rule-list page_size=2

Context Example

{
    "Cofense": {
        "Rule": [
            {
                "attributes": {
                    "active": true,
                    "author_name": "Thor",
                    "content": "meta:\n  time_to_live=\"Forever\"\n  rule_context=\"Phishing Tactic\"\nstrings: \n  $Body1=\"Due within the next 30 days\" nocase\n  $Subject1=\"Aging\" nocase\ncondition:\n  all of them\n",
                    "created_at": "2020-11-24T15:19:12.616Z",
                    "description": "Testing customer-created rule",
                    "name": "MX_Testing",
                    "priority": 5,
                    "reports_count": 0,
                    "rule_context": "Phishing Tactic",
                    "scope": "Email",
                    "share_with_cofense": false,
                    "time_to_live": "Forever",
                    "updated_at": "2020-11-24T15:19:12.616Z"
                },
                "id": "1690",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/rules/1690"
                },
                "relationships": {
                    "cluster_context": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/1690/cluster_context",
                            "self": "https://triage.example.com/api/public/v2/rules/1690/relationships/cluster_context"
                        }
                    },
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/1690/clusters",
                            "self": "https://triage.example.com/api/public/v2/rules/1690/relationships/clusters"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "2",
                            "type": "operators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/1690/owner",
                            "self": "https://triage.example.com/api/public/v2/rules/1690/relationships/owner"
                        }
                    },
                    "report_context": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/1690/report_context",
                            "self": "https://triage.example.com/api/public/v2/rules/1690/relationships/report_context"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/1690/reports",
                            "self": "https://triage.example.com/api/public/v2/rules/1690/relationships/reports"
                        }
                    }
                },
                "type": "rules"
            },
            {
                "attributes": {
                    "active": true,
                    "author_name": "Thanos",
                    "content": "meta:\n  time_to_live=\"Forever\"\n  rule_context=\"Unknown\"\nstrings: \n  $link=\"www.cnn.com\" nocase\n  $url1=\"www.cnn.com\" nocase\n  $url2=\"www.cnn.com\" nocase\n  $sub=\"REPLACE_WITH_SUBJECT\" nocase\ncondition:\n  any of ($url*) or ($link and $sub)\n",
                    "created_at": "2021-04-19T10:31:44.773Z",
                    "description": "Its is a test rule",
                    "name": "test_rule1",
                    "priority": 1,
                    "reports_count": 5,
                    "rule_context": "Unknown",
                    "scope": "Email",
                    "share_with_cofense": false,
                    "tags": [
                        "test_tag",
                        "TEST"
                    ],
                    "time_to_live": "Forever",
                    "updated_at": "2021-04-29T07:21:30.634Z"
                },
                "id": "2534",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/rules/2534"
                },
                "relationships": {
                    "cluster_context": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/2534/cluster_context",
                            "self": "https://triage.example.com/api/public/v2/rules/2534/relationships/cluster_context"
                        }
                    },
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/2534/clusters",
                            "self": "https://triage.example.com/api/public/v2/rules/2534/relationships/clusters"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "9",
                            "type": "operators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/2534/owner",
                            "self": "https://triage.example.com/api/public/v2/rules/2534/relationships/owner"
                        }
                    },
                    "report_context": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/2534/report_context",
                            "self": "https://triage.example.com/api/public/v2/rules/2534/relationships/report_context"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/rules/2534/reports",
                            "self": "https://triage.example.com/api/public/v2/rules/2534/relationships/reports"
                        }
                    }
                },
                "type": "rules"
            }
        ]
    }
}

Human Readable Output

Rule(s)

Rule ID Rule Name Description Active Priority Scope Author Name Rule Context Created At Updated At
1690 MX_Testing Testing customer-created rule true 5 Email Thor Phishing Tactic 2020-11-24T15:19:12.616Z 2020-11-24T15:19:12.616Z
2534 test_rule1 Its is a test rule true 1 Email Thanos Unknown 2021-04-19T10:31:44.773Z 2021-04-29T07:21:30.634Z

cofense-url-list

Retrieves URLs based on the filter values provided in the command arguments.
URLs are the threats (or non-threat) that are detected in the reported emails.

Base Command

cofense-url-list

Input

Argument Name Description Required
id Specify the ID of the URL to retrieve a specific URL. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of URLs to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the URLs. Default is 1. Optional
sort_by Specify the attributes to sort the URLs. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -created_at, -updated_at. Optional
filter_by Specify the filters to filter the list of urls by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“risk_score_eq\”:\“1,2\”, \“updated_at_gt\”:\“2020-10-26T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: url, risk_score. Optional
risk_score Specify the risk scores to retrieve the urls. Optional
created_at Specify the date and time of creation, from when to retrieve the URLs. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the URLs. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Url.id String Unique identifier of the URL.
Cofense.Url.type String Type of the resource of Cofense Triage.
Cofense.Url.links.self String Link of the resource.
Cofense.Url.attributes.url String Value of the URL.
Cofense.Url.attributes.risk_score Unknown Risk score of the URL.
Cofense.Url.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Url.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource details were last updated.
Cofense.Url.relationships.domain.links.self String Link to retrieve the domain of the URL.
Cofense.Url.relationships.domain.links.related String Link to retrieve the detailed information of the domain of the URL.
Cofense.Url.relationships.hostname.links.self String Link to retrieve the hostname of the URL.
Cofense.Url.relationships.hostname.links.related String Link to retrieve the detailed information of the hostname of the URL.
Cofense.Url.relationships.hostname.data.type String Type of the hostname associated with the URL.
Cofense.Url.relationships.hostname.data.id String Unique identifier of the hostname associated with the URL.
Cofense.Url.relationships.clusters.links.self String Link to retrieve the clusters containing the reports with the URL.
Cofense.Url.relationships.clusters.links.related String Link to retrieve the detailed information of the clusters containing the reports with the URL.
Cofense.Url.relationships.integration_submissions.links.self String Link to retrieve the integration submissions containing the URL.
Cofense.Url.relationships.integration_submissions.links.related String Link to retrieve the detailed information of the integration submissions containing the URL.
Cofense.Url.relationships.reports.links.self String Link to retrieve the reports containing the URL.
Cofense.Url.relationships.reports.links.related String Link to retrieve the detailed information of the reports containing the URL.

Command Example

!cofense-url-list page_size=2

Context Example

{
    "Cofense": {
        "Url": [
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:24.185Z",
                    "updated_at": "2020-10-21T20:54:24.185Z",
                    "url": "http://dummy.com/servlet/MailView?ms=MTE4NDM1ODgS1&r=LTMyMjA1MjQ1ODcS1&j=MTc2MDQ3MTQ4MwS2&mt=1&rt=0"
                },
                "id": "15",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/urls/15"
                },
                "relationships": {
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/15/clusters",
                            "self": "https://triage.example.com/api/public/v2/urls/15/relationships/clusters"
                        }
                    },
                    "domain": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/15/domain",
                            "self": "https://triage.example.com/api/public/v2/urls/15/relationships/domain"
                        }
                    },
                    "hostname": {
                        "data": {
                            "id": "6",
                            "type": "hostnames"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/15/hostname",
                            "self": "https://triage.example.com/api/public/v2/urls/15/relationships/hostname"
                        }
                    },
                    "integration_submissions": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/15/integration_submissions",
                            "self": "https://triage.example.com/api/public/v2/urls/15/relationships/integration_submissions"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/15/reports",
                            "self": "https://triage.example.com/api/public/v2/urls/15/relationships/reports"
                        }
                    }
                },
                "type": "urls"
            },
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:24.204Z",
                    "updated_at": "2020-10-21T20:54:24.204Z",
                    "url": "http://dummy.com/ctt?kn=3&ms=MTE4NDM1ODgS1&r=LTMyMjA1MjQ1ODcS1&b=0&j=MTc2MDQ3MTQ4MwS2&mt=1&rt=0"
                },
                "id": "16",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/urls/16"
                },
                "relationships": {
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/16/clusters",
                            "self": "https://triage.example.com/api/public/v2/urls/16/relationships/clusters"
                        }
                    },
                    "domain": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/16/domain",
                            "self": "https://triage.example.com/api/public/v2/urls/16/relationships/domain"
                        }
                    },
                    "hostname": {
                        "data": {
                            "id": "6",
                            "type": "hostnames"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/16/hostname",
                            "self": "https://triage.example.com/api/public/v2/urls/16/relationships/hostname"
                        }
                    },
                    "integration_submissions": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/16/integration_submissions",
                            "self": "https://triage.example.com/api/public/v2/urls/16/relationships/integration_submissions"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/urls/16/reports",
                            "self": "https://triage.example.com/api/public/v2/urls/16/relationships/reports"
                        }
                    }
                },
                "type": "urls"
            }
        ]
    }
}

Human Readable Output

URL(s)

URL ID URL Created At Updated At
15 http://dummy.com/servlet/MailView?ms=MTE4NDM1ODgS1&r=LTMyMjA1MjQ1ODcS1&j=MTc2MDQ3MTQ4MwS2&mt=1&rt=0 2020-10-21T20:54:24.185Z 2020-10-21T20:54:24.185Z
16 http://dummy.com/ctt?kn=3&ms=MTE4NDM1ODgS1&r=LTMyMjA1MjQ1ODcS1&b=0&j=MTc2MDQ3MTQ4MwS2&mt=1&rt=0 2020-10-21T20:54:24.204Z 2020-10-21T20:54:24.204Z

cofense-threat-indicator-create

Creates a threat indicator based on the values provided in the command arguments.

Base Command

cofense-threat-indicator-create

Input

Argument Name Description Required
threat_level Specify the level of the threat indicator that is to be created. Some possible values are: Malicious, Suspicious, Benign. Required
threat_type Specify the type of the threat indicator that is to be created. Some possible values are: Sender, Subject, Domain, URL, MD5, SHA256, Hostname, or Header. Required
threat_value Specify the value corresponding to the type of threat indicated in threat_type that is to be created. Note: It should have at least 3 characters. It must be unique and valid. Required
threat_source Specify the value corresponding to the source of the threat indicator that is to be created. Note: This attribute supports only one threat_type/threat_value pair per source. Default is XSOAR-UI. Optional

Context Output

Path Type Description
Cofense.ThreatIndicator.id String Unique identifier of the threat indicator.
Cofense.ThreatIndicator.type String Type of the resource of Cofense Triage.
Cofense.ThreatIndicator.links.self String Link of the resource.
Cofense.ThreatIndicator.attributes.threat_level String The level of the threat.
Cofense.ThreatIndicator.attributes.threat_type String The type of the threat.
Cofense.ThreatIndicator.attributes.threat_value String Value corresponding to the type of threat indicated in the type of the threat.
Cofense.ThreatIndicator.attributes.threat_source String Value corresponding to the source of the threat.
Cofense.ThreatIndicator.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.ThreatIndicator.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.ThreatIndicator.relationships.owner.links.self String Link to retrieve the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.links.related String Link to retrieve the detailed information of the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.type String Type of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.id String Unique identifier of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.self String Link to retrieve the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.related String Link to retrieve the detailed information of the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.self String Link to retrieve the comments containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.related String Link to retrieve the detailed information of the comments containing the threat indicator.

Command Example

!cofense-threat-indicator-create threat_level=Benign threat_type=Hostname threat_value="abc.com"

Context Example

{
    "Cofense": {
        "ThreatIndicator": {
            "attributes": {
                "created_at": "2021-06-22T06:11:57.462Z",
                "threat_level": "Benign",
                "threat_source": "XSOAR-UI",
                "threat_type": "Hostname",
                "threat_value": "abc.com",
                "updated_at": "2021-06-22T06:11:57.462Z"
            },
            "id": "393",
            "links": {
                "self": "https://triage.example.com/api/public/v2/threat_indicators/393"
            },
            "relationships": {
                "comments": {
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/393/comments",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/393/relationships/comments"
                    }
                },
                "owner": {
                    "data": {
                        "id": "3",
                        "type": "api_applications"
                    },
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/393/owner",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/393/relationships/owner"
                    }
                },
                "reports": {
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/393/reports",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/393/relationships/reports"
                    }
                }
            },
            "type": "threat_indicators"
        }
    }
}

Human Readable Output

Threat Indicator(s)

Threat Indicator ID Threat Level Threat Type Threat Value Threat Source Created At Updated At
393 Benign Hostname abc.com XSOAR-UI 2021-06-22T06:11:57.462Z 2021-06-22T06:11:57.462Z

cofense-reporter-list

Retrieves the reporters that match the provided parameters.
Reporters are employees of an organization who send, or report, suspicious emails to Cofense Triage.

Base Command

cofense-reporter-list

Input

Argument Name Description Required
id Specify the ID of the reporter to retrieve a specific reporter. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of reporters to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the reporters. Default is 1. Optional
sort_by Specify the attributes to sort the reporters. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: reports_count, -email. Optional
filter_by Specify the filters to filter the list of reporters by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“reputation_score_eq\”:\“1,2\”, \“reports_count_gt\”:\“3\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: email, reports_count. Optional
reputation_score Specify reputation score to retrieve the reporters. Optional
vip Specify that the reporter to be retrieved is VIP or non-VIP. Possible values are: true, false. Optional
email Specify emails of the reporter to retrieve the reporter. Optional
created_at Specify the date and time of creation, from when to retrieve the reporters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the reporters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Reporter.id String Unique identifier of the reporter.
Cofense.Reporter.type String Type of the resource of Cofense Triage.
Cofense.Reporter.links.self String Link of the resource.
Cofense.Reporter.attributes.email String Email address of the reporter.
Cofense.Reporter.attributes.reports_count Number Number of emails reported by the reporter.
Cofense.Reporter.attributes.last_reported_at Date Date and time, in ISO 8601 format, when the reporter last reported an email.
Cofense.Reporter.attributes.reputation_score Number Reputation score of the reporter.
Cofense.Reporter.attributes.vip Boolean Whether the reporter is a VIP (true) or not (false). The default is true.
Cofense.Reporter.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Reporter.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Reporter.relationships.clusters.links.self String Link to retrieve the clusters containing reports the individual reported.
Cofense.Reporter.relationships.clusters.links.related String Link to retrieve the detailed information of the clusters containing reports the individual reported.
Cofense.Reporter.relationships.reports.links.self String Link to retrieve the reports the individual reported.
Cofense.Reporter.relationships.reports.links.related String Link to retrieve the detailed information of the reports the individual reported.

Command Example

!cofense-reporter-list page_size=2

Context Example

{
    "Cofense": {
        "Reporter": [
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:23.383Z",
                    "email": "no-reply@xyz.com",
                    "last_reported_at": "2020-12-11T05:46:39.000Z",
                    "reports_count": 10,
                    "reputation_score": 8,
                    "updated_at": "2021-05-30T11:51:00.170Z",
                    "vip": false
                },
                "id": "4",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/reporters/4"
                },
                "relationships": {
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reporters/4/clusters",
                            "self": "https://triage.example.com/api/public/v2/reporters/4/relationships/clusters"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reporters/4/reports",
                            "self": "https://triage.example.com/api/public/v2/reporters/4/relationships/reports"
                        }
                    }
                },
                "type": "reporters"
            },
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:25.915Z",
                    "email": "devcomm@xyz.com",
                    "last_reported_at": "2020-05-05T18:44:01.000Z",
                    "reports_count": 2,
                    "reputation_score": -5,
                    "updated_at": "2020-12-03T10:51:25.482Z",
                    "vip": true
                },
                "id": "6",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/reporters/6"
                },
                "relationships": {
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reporters/6/clusters",
                            "self": "https://triage.example.com/api/public/v2/reporters/6/relationships/clusters"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/reporters/6/reports",
                            "self": "https://triage.example.com/api/public/v2/reporters/6/relationships/reports"
                        }
                    }
                },
                "type": "reporters"
            }
        ]
    }
}

Human Readable Output

Reporter(s)

Reporter ID Reporter Email Reports Count Reputation Score VIP Last Reported At Created At Updated At
4 no-reply@xyz.com 10 8 false 2020-12-11T05:46:39.000Z 2020-10-21T20:54:23.383Z 2021-05-30T11:51:00.170Z
6 devcomm@xyz.com 2 -5 true 2020-05-05T18:44:01.000Z 2020-10-21T20:54:25.915Z 2020-12-03T10:51:25.482Z

cofense-integration-submission-get

Retrieves integration submission based on the filter values provided in the command arguments.

Note:

  • When the user provides incorrect values in arguments, the user will be getting a 500 internal error.
  • When the user provides any value in kind argument, the user will be getting a 500 internal error.

Base Command

cofense-integration-submission-get

Input

Argument Name Description Required
id Specify URL ID or attachment payload ID to retrieve an integration submission. Note: To retrieve URL ID, execute cofense-url-list command. To retrieve attachment ID, execute cofense-attachment-payload-list command. Required
type Type of the integration submission the user wants to retrieve. Possible values are: urls, attachment_payloads. Default is urls. Optional
page_size Specify the number of integration submissions to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the integration submissions. Optional
sort_by Specify the attributes to sort the integration submissions. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: status, -id. Optional
filter_by Specify the filters to filter the list of integration submissions by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“status_eq\”:\“complete\”, \“risk_score_eq\”:\“0,1\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: status, kind. Optional
status Specify the status to retrieve the integration submission. Some possible values are: ending, complete, target_not_found, error, running, or hash_not_found. Optional
kind Specify the kind to retrieve the integration submission. Some possible values are: File, Hash, URL. Optional
risk_score Specify the risk scores to retrieve the attachment payloads. Optional
created_at Specify the date and time of creation, from when to retrieve the integration submissions. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the integration submissions. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.IntegrationSubmission.id String Unique identifier of the integration submission.
Cofense.IntegrationSubmission.type String Type of the resource of Cofense Triage.
Cofense.IntegrationSubmission.links.self String Link of the resource.
Cofense.IntegrationSubmission.attributes.status String Status of the integration submission.
Cofense.IntegrationSubmission.attributes.result String Result of the integration submission.
Cofense.IntegrationSubmission.attributes.kind String Kind of the integration submission.
Cofense.IntegrationSubmission.attributes.risk_score Number Risk score of the integration submission.
Cofense.IntegrationSubmission.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.IntegrationSubmission.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.IntegrationSubmission.relationships.integration.links.self String Link to retrieve the integration associated with the integration submission.
Cofense.IntegrationSubmission.relationships.integration.links.related String Link to retrieve the detailed information of integration associated with the integration submission.
Cofense.IntegrationSubmission.relationships.integration.data.type String Type of the integration associated with the integration submission.
Cofense.IntegrationSubmission.relationships.integration.data.id String Unique Identifier of the integration associated with the integration submission.
Cofense.IntegrationSubmission.relationships.target.links.self String Link to retrieve the target associated with the integration submission.
Cofense.IntegrationSubmission.relationships.target.links.related String Link to retrieve the detailed information of the target associated with the integration submission.
Cofense.IntegrationSubmission.relationships.target.data.type String Type of the target associated with the integration submission.
Cofense.IntegrationSubmission.relationships.target.data.id String Unique Identifier of the target associated with the integration submission.

Command Example

!cofense-integration-submission-get id=4879 type=urls

Context Example

{
    "Cofense": {
        "IntegrationSubmission": [
            {
                "attributes": {
                    "created_at": "2021-04-02T16:32:43.525Z",
                    "kind": "URL",
                    "result": "{\"success\":0,\"error_code\":117,\"error\":\"Invalid URL\"}",
                    "status": "error",
                    "updated_at": "2021-04-02T16:34:11.016Z"
                },
                "id": "155",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/integration_submissions/155"
                },
                "relationships": {
                    "integration": {
                        "data": {
                            "id": "5",
                            "type": "integrations"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/155/integration",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/155/relationships/integration"
                        }
                    },
                    "target": {
                        "data": {
                            "id": "4879",
                            "type": "urls"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/155/target",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/155/relationships/target"
                        }
                    }
                },
                "type": "integration_submissions"
            },
            {
                "attributes": {
                    "created_at": "2021-04-02T16:31:51.713Z",
                    "kind": "URL",
                    "result": "{\"success\":0,\"error_code\":117,\"error\":\"Invalid URL\"}",
                    "status": "error",
                    "updated_at": "2021-04-02T16:32:11.093Z"
                },
                "id": "154",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/integration_submissions/154"
                },
                "relationships": {
                    "integration": {
                        "data": {
                            "id": "5",
                            "type": "integrations"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/154/integration",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/154/relationships/integration"
                        }
                    },
                    "target": {
                        "data": {
                            "id": "4879",
                            "type": "urls"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/154/target",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/154/relationships/target"
                        }
                    }
                },
                "type": "integration_submissions"
            },
            {
                "attributes": {
                    "created_at": "2021-04-02T16:27:42.094Z",
                    "kind": "URL",
                    "result": "{\"success\":0,\"error_code\":117,\"error\":\"Invalid URL\"}",
                    "status": "error",
                    "updated_at": "2021-04-02T16:28:11.300Z"
                },
                "id": "153",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/integration_submissions/153"
                },
                "relationships": {
                    "integration": {
                        "data": {
                            "id": "5",
                            "type": "integrations"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/153/integration",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/153/relationships/integration"
                        }
                    },
                    "target": {
                        "data": {
                            "id": "4879",
                            "type": "urls"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/integration_submissions/153/target",
                            "self": "https://triage.example.com/api/public/v2/integration_submissions/153/relationships/target"
                        }
                    }
                },
                "type": "integration_submissions"
            }
        ]
    }
}

Human Readable Output

Integration Submission(s)

Integration Submission ID Status Kind Created At Updated At
155 error URL 2021-04-02T16:32:43.525Z 2021-04-02T16:34:11.016Z
154 error URL 2021-04-02T16:31:51.713Z 2021-04-02T16:32:11.093Z
153 error URL 2021-04-02T16:27:42.094Z 2021-04-02T16:28:11.300Z

cofense-attachment-payload-list

Retrieves attachment payloads based on the filter values provided in the command arguments.
Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email.

Base Command

cofense-attachment-payload-list

Input

Argument Name Description Required
id Specify ID of the attachment payload to retrieve a specific attachment payload. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of attachment payloads to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the attachment payloads. Default is 1. Optional
sort_by Specify the attributes to sort the attachment payloads. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: risk_score, -id. Optional
filter_by Specify the filters to filter the list of attachment payloads by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“risk_score\”:\“0,1\”, \“created_at_gteq\”:\“2020-04-13T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: md5, risk_score. Optional
risk_score Specify the risk scores to retrieve the attachment payloads. Optional
created_at Specify the date and time of creation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.AttachmentPayload.id String Unique identifier of the attachment payload.
Cofense.AttachmentPayload.type String Type of the resource of Cofense Triage.
Cofense.AttachmentPayload.links.self String Link of the resource.
Cofense.AttachmentPayload.attributes.mime_type String MIME type of the payload.
Cofense.AttachmentPayload.attributes.md5 String MD5 hash of the payload.
Cofense.AttachmentPayload.attributes.sha256 String SHA256 hash of the payload.
Cofense.AttachmentPayload.attributes.risk_score Number Risk score of the payload.
Cofense.AttachmentPayload.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.AttachmentPayload.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.AttachmentPayload.relationships.attachments.links.self String Link to retrieve the attachment containing the payload.
Cofense.AttachmentPayload.relationships.attachments.links.related String Link to retrieve the detailed information of the attachment containing the payload.
Cofense.AttachmentPayload.relationships.clusters.links.self String Link to retrieve the cluster of reports containing the payload.
Cofense.AttachmentPayload.relationships.clusters.links.related String Link to retrieve the detailed information of the cluster of reports containing the payload.
Cofense.AttachmentPayload.relationships.integration_submissions.links.self String Link to retrieve the integration submissions related to attachment.
Cofense.AttachmentPayload.relationships.integration_submissions.links.related String Link to retrieve the detailed information of the integration submissions related to attachment.
Cofense.AttachmentPayload.relationships.reports.links.self String Link to retrieve the report with attachments containing the payload.
Cofense.AttachmentPayload.relationships.reports.links.related String Link to retrieve the detailed information of the report with attachments containing the payload.

Command Example

!cofense-attachment-payload-list page_size=2

Context Example

{
    "Cofense": {
        "AttachmentPayload": [
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:36.450Z",
                    "md5": "123456789ec6d4a936ef02d4042a93c2",
                    "mime_type": "image/png; charset=binary",
                    "sha256": "123456789f8c56c47f9a481c919eb869af09f9fff0c1551781aa77e8674377b9",
                    "updated_at": "2020-10-21T20:54:36.450Z"
                },
                "id": "8",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/attachment_payloads/8"
                },
                "relationships": {
                    "attachments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/8/attachments",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/8/relationships/attachments"
                        }
                    },
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/8/clusters",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/8/relationships/clusters"
                        }
                    },
                    "integration_submissions": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/8/integration_submissions",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/8/relationships/integration_submissions"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/8/reports",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/8/relationships/reports"
                        }
                    }
                },
                "type": "attachment_payloads"
            },
            {
                "attributes": {
                    "created_at": "2020-10-21T20:54:36.531Z",
                    "md5": "9f16385db56b9429fc210b19df012345",
                    "mime_type": "image/png; charset=binary",
                    "sha256": "7609ec052a3834f0ac822001837d7b25dea34bd38143a13ea6a187c192212345",
                    "updated_at": "2020-10-21T20:54:36.531Z"
                },
                "id": "9",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/attachment_payloads/9"
                },
                "relationships": {
                    "attachments": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/9/attachments",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/9/relationships/attachments"
                        }
                    },
                    "clusters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/9/clusters",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/9/relationships/clusters"
                        }
                    },
                    "integration_submissions": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/9/integration_submissions",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/9/relationships/integration_submissions"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/attachment_payloads/9/reports",
                            "self": "https://triage.example.com/api/public/v2/attachment_payloads/9/relationships/reports"
                        }
                    }
                },
                "type": "attachment_payloads"
            }
        ]
    }
}

Human Readable Output

Attachment Payload(s)

Attachment Payload ID Mime Type MD5 SHA256 Created At Updated At
8 image/png; charset=binary 123456789ec6d4a936ef02d4042a93c2 123456789f8c56c47f9a481c919eb869af09f9fff0c1551781aa77e8674377b9 2020-10-21T20:54:36.450Z 2020-10-21T20:54:36.450Z
9 image/png; charset=binary 9f16385db56b9429fc210b19df012345 7609ec052a3834f0ac822001837d7b25dea34bd38143a13ea6a187c192212345 2020-10-21T20:54:36.531Z 2020-10-21T20:54:36.531Z

cofense-comment-list

Retrieves comments based on the filter values provided in the command arguments.

Base Command

cofense-comment-list

Input

Argument Name Description Required
id Specify the ID of the comment to retrieve a specific comment. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of comments to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the comments. Default is 1. Optional
sort_by Specify the attributes to sort the comments. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -created_at, body. Optional
filter_by Specify the filters to filter the list of comments by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“body_format_eq\”:\“json\”, \“created_at_gteq\”:\“2021-04-13T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: body, body_format. Optional
body_format Specify the format of the comment body to retrieve the comments. Possible values are: text, json. Optional
tags Specify the tags to retrieve the comments based on the tags associated with the comments. Optional
report_id Specify the ID of the report to retrieve the comments specific to the report. Note: When both report_id and threat_indicator_id are provided, higher priority will be given to report_id. Note: To retrieve report_id, execute cofense-report-list command. Optional
threat_indicator_id Specify the ID of the threat indicator to retrieve the comments specific to the threat indicator. Note: When both report_id and threat_indicator_id are provided, higher priority will be given to report_id. Note: To retrieve threat_indicator_id, execute cofense-threat-indicator-list command. Optional
created_at Specify the date and time of creation, from when to retrieve the comments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the comments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Comment.id String Unique identifier of the comment.
Cofense.Comment.type String Type of the resource of Cofense Triage.
Cofense.Comment.links.self String Link of the resource.
Cofense.Comment.attributes.body_format String Format of the comment body.
Cofense.Comment.attributes.body String Body of the comment.
Cofense.Comment.attributes.tags Unknown Tags assigned to the comment.
Cofense.Comment.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Comment.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Comment.attributes.body.type String Type of the comment.
Cofense.Comment.attributes.body.properties.reported_time.type Date Reported time of the comment.
Cofense.Comment.attributes.body.properties.srctag.type Unknown Source tags associated with the comments.
Cofense.Comment.attributes.body.properties.received_time.type Date Received time for the comments.
Cofense.Comment.attributes.body.properties.from.type String Email ID of the user who added the comment.
Cofense.Comment.attributes.body.properties.reported_by.type String Email ID of the reporter who reported the comment.
Cofense.Comment.attributes.body.properties.notes.type String Notes of the comment.
Cofense.Comment.attributes.body.properties.summary.type String Summary of the comment.
Cofense.Comment.attributes.body.properties.malware_families.type String Malware families for the comment.
Cofense.Comment.attributes.body.properties.phenotypes.type String Phenotypes of the comment.
Cofense.Comment.attributes.body.properties.message_id.type String Message ID for the comment.
Cofense.Comment.attributes.body.properties.reply_to.type String Replied to email ID for the comment.
Cofense.Comment.attributes.body.properties.report_url.type String Report URL for the comment.
Cofense.Comment.attributes.body.properties.escalation_type.type String Escalation type of the comment.
Cofense.Comment.attributes.body.properties.stage_1_iocs.type String Type of the stage 1 IOCs.
Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.files.type String File ioc available in the comment.
Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_ips.type String Type of the infection IPs.
Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_ips.items.type String Type of the infection IP available in the comment.
Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_urls.items.type String Infection URL available in the comment.
Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_urls.type String Type of the infection URL.
Cofense.Comment.attributes.body.properties.brands.type String Type of the brands.
Cofense.Comment.attributes.body.properties.brands.items.type String Brands of the comment.
Cofense.Comment.attributes.body.properties.vision_results.type String Type of the vision result.
Cofense.Comment.attributes.body.properties.vision_results.properties.results_id String Result ID of the vision result.
Cofense.Comment.attributes.body.properties.vision_results.properties.query_created.type Date Query created date for the vision result.
Cofense.Comment.attributes.body.properties.vision_results.properties.messages_removed String Number of messages removed from the comment.
Cofense.Comment.attributes.body.properties.vision_results.properties.messages_found String Number of messages found from the comment.
Cofense.Comment.attributes.body.properties.subject.type String Subject of the comment.
Cofense.Comment.attributes.body.properties.sent_to.type String Receiver email ID.
Cofense.Comment.attributes.body.properties.stage_2_iocs.type String Type of the stage 2 IOCs.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.files.type String File IOCs available in the comment.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.md5.type String MD5 IOCs available in the comment.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.size.type String Size of the stage 2 IOCs.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_ips.type String Type of the payload IPs.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_ips.items.type String Payload IPs available in the comment.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_urls.type String Type of the payload URLs.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_urls.items.type String Payload URLs available in the comment.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.c2_ips.type String C2 IPs available in the comment.
Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.c2_urls.type Unknown C2 URLs available in the comment.
Cofense.Comment.attributes.body.properties.report_id.type String ID of the report associated with the comment.
Cofense.Comment.relationships.commentable.links.self String Link to retrieve the commentable comments.
Cofense.Comment.relationships.commentable.links.related String Link to retrieve the detailed information of the commentable comments.
Cofense.Comment.relationships.commentable.data.type String Type of the commentable comment associated with the comment.
Cofense.Comment.relationships.commentable.data.id String Unique identifier of the commentable comment associated with the comment.
Cofense.Comment.relationships.owner.links.self String Link to retrieve the owner of the comment.
Cofense.Comment.relationships.owner.links.related String Link to retrieve the detailed information of the owner of the comment.
Cofense.Comment.relationships.owner.data.type String Type of the owner associated with the comment.
Cofense.Comment.relationships.owner.data.id String Unique identifier of the owner associated with the comment.

Command Example

!cofense-comment-list page_size=2

Context Example

{
    "Cofense": {
        "Comment": [
            {
                "attributes": {
                    "body": "www.xyz.com",
                    "body_format": "text",
                    "created_at": "2021-04-01T20:52:59.342Z",
                    "updated_at": "2021-04-01T20:52:59.342Z"
                },
                "id": "1",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/comments/1"
                },
                "relationships": {
                    "commentable": {
                        "data": {
                            "id": "216",
                            "type": "threat_indicators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/comments/1/commentable",
                            "self": "https://triage.example.com/api/public/v2/comments/1/relationships/commentable"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "2",
                            "type": "operators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/comments/1/owner",
                            "self": "https://triage.example.com/api/public/v2/comments/1/relationships/owner"
                        }
                    }
                },
                "type": "comments"
            },
            {
                "attributes": {
                    "body": "www.abc.com",
                    "body_format": "text",
                    "created_at": "2021-04-02T12:58:25.496Z",
                    "updated_at": "2021-04-02T12:58:25.496Z"
                },
                "id": "2",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/comments/2"
                },
                "relationships": {
                    "commentable": {
                        "data": {
                            "id": "207",
                            "type": "threat_indicators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/comments/2/commentable",
                            "self": "https://triage.example.com/api/public/v2/comments/2/relationships/commentable"
                        }
                    },
                    "owner": {
                        "data": {
                            "id": "2",
                            "type": "operators"
                        },
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/comments/2/owner",
                            "self": "https://triage.example.com/api/public/v2/comments/2/relationships/owner"
                        }
                    }
                },
                "type": "comments"
            }
        ]
    }
}

Human Readable Output

Comment(s)

Comment ID Body Format Body Created At Updated At Associated To Associated To ID
1 text www.xyz.com 2021-04-01T20:52:59.342Z 2021-04-01T20:52:59.342Z threat_indicators 216
2 text www.abc.com 2021-04-02T12:58:25.496Z 2021-04-02T12:58:25.496Z threat_indicators 207

cofense-cluster-list

Retrieves clusters based on the filter values provided in the command arguments.

Base Command

cofense-cluster-list

Input

Argument Name Description Required
id Specify the ID of the cluster to retrieve a specific cluster. Note: If ‘id’ argument is provided, then apart from ‘fields_to_retrieve’, all arguments will be neglected. Optional
page_size Specify the number of clusters to retrieve per page. Note: Possible values are between 1 and 200. Default is 20. Optional
page_number Specify a page number to retrieve the clusters. Default is 1. Optional
sort_by Specify the attributes to sort the clusters. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: created_at, -updated_at. Optional
filter_by Specify the filters to filter the list of clusters by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\“attribute1_operator \”: \“value1, value2\”, \“attribute2_operator\” : \“value3, value4\”} For example: {\“risk_score_eq\”:\“1,2\”, \“updated_at_gt\”:\“2020-10-26T10:48:16.834Z\”}. Optional
fields_to_retrieve Specify the fields to retrieve the mentioned attributes only. For example: unprocessed_reports_count, processed_reports_count. Optional
tags Specify the tags to retrieve the cluster. Optional
match_priority Specify the priority to retrieve the cluster based on the priority of the rules that match the reports in the cluster. Possible values are: 0, 1, 2, 3, 4, 5. Optional
total_reports_count Specify the number of reports to be present in the cluster. Optional
created_at Specify the date and time of creation, from when to retrieve the clusters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional
updated_at Specify the date and time of updation, from when to retrieve the clusters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Optional

Context Output

Path Type Description
Cofense.Cluster.id String Unique identifier of the cluster.
Cofense.Cluster.type String Type of the resource of Cofense Triage.
Cofense.Cluster.links.self String Link of the resource.
Cofense.Cluster.attributes.risk_score Number Risk score of the cluster.
Cofense.Cluster.attributes.first_reported_at Date Date and time, in ISO 8601 format, when the first report in the cluster was reported.
Cofense.Cluster.attributes.oldest_unprocessed_reported_at Date Date and time, in ISO 8601 format, when the oldest unprocessed report in the cluster was reported.
Cofense.Cluster.attributes.last_received_at Date Date and time, in ISO 8601 format, when the suspect email associated with the last report in the cluster was received.
Cofense.Cluster.attributes.last_reported_at Date Date and time, in ISO 8601 format, when the last report in the cluster was reported to Triage.
Cofense.Cluster.attributes.last_from_address String Sender email address for the suspect email associated with the last report added to the cluster.
Cofense.Cluster.attributes.last_subject String Subject of the last received report.
Cofense.Cluster.attributes.average_reporter_reputation String Average reporter reputation score across all reports in the cluster.
Cofense.Cluster.attributes.match_priority Number Highest priority of the rules that match the reports in the cluster.
Cofense.Cluster.attributes.host_source String Semicolon-separated list of URL domains in the cluster.
Cofense.Cluster.attributes.tags Unknown Tags assigned to the cluster.
Cofense.Cluster.attributes.attachments_count Number Count of attachments in the cluster.
Cofense.Cluster.attributes.unprocessed_reports_count Number Count of unprocessed reports in the cluster.
Cofense.Cluster.attributes.processed_reports_count Number Count of processed reports in the cluster.
Cofense.Cluster.attributes.total_reports_count Number Count of all reports in the cluster.
Cofense.Cluster.attributes.rules_count Number Count of unique rules that match one or more reports in the cluster.
Cofense.Cluster.attributes.urls_count Number Count of URLs in the cluster.
Cofense.Cluster.attributes.vip_reporters_count Number Count of VIP reporters.
Cofense.Cluster.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.Cluster.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.Cluster.relationships.attachment_payloads.links.self String Link to retrieve the payloads of attachments associated with the reports in the cluster.
Cofense.Cluster.relationships.attachment_payloads.links.related String Link to retrieve the detailed information of the payloads of attachments associated with the reports in the cluster.
Cofense.Cluster.relationships.domains.links.self String Link to retrieve the domain of the reports in the cluster.
Cofense.Cluster.relationships.domains.links.related String Link to retrieve the detailed information of the domain of the reports in the cluster.
Cofense.Cluster.relationships.hostnames.links.self String Link to retrieve the hostnames of URLs associated with the reports in the cluster.
Cofense.Cluster.relationships.hostnames.links.related String Link to retrieve the detailed information of the hostnames of URLs associated with the report in the cluster.
Cofense.Cluster.relationships.reports.links.self String Link to retrieve reports in the cluster.
Cofense.Cluster.relationships.reports.links.related String Link to retrieve the detailed information of the reports in the cluster.
Cofense.Cluster.relationships.reporters.links.self String Link to retrieve the reporters of reports in the cluster.
Cofense.Cluster.relationships.reporters.links.related String Link to retrieve the detailed information of the reporters of reports in the cluster.
Cofense.Cluster.relationships.rules.links.self String Link to retrieve the rules matching the cluster.
Cofense.Cluster.relationships.rules.links.related String Link to retrieve the detailed information of the rules matching the cluster.
Cofense.Cluster.relationships.urls.links.self String Link to retrieve the URLs associated with reports in the cluster.
Cofense.Cluster.relationships.urls.links.related String Link to retrieve the detailed information of the URLs associated with reports in the cluster.

Command Example

!cofense-cluster-list page_size=2

Context Example

{
    "Cofense": {
        "Cluster": [
            {
                "attributes": {
                    "attachments_count": 0,
                    "average_reporter_reputation": "0.0",
                    "created_at": "2020-10-21T20:54:25.644Z",
                    "first_reported_at": "2019-11-08T17:17:05.000Z",
                    "host_source": "dummy.xyz.com;dummy.com",
                    "match_priority": 0,
                    "processed_reports_count": 11,
                    "risk_score": 34,
                    "rules_count": 0,
                    "total_reports_count": 11,
                    "unprocessed_reports_count": 0,
                    "updated_at": "2021-06-02T11:05:02.806Z",
                    "urls_count": 3,
                    "vip_reporters_count": 0
                },
                "id": "1",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/clusters/1"
                },
                "relationships": {
                    "attachment_payloads": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/attachment_payloads",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/attachment_payloads"
                        }
                    },
                    "domains": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/domains",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/domains"
                        }
                    },
                    "hostnames": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/hostnames",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/hostnames"
                        }
                    },
                    "reporters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/reporters",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/reporters"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/reports",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/reports"
                        }
                    },
                    "rules": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/rules",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/rules"
                        }
                    },
                    "urls": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/1/urls",
                            "self": "https://triage.example.com/api/public/v2/clusters/1/relationships/urls"
                        }
                    }
                },
                "type": "clusters"
            },
            {
                "attributes": {
                    "attachments_count": 0,
                    "average_reporter_reputation": "0.0",
                    "created_at": "2020-10-21T20:54:28.227Z",
                    "first_reported_at": "2019-11-08T19:50:17.000Z",
                    "host_source": "content.xyz.com;dummy.pages03.net",
                    "match_priority": 0,
                    "processed_reports_count": 1,
                    "risk_score": 8,
                    "rules_count": 0,
                    "total_reports_count": 1,
                    "unprocessed_reports_count": 0,
                    "updated_at": "2020-11-23T13:17:43.492Z",
                    "urls_count": 3,
                    "vip_reporters_count": 0
                },
                "id": "2",
                "links": {
                    "self": "https://triage.example.com/api/public/v2/clusters/2"
                },
                "relationships": {
                    "attachment_payloads": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/attachment_payloads",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/attachment_payloads"
                        }
                    },
                    "domains": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/domains",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/domains"
                        }
                    },
                    "hostnames": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/hostnames",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/hostnames"
                        }
                    },
                    "reporters": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/reporters",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/reporters"
                        }
                    },
                    "reports": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/reports",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/reports"
                        }
                    },
                    "rules": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/rules",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/rules"
                        }
                    },
                    "urls": {
                        "links": {
                            "related": "https://triage.example.com/api/public/v2/clusters/2/urls",
                            "self": "https://triage.example.com/api/public/v2/clusters/2/relationships/urls"
                        }
                    }
                },
                "type": "clusters"
            }
        ]
    }
}

Human Readable Output

Cluster(s)

Cluster ID Unprocessed Report Total Report Count Match Priority Host Source Average Reporter Reputation Score VIP Reporter count Created At Updated At
1 0 11 0 dummy.xyz.com;dummy.com 0.0 0 2020-10-21T20:54:25.644Z 2021-06-02T11:05:02.806Z
2 0 1 0 content.xyz.com;dummy.pages03.net 0.0 0 2020-10-21T20:54:28.227Z 2020-11-23T13:17:43.492Z

cofense-threat-indicator-update

Updates a threat indicator based on the values provided in the command arguments.

Base Command

cofense-threat-indicator-update

Input

Argument Name Description Required
id Specify ID of the threat indicator that is to be updated. Note: To retrieve id, execute cofense-threat-indicator-list command. Required
threat_level Specify the level of the threat indicator that is to be updated. Some possible values are: Malicious, Suspicious, Benign. Required
threat_source Specify the value corresponding to the source of the threat indicator that is to be updated. Optional

Context Output

Path Type Description
Cofense.ThreatIndicator.id String Unique identifier of the threat indicator.
Cofense.ThreatIndicator.type String Type of the resource of Cofense Triage.
Cofense.ThreatIndicator.links.self String Link of the resource.
Cofense.ThreatIndicator.attributes.threat_level String The level of the threat.
Cofense.ThreatIndicator.attributes.threat_type String The type of the threat.
Cofense.ThreatIndicator.attributes.threat_value String Value corresponding to the type of threat indicated in the type of the threat.
Cofense.ThreatIndicator.attributes.threat_source String Value corresponding to the source of the threat.
Cofense.ThreatIndicator.attributes.created_at Date Date and time, in ISO 8601 format, when the resource was created.
Cofense.ThreatIndicator.attributes.updated_at Date Date and time, in ISO 8601 format, when the resource was last updated.
Cofense.ThreatIndicator.relationships.owner.links.self String Link to retrieve the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.links.related String Link to retrieve the detailed information of the owner of the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.type String Type of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.owner.data.id String Unique identifier of the owner associated with the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.self String Link to retrieve the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.reports.links.related String Link to retrieve the detailed information of the reports containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.self String Link to retrieve the comments containing the threat indicator.
Cofense.ThreatIndicator.relationships.comments.links.related String Link to retrieve the detailed information of the comments containing the threat indicator.

Command Example

!cofense-threat-indicator-update id=1 threat_level=Suspicious

Context Example

{
    "Cofense": {
        "ThreatIndicator": {
            "attributes": {
                "created_at": "2020-10-26T10:47:09.675Z",
                "threat_level": "Suspicious",
                "threat_source": "URL",
                "threat_type": "SHA256",
                "threat_value": "dummy_hash",
                "updated_at": "2021-06-22T06:09:22.661Z"
            },
            "id": "1",
            "links": {
                "self": "https://triage.example.com/api/public/v2/threat_indicators/1"
            },
            "relationships": {
                "comments": {
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/1/comments",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/comments"
                    }
                },
                "owner": {
                    "data": {
                        "id": "3",
                        "type": "api_applications"
                    },
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/1/owner",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/owner"
                    }
                },
                "reports": {
                    "links": {
                        "related": "https://triage.example.com/api/public/v2/threat_indicators/1/reports",
                        "self": "https://triage.example.com/api/public/v2/threat_indicators/1/relationships/reports"
                    }
                }
            },
            "type": "threat_indicators"
        }
    }
}

Human Readable Output

Threat Indicator(s)

Threat Indicator ID Threat Level Threat Type Threat Value Threat Source Created At Updated At
1 Suspicious SHA256 dummy_hash URL 2020-10-26T10:47:09.675Z 2021-06-22T06:09:22.661Z

get-remote-data

Get remote data from a remote incident. Please note that this method will not update the current incident, it’s here for debugging purposes.

Base Command

get-remote-data

Input

Argument Name Description Required
id The report ID. Required
lastUpdate Date string representing the local time.The incident is only returned if it was modified after the last update time. Required

Context Output

There is no context output for this command.

Command Example

!get-remote-data id=34 lastUpdate="3 days"

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate Date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time. Required

Context Output

There is no context output for this command.

Command Example

!get-modified-remote-data lastUpdate="3 days"

cofense-report-image-download

Downloads the image of the report that matches the specified report ID.

Base Command

cofense-report-image-download

Input

Argument Name Description Required
id Specify the ID of the report to download the image file. Note: To retrieve id, execute cofense-report-list command. Required
type The image type of the report the user wants to download. Some possible values are: jpg, png. Default is png. Optional

Context Output

Path Type Description
InfoFile.Name String File name.
InfoFile.EntryID String The entry ID of the file.
InfoFile.Size Number File size in bytes.
InfoFile.Type String The file type.
InfoFile.Info String File information.
InfoFile.Extension String File extension.

Command Example

!cofense-report-image-download id="4"

Context Example

{
    "InfoFile": {
        "EntryID": "12345@24e2b8bb-acd8-4ad6-8f7c-5140d65ea600",
        "Extension": "png",
        "Info": "image/png",
        "Name": "Report ID - 4.png",
        "Size": 63172,
        "Type": "PNG image data, 400 x 769, 8-bit/color RGBA, non-interlaced"
    }
}

Human Readable Output

Uploaded an image: Report ID - 4.png
cofense-report-image-download

Breaking changes from the previous version of this integration - Cofense Triage v2

The following sections list the changes in this version.

Commands

The following commands were removed in this version

  • cofense-search-reports - this command was replaced by cofense-report-list.
  • cofense-search-inbox-reports - this command was replaced by cofense-report-list with argument ‘report_location’ .
  • cofense-get-attachment
  • cofense-get-reporter - this command was replaced by cofense-reporter-list.
  • cofense-get-report-by-id - this command was replaced by cofense-report-list with argument ‘id’.
  • cofense-get-report-png-by-id - this command was replaced by cofense-report-image-download.
  • cofense-get-threat-indicators - this command was replaced by cofense-threat-indicator-list.

Additional Considerations for this version

The ability to mirror incident data has been added.

The following commands were added in this version

  • cofense-attachment-payload-list
  • cofense-category-list
  • cofense-cluster-list
  • cofense-comment-list
  • cofense-integration-submission-get
  • cofense-report-categorize
  • cofense-report-download
  • cofense-rule-list
  • cofense-threat-indicator-create
  • cofense-threat-indicator-update
  • cofense-url-list
  • cofense-report-attachment-payload-list
  • cofense-report-attachment-list
  • cofense-report-attachment-download

Configuration parameters

  • url — Server URL (required)
  • credentials — Client ID (required)
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time interval
  • mailbox_location — Report Location
  • match_priority — Match Priority
  • category_id — Category ID
  • tags — Tags
  • categorization_tags — Categorization Tags
  • mirror_direction — Incident Mirroring Direction
  • filter_by — Advanced Filters
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents

Commands (20)

  • cofense-attachment-payload-list

    Retrieves attachment payloads based on the filter values provided in the command arguments. Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email.

  • cofense-category-list

    Retrieves categories based on the provided parameters. Categories are applied while processing the email to indicate the type of threat (or non-threat) that reports and clusters pose to the organization.

  • cofense-cluster-list

    Retrieves clusters based on the filter values provided in the command arguments.

  • cofense-comment-list

    Retrieves comments based on the filter values provided in the command arguments.

  • cofense-integration-submission-get

    Retrieves integration submission based on the filter values provided in the command arguments.

  • cofense-report-attachment-download

    Downloads the attachment for the specified attachment ID.

  • cofense-report-attachment-list

    Retrieves attachments based on provided report id in the command arguments. For reported emails that contain attachments, Cofense Triage captures the attachment's filename and size.

  • cofense-report-attachment-payload-list

    Retrieves attachment payloads based on provided report id in the command arguments. Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email attachment.

  • cofense-report-categorize

    Categorizes a report into a specific category provided by the user.

  • cofense-report-download

    Downloads the raw email for the report that matches the specified report ID.

  • cofense-report-image-download

    Downloads the image of the report that matches the specified report ID.

  • cofense-report-list

    Retrieves a report or a list of reports based on the filter values provided in the command arguments.

  • cofense-reporter-list

    Retrieves the reporters that match the provided parameters. Reporters are employees of an organization who send, or report, suspicious emails to Cofense Triage.

  • cofense-rule-list

    Retrieves rules based on the filter values provided in the command arguments. Rules identify specific characteristics for categorizing the reported emails.

  • cofense-threat-indicator-create

    Creates a threat indicator based on the values provided in the command arguments.

  • cofense-threat-indicator-list

    Retrieves the list of threat indicators based on the provided parameters. Threat indicators identify the threat level of an email's subject, sender, domains, URLs, and MD5 and SHA256 attachment hash signatures.

  • cofense-threat-indicator-update

    Updates a threat indicator based on the values provided in the command arguments.

  • cofense-url-list

    Retrieves URLs based on the filter values provided in the command arguments. URLs are the threats (or non-threat) that are detected in the reported emails.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a mirroring feature, which is available from Cortex XSOAR version 6.1.

  • get-remote-data

    Get remote data from a remote incident. Please note that this method will not update the current incident, it's here for debugging purposes.

Source

CofenseTriagev3.py CofenseTriagev3_test.py CofenseTriagev3.yml CofenseTriagev3_description.md
Download History Raw 
import json
import os
import time
from unittest import mock
from unittest.mock import patch

import dateparser
import pytest
from CofenseTriagev3 import MESSAGES
from CommonServerPython import DemistoException
from test_data import input_data

BASE_URL = "https://triage.example.com"
API_TOKEN = "dummy_token"
MOCK_INTEGRATION_CONTEXT = {"api_token": API_TOKEN, "valid_until": time.time() + 7200}
AUTHENTICATION_RESP_HEADER = {"access_token": API_TOKEN, "token_type": "Bearer", "expires_in": 7200, "created_at": 1604920579}
MOCKER_HTTP_METHOD = "CofenseTriagev3.Client.http_request"


def util_load_json(path: str) -> dict:
    """Load a json to python dict."""
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


@pytest.fixture
def mocked_client():
    mocked_client = mock.Mock()
    return mocked_client


@pytest.fixture()
def client():
    from CofenseTriagev3 import Client

    return Client(BASE_URL, False, False, "client_id", "client_secret")


def test_test_module_when_valid_response_is_returned(mocked_client):
    """Test test_module function for success cases."""
    from CofenseTriagev3 import test_module

    mocked_client.http_request.return_value = {}
    assert test_module(mocked_client, {}) == "ok"


def test_http_request_when_valid_response_is_returned(mocker, requests_mock, client):
    """Test case scenario for successful execution of http_request function"""
    from CofenseTriagev3 import URL_SUFFIX

    mocker.patch("CofenseTriagev3.Client.get_api_token", new=lambda x: False)
    mocker.patch("CofenseTriagev3.Client.set_integration_context", new=lambda x, y: "token")
    requests_mock.get(BASE_URL + URL_SUFFIX["SYSTEM_STATUS"], json={"status": True}, status_code=200)
    requests_mock.post(
        BASE_URL + "/oauth/token?client_id=client_id&client_secret=client_secret&grant_type=client_credentials",
        json={"access_token": "token"},
        status_code=200,
    )
    assert client.http_request(URL_SUFFIX["SYSTEM_STATUS"]) == {"status": True}


def test_http_request_when_error_is_returned(mocker, requests_mock, client):
    """Test case for failure scenario of http_request function"""
    from CofenseTriagev3 import URL_SUFFIX

    mocker.patch("CofenseTriagev3.Client.get_api_token", new=lambda x: "token")

    requests_mock.get(BASE_URL + URL_SUFFIX["SYSTEM_STATUS"], json={"status": True}, status_code=401)
    with pytest.raises(DemistoException) as err:
        client.http_request(URL_SUFFIX["SYSTEM_STATUS"])
    assert str(err.value) == "Authentication error: please provide valid Client ID and Client Secret."


def test_set_token_in_integration_context(client):
    """Test case scenario for setting api_token in integration context"""
    response = client.set_integration_context(AUTHENTICATION_RESP_HEADER)
    assert response == "Bearer " + API_TOKEN


def test_error_while_getting_api_token(client):
    """Test cases for scenario when there is no access_token in API response"""
    with pytest.raises(ValueError, match=MESSAGES["API_TOKEN"]):
        client.set_integration_context({})


@patch("CofenseTriagev3.Client._http_request")
@patch("demistomock.getIntegrationContext")
@patch("demistomock.setIntegrationContext")
def test_get_api_token_when_found_in_integration_context(mocker_set_context, mocker_get_context, mock_request, client):
    """Test cases for scenario when there is api_token and valid_until in integration context."""
    mocker_get_context.return_value = MOCK_INTEGRATION_CONTEXT
    mocker_set_context.return_value = {}

    mock_request.return_value = AUTHENTICATION_RESP_HEADER

    api_token = client.get_api_token()

    assert api_token == AUTHENTICATION_RESP_HEADER["access_token"]


@pytest.mark.parametrize("integration_context", input_data.integration_context)
@patch("demistomock.getIntegrationContext")
@patch("demistomock.setIntegrationContext")
def test_get_api_token_when_not_found_in_integration_context(mocker_set_context, mocker_get_context, client, integration_context):
    """Test cases for scenario when there is no api_token or no valid_until or valid_until < current timestamp in
    integration context"""
    mocker_get_context.return_value = integration_context
    mocker_set_context.return_value = {}

    api_token = client.get_api_token()

    assert not api_token


@patch(MOCKER_HTTP_METHOD)
def test_cofense_report_list_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-report-list command."""
    from CofenseTriagev3 import cofense_report_list_command

    with open("test_data/report/report_list_response.json") as data:
        mock_response = json.load(data)

    with open("test_data/report/report_list_context.json") as data:
        expected_res = json.load(data)

    with open("test_data/report/report_list.md") as data:
        expected_hr = data.read()

    mocker_http_request.return_value = mock_response
    args = {"page_size": "20"}

    result = cofense_report_list_command(client, args)

    assert result.raw_response == mock_response
    assert result.outputs == expected_res
    assert result.readable_output == expected_hr


@patch(MOCKER_HTTP_METHOD)
def test_cofense_report_list_command_when_empty_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-report-list command with an empty response."""
    from CofenseTriagev3 import cofense_report_list_command

    mocker_http_request.return_value = {}

    args = {"page_size": "20"}

    result = cofense_report_list_command(client, args)

    assert result.readable_output == "No report(s) were found for the given argument(s)."


@pytest.mark.parametrize("args, err_msg", input_data.list_report_cmd_arg)
def test_validate_list_report_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_report_args

    with pytest.raises(ValueError) as err:
        validate_list_report_args(args)
    assert str(err.value) == err_msg


def test_validate_list_report_args_when_valid_args_are_provided():
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import validate_list_report_args

    # Arguments to be passed
    args = {
        "match_priority": "1",
        "tags": "test",
        "categorization_tags": "snow",
        "report_location": "inbox",
        "filter_by": '{"categorization_tags_any": "test", "match_priority": "2", "location_eq": "processed"'
        ', "tags_any": "test1", "risk_score_eq": "1,2"}',
    }
    # Expected response
    params = {
        "filter[categorization_tags_any]": "snow",
        "filter[location]": "inbox",
        "filter[match_priority]": "1",
        "filter[tags_any]": "test",
        "filter[risk_score_eq]": "1,2",
    }
    assert validate_list_report_args(args) == params


@pytest.mark.parametrize("reason, status_code, result, expected_err_msg", input_data.exception_handler)
def test_exception_handler(mocker, reason, status_code, result, expected_err_msg):
    """Test cases for the scenario when the response does not have status_code as valid.
    So to ensure that error messages are as per expected error messages."""
    from CofenseTriagev3 import Client

    mocked_response = mocker.Mock()
    mocked_response.reason = reason
    mocked_response.status_code = status_code
    mocked_response.json.return_value = result
    mocked_response.text = result
    with pytest.raises(DemistoException) as err:
        Client.exception_handler(mocked_response)

    assert str(err.value) == expected_err_msg


def test_validate_list_command_args_when_valid_args_are_provided():
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import validate_list_command_args

    # Arguments to be passed
    args = {
        "page_size": "2",
        "page_number": 3,
        "sort_by": " threat_level, -threat_value, , ",
        "filter_by": "threat_level_eq= ,Malicious, ; updated_at_gt=2020-10-21T20:54:24.185Z, ; ",
        "fields_to_retrieve": " threat_level,threat_type, ,threat_value",
        "created_at": "2020-10-21T20:54:23.444Z",
    }

    # Expected response
    params = (
        {
            "page[size]": 2,
            "page[number]": 3,
            "sort": "threat_level,-threat_value",
            "fields[threat_indicators]": "threat_level,threat_type,threat_value",
            "filter[created_at_gteq]": dateparser.parse("2020-10-21T20:54:23.444Z"),
        },
        ["created_at"],
    )

    assert validate_list_command_args(args, "threat_indicators") == params


@pytest.mark.parametrize("args, params", input_data.valid_dates)
def test_validate_list_command_args_when_valid_dates_are_provided(args, params):
    from CofenseTriagev3 import validate_list_command_args

    result = validate_list_command_args(args, "threat_indicators")
    result = result[0]["filter[created_at_gteq]"].strftime("%Y-%m-%d")

    assert result == params


@pytest.mark.parametrize("args, err_msg", input_data.validate_args)
def test_validate_list_command_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_command_args

    with pytest.raises(ValueError) as err:
        validate_list_command_args(args, "threat_indicators")
    assert str(err.value) == err_msg


def test_cofense_threat_indicator_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-threat-indicator-list command."""

    from CofenseTriagev3 import cofense_threat_indicator_list_command

    response = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_context.json"))

    with open(os.path.join("test_data", "threat_indicator/threat_indicators_command_readable_output.md")) as f:
        readable_output = f.read()

    # Execute
    args = {
        "id": "298",
        "filter_by": '{"threat_level_eq":"Benign","updated_at_gt":"2020-10-21T20:54:24.185Z",'
        '"threat_level": "Malicious","threat_type": "URl", "threat_value":'
        ' "https://example.com/carolann","threat_source": "Generic Threat Intel"}',
    }
    command_response = cofense_threat_indicator_list_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.ThreatIndicator"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_threat_indicator_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-threat-indicator-list command with an empty response."""

    from CofenseTriagev3 import cofense_threat_indicator_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No threat indicators were found for the given argument(s)."

    # Execute
    command_response = cofense_threat_indicator_list_command(mocked_client, {})

    # Assert
    assert command_response.readable_output == readable_output


@pytest.mark.parametrize("args", input_data.invalid_args_for_threat_indicator_list)
def test_validate_list_threat_indicator_args_when_invalid_args_are_provided(args):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_threat_indicator_args

    with pytest.raises(ValueError) as err:
        validate_list_threat_indicator_args(args)

    assert str(err.value) == MESSAGES["FILTER"]


def test_cofense_report_download_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-download command."""

    from CofenseTriagev3 import cofense_report_download_command

    result = cofense_report_download_command(mocked_client, args={"id": "4"})
    assert result.get("File") == "Report ID - 4.eml"


def test_cofense_report_download_command_when_invalid_args_are_provided(mocked_client):
    """Test case scenario for failure execution of cofense-report-download command."""

    from CofenseTriagev3 import cofense_report_download_command

    args = {"id": ""}
    with pytest.raises(ValueError) as err:
        cofense_report_download_command(mocked_client, args)
    assert str(err.value) == MESSAGES["REQUIRED_ARGUMENT"].format("id")


def test_cofense_report_categorize_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-categorize command."""

    from CofenseTriagev3 import cofense_report_categorize_command

    mocked_client.http_request.return_value.status_code = 204
    response = cofense_report_categorize_command(
        mocked_client, args={"id": "4", "category_id": "3", "categorization_tags": " a,b, c", "response_id": "5"}
    )
    assert response.readable_output == "Report with ID = 4 is categorized successfully."


def test_cofense_report_categorize_when_wrong_category_id_is_provided(mocked_client):
    """Test case scenario when wrong category_id is provided for cofense-report-categorize command."""

    from CofenseTriagev3 import cofense_report_categorize_command

    with pytest.raises(ValueError) as err:
        cofense_report_categorize_command(mocked_client, args={"id": "4", "category_id": "3, 34"})
    assert str(err.value) == '"3, 34" is not a valid number'


def test_cofense_report_categorize_when_wrong_report_id_is_assigned(mocked_client):
    """Test case scenario when wrong report_id is provided for cofense-report-categorize command."""

    from CofenseTriagev3 import cofense_report_categorize_command

    with pytest.raises(ValueError) as err:
        cofense_report_categorize_command(mocked_client, args={"id": "4, 3; 5", "category_id": "3"})
    assert str(err.value) == '"4, 3; 5" is not a valid number'


@pytest.mark.parametrize("args, msg", [({"id": "", "category_id": "2"}, "id"), ({"id": "1", "category_id": ""}, "category_id")])
def test_cofense_report_categorize_command_when_invalid_args_are_provided(mocked_client, args, msg):
    """Test case scenario for failure execution of cofense-report-download command."""

    from CofenseTriagev3 import cofense_report_categorize_command

    with pytest.raises(ValueError):
        cofense_report_categorize_command(mocked_client, args)


@patch(MOCKER_HTTP_METHOD)
def test_cofense_category_list_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-category-list command."""
    from CofenseTriagev3 import cofense_category_list_command

    with open("test_data/category/category_list_response.json") as data:
        mock_response = json.load(data)

    with open("test_data/category/category_list_context.json") as data:
        expected_res = json.load(data)

    with open("test_data/category/category_list.md") as data:
        expected_hr = data.read()

    mocker_http_request.return_value = mock_response
    args = {"page_size": "2"}

    result = cofense_category_list_command(client, args)

    assert result.raw_response == mock_response
    assert result.outputs == expected_res
    assert result.readable_output == expected_hr


@patch(MOCKER_HTTP_METHOD)
def test_cofense_category_list_command_when_empty_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-category-list command with an empty response."""
    from CofenseTriagev3 import cofense_category_list_command

    mocker_http_request.return_value = {}

    args = {"page_size": "2"}

    result = cofense_category_list_command(client, args)

    assert result.readable_output == "No categories were found for the given argument(s)."


@pytest.mark.parametrize("args, err_msg", input_data.list_category_cmd_arg)
def test_validate_list_category_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_category_args

    with pytest.raises(ValueError) as err:
        validate_list_category_args(args)
    assert str(err.value) == err_msg


def test_validate_list_category_args_when_valid_args_are_provided():
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import validate_list_category_args

    # Arguments to be passed
    args = {
        "name": "Spam",
        "is_malicious": "true",
        "score": "5,10",
        "filter_by": '{"name":"test", "malicious":"false" ,"score":"15" ,"archived":"false"}',
    }
    # Expected response
    params = {
        "filter[name]": "Spam",
        "filter[malicious]": "true",
        "filter[score]": "5,10",
        "filter[archived]": "false",
    }
    assert validate_list_category_args(args) == params


def test_validate_fetch_incident_parameters_when_valid_params_are_provided():
    """Test case scenario when the parameters provided are valid."""

    from CofenseTriagev3 import validate_fetch_incidents_parameters

    # Parameters passed
    params = {
        "max_fetch": 15,
        "first_fetch": "03/06/2021",
        "match_priority": ["0", "1", "2"],
        "tags": "test",
        "categorization_tags": "snow",
        "mailbox_location": ["Inbox", "Processed"],
        "filter_by": '{"categorization_tags_any":"test","match_priority":"2","tags_any":"test1","risk_score_eq":"1,2"}',
    }
    # Expected response
    fetch_params = {
        "page[size]": 15,
        "filter[updated_at_gteq]": "2021-03-06T00:00:00.000000Z",
        "filter[categorization_tags_any]": "snow",
        "filter[location]": "Inbox,Processed",
        "filter[match_priority]": "0,1,2",
        "filter[tags_any]": "test",
        "filter[risk_score_eq]": "1,2",
    }
    assert validate_fetch_incidents_parameters(params) == fetch_params


@pytest.mark.parametrize("args, err_msg", input_data.fetch_incident_params)
def test_validate_fetch_incident_parameters_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the parameters provided are not valid."""

    from CofenseTriagev3 import validate_fetch_incidents_parameters

    with pytest.raises(ValueError) as err:
        validate_fetch_incidents_parameters(args)
    assert str(err.value) == err_msg


@patch("demistomock.integrationInstance", create=True)
@patch(MOCKER_HTTP_METHOD)
def test_fetch_incidents_when_valid_response_is_returned(mocker_http_request, mocker_integration_instance, client):
    """Test case scenario for successful execution of fetch_incident."""
    from CofenseTriagev3 import fetch_incidents

    response = util_load_json(os.path.join("test_data", "fetch_incidents/fetch_incidents_response.json"))

    mocker_http_request.return_value = response
    mocker_integration_instance.return_value = "Cofense Triage v3_instance_1"

    context_output = util_load_json(os.path.join("test_data", "fetch_incidents/fetch_incidents.json"))

    params = {"max_fetch": "2", "first_fetch": "1 year", "mirror_direction": "Incoming"}

    next_run, incidents = fetch_incidents(client, {}, params)

    assert incidents == context_output["incidents"]
    assert next_run == {"ids": ["4", "6"], "updated_at": "2021-05-02T08:38:57.241Z"}


@patch("demistomock.integrationInstance", create=True)
@patch(MOCKER_HTTP_METHOD)
def test_fetch_incidents_with_last_run_when_valid_response_is_returned(mocker_http_request, mocker_integration_instance, client):
    """Test case scenario for successful execution of fetch_incident."""
    from CofenseTriagev3 import fetch_incidents

    response = util_load_json(os.path.join("test_data", "fetch_incidents/fetch_incidents_response.json"))

    mocker_http_request.return_value = response
    mocker_integration_instance.return_value = "Cofense Triage v3_instance_1"

    context_output = util_load_json(os.path.join("test_data", "fetch_incidents/fetch_incidents.json"))

    params = {"max_fetch": "2", "first_fetch": "1 year", "mirror_direction": "Incoming"}

    next_run, incidents = fetch_incidents(client, {"ids": ["1"], "page_number": 1}, params)

    assert incidents == context_output["incidents"]
    assert next_run == {"ids": ["1", "4", "6"], "updated_at": "2021-05-02T08:38:57.241Z"}


def test_cofense_url_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-url-list command."""

    from CofenseTriagev3 import cofense_url_list_command

    response = util_load_json(os.path.join("test_data", "url/list_url_command_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "url/list_url_command_context.json"))

    with open(os.path.join("test_data", "url/list_url_command_readable_output.md")) as f:
        readable_output = f.read()

    # Execute
    args = {
        "id": "15",
        "filter_by": '{"risk_score_eq":" 1,2", "updated_at_gt":"2020-10-21T20:54:24.185Z"}',
        "risk_score": "1,2,3",
    }
    command_response = cofense_url_list_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.Url"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_url_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-url-list command with an empty response."""

    from CofenseTriagev3 import cofense_url_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No URLs were found for the given argument(s)."

    # Execute
    command_response = cofense_url_list_command(mocked_client, {})

    # Assert
    assert command_response.readable_output == readable_output


def test_validate_list_urls_args_when_invalid_args_are_provided():
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_url_args

    args = {"risk_score": "1 , -2, abc"}

    with pytest.raises(ValueError) as err:
        validate_list_url_args(args)
    assert str(err.value) == '"abc" is not a valid number'


@patch(MOCKER_HTTP_METHOD)
def test_cofense_rule_list_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-rule-list command."""
    from CofenseTriagev3 import cofense_rule_list_command

    with open("test_data/rule/rule_list_response.json") as data:
        mock_response = json.load(data)

    with open("test_data/rule/rule_list_context.json") as data:
        expected_res = json.load(data)

    with open("test_data/rule/rule_list.md") as data:
        expected_hr = data.read()

    mocker_http_request.return_value = mock_response
    args = {"page_size": "2"}

    result = cofense_rule_list_command(client, args)

    assert result.raw_response == mock_response
    assert result.outputs == expected_res
    assert result.readable_output == expected_hr


@patch(MOCKER_HTTP_METHOD)
def test_cofense_rule_list_command_when_empty_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-rule-list command with an empty response."""
    from CofenseTriagev3 import cofense_rule_list_command

    mocker_http_request.return_value = {}

    args = {"page_size": "2"}

    result = cofense_rule_list_command(client, args)

    assert result.readable_output == "No rule(s) were found for the given argument(s)."


@pytest.mark.parametrize("args, err_msg", input_data.list_rule_cmd_arg)
def test_validate_list_rule_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_rule_args

    with pytest.raises(ValueError) as err:
        validate_list_rule_args(args)
    assert str(err.value) == err_msg


def test_validate_list_rule_args_when_valid_args_are_provided():
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import validate_list_rule_args

    # Arguments to be passed
    args = {
        "name": "MX-Testing",
        "priority": "1",
        "tags": "Test",
        "scope": "Email",
        "active": "true",
        "author_name": "dummy",
        "rule_context": "Phishing Tactic",
        "filter_by": '{"name":"Test","rule_context":"Unknown"}',
    }
    # Expected response
    params = {
        "filter[name]": "MX-Testing",
        "filter[priority]": "1",
        "filter[tags_any]": "Test",
        "filter[scope]": "Email",
        "filter[active]": "true",
        "filter[author_name]": "dummy",
        "filter[rule_context]": "Phishing Tactic",
    }
    assert validate_list_rule_args(args) == params


def test_cofense_threat_indicator_create_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-threat-indicator-create command."""

    from CofenseTriagev3 import cofense_threat_indicator_create_command

    response = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_context.json"))

    with open(os.path.join("test_data", "threat_indicator/threat_indicators_command_readable_output.md")) as f:
        readable_output = f.read()

    # Execute
    args = {
        "threat_level": "Malicious",
        "threat_type": "URl",
        "threat_value": "https://example.com/carolann",
        "threat_source": "Generic Threat Intel",
    }
    command_response = cofense_threat_indicator_create_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.ThreatIndicator"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


@pytest.mark.parametrize("args, err_msg", input_data.create_threat_indicators_cmd_arg)
def test_validate_create_threat_indicator_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_create_threat_indicator_args

    with pytest.raises(ValueError) as err:
        validate_create_threat_indicator_args(args)
    assert str(err.value) == err_msg


@pytest.mark.parametrize("args, params, err_msg", input_data.check_fetch_incident_configuration_args)
def test_check_fetch_incident_configuration_when_invalid_args_are_provided(args, params, err_msg):
    """Test case scenario when the parameters provided are not valid."""

    from CofenseTriagev3 import check_fetch_incident_configuration

    with pytest.raises(ValueError) as err:
        check_fetch_incident_configuration(args, params)
    assert str(err.value) == err_msg


def test_cofense_integration_submission_get_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-integration-submission-get command."""

    from CofenseTriagev3 import cofense_integration_submission_get_command

    response = util_load_json(os.path.join("test_data", "integration_submission/integration_submission_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "integration_submission/integration_submission_context.json"))

    with open(os.path.join("test_data", "integration_submission/integration_submission_command_readable_output.md")) as f:
        readable_output = f.read()

    # Execute
    args = {"id": "190", "type": "attachment_payloads"}
    command_response = cofense_integration_submission_get_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.IntegrationSubmission"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_integration_submission_get_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-integration-submission-get with an empty response."""

    from CofenseTriagev3 import cofense_integration_submission_get_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No integration submissions were found for the given argument(s)."

    # Execute
    command_response = cofense_integration_submission_get_command(mocked_client, {"id": "15"})

    # Assert
    assert command_response.readable_output == readable_output


@pytest.mark.parametrize("args, err_msg", input_data.get_integration_submission_cmd_arg)
def test_cofense_integration_submission_get_command_when_invalid_args_are_provided(mocked_client, args, err_msg):
    """Test case scenario for failure execution of cofense-integration-submission-get."""

    from CofenseTriagev3 import cofense_integration_submission_get_command

    with pytest.raises(ValueError) as err:
        cofense_integration_submission_get_command(mocked_client, args)
    assert str(err.value) == err_msg


def test_cofense_reporter_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-reporter-list command."""

    from CofenseTriagev3 import cofense_reporter_list_command

    response = util_load_json(os.path.join("test_data", "reporter/reporter_list_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "reporter/reporter_list_context.json"))

    with open(os.path.join("test_data", "reporter/reporter_list.md")) as f:
        readable_output = f.read()

    # Execute
    args = {
        "id": "4",
        "filter_by": '{"reports_count_gt": "10","updated_at_gt":"2020-10-21T20:54:24.185Z"}',
        "reputation_score": "2,3,4",
        "vip": "true",
        "email": "no-reply@xforce.ibmcloud.com",
    }

    command_response = cofense_reporter_list_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.Reporter"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_reporter_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-reporter-list command with an empty response."""

    from CofenseTriagev3 import cofense_reporter_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No reporters were found for the given argument(s)."

    # Execute
    command_response = cofense_reporter_list_command(mocked_client, {})

    # Assert
    assert command_response.readable_output == readable_output


@pytest.mark.parametrize("args, err_msg", input_data.list_reporter_cmd_arg)
def test_validate_list_reporter_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_reporter_args

    with pytest.raises(ValueError) as err:
        validate_list_reporter_args(args)

    assert str(err.value) == err_msg


def test_cofense_attachment_payload_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-attachment-payload-list command."""

    from CofenseTriagev3 import cofense_attachment_payload_list_command

    response = util_load_json(os.path.join("test_data", "attachment_payload/attachment_payload_list_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "attachment_payload/attachment_payload_list_context.json"))

    with open(os.path.join("test_data", "attachment_payload/attachment_payload_list.md")) as f:
        readable_output = f.read()

    # Execute
    args = {"id": "4", "filter_by": '{"updated_at_gt" :"2020-10-21T20:54:24.185Z"}', "risk_score": "1,2"}

    command_response = cofense_attachment_payload_list_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.AttachmentPayload"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_attachment_payload_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-attachment-payload-list command with an empty response."""

    from CofenseTriagev3 import cofense_attachment_payload_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No attachment payloads were found for the given argument(s)."

    # Execute
    command_response = cofense_attachment_payload_list_command(mocked_client, {})

    # Assert
    assert command_response.readable_output == readable_output


def test_validate_list_attachment_payload_args_when_invalid_args_are_provided():
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_attachment_payload_args

    args = {"risk_score": "1 , -2, x"}

    with pytest.raises(ValueError) as err:
        validate_list_attachment_payload_args(args)
    assert str(err.value) == '"x" is not a valid number'


@patch(MOCKER_HTTP_METHOD)
def test_cofense_comment_list_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-comment-list command."""
    from CofenseTriagev3 import cofense_comment_list_command

    mock_response = util_load_json("test_data/comment/comment_list_response.json")
    mocker_http_request.return_value = mock_response

    expected_res = util_load_json("test_data/comment/comment_list_context.json")

    with open("test_data/comment/comment_list_hr.md") as data:
        expected_hr = data.read()

    args = {"page_size": "20"}

    result = cofense_comment_list_command(client, args)

    assert result.raw_response == mock_response
    assert result.outputs == expected_res
    assert result.readable_output == expected_hr


@patch(MOCKER_HTTP_METHOD)
def test_cofense_comment_list_command_when_empty_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-comment-list command with an empty response."""
    from CofenseTriagev3 import cofense_comment_list_command

    mocker_http_request.return_value = {}

    args = {"page_size": "20"}

    result = cofense_comment_list_command(client, args)

    assert result.readable_output == "No comment(s) were found for the given argument(s)."


@pytest.mark.parametrize("args, err_msg", input_data.list_comment_cmd_arg)
def test_validate_list_comment_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_comment_list_args

    with pytest.raises(ValueError) as err:
        validate_comment_list_args(args)
    assert str(err.value) == err_msg


@patch(MOCKER_HTTP_METHOD)
def test_get_remote_data(mocker_http_request, client):
    """Test case scenario for successful execution of get-remote-data command"""
    from CofenseTriagev3 import get_remote_data_command

    raw_response = util_load_json(os.path.join("test_data", "fetch_incidents/get_remote_data_command.json"))
    response = util_load_json(os.path.join("test_data", "fetch_incidents/get_remote_data_command_response.json"))
    mocker_http_request.return_value = raw_response
    args = {"id": 4, "lastUpdate": "2021-05-17T05:11:51.667Z"}

    command_response = get_remote_data_command(client, args)
    assert command_response.mirrored_object == response


def test_cofense_threat_indicator_update_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-threat-indicator-update command."""

    from CofenseTriagev3 import cofense_threat_indicator_update_command

    response = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(os.path.join("test_data", "threat_indicator/threat_indicators_command_context.json"))

    with open(os.path.join("test_data", "threat_indicator/threat_indicators_command_readable_output.md")) as f:
        readable_output = f.read()

    # Execute
    args = {"threat_level": "Malicious", "id": "298", "threat_source": "Generic Threat Intel"}
    command_response = cofense_threat_indicator_update_command(mocked_client, args)

    # Assert
    assert command_response.outputs_prefix == "Cofense.ThreatIndicator"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


@pytest.mark.parametrize("args, err_msg", input_data.update_threat_indicators_cmd_arg)
def test_validate_update_threat_indicator_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_update_threat_indicator_args

    with pytest.raises(ValueError) as err:
        validate_update_threat_indicator_args(args)
    assert str(err.value) == err_msg


@patch(MOCKER_HTTP_METHOD)
def test_cofense_cluster_list_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-cluster-list command."""
    from CofenseTriagev3 import cofense_cluster_list_command

    with open("test_data/cluster/cluster_list_response.json") as data:
        mock_response = json.load(data)

    with open("test_data/cluster/cluster_list_context.json") as data:
        expected_res = json.load(data)

    with open("test_data/cluster/cluster_list.md") as data:
        expected_hr = data.read()

    mocker_http_request.return_value = mock_response
    args = {"page_size": "2"}

    result = cofense_cluster_list_command(client, args)

    assert result.raw_response == mock_response
    assert result.outputs == expected_res
    assert result.readable_output == expected_hr


@patch(MOCKER_HTTP_METHOD)
def test_cofense_cluster_list_command_when_empty_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-cluster-list command with an empty response."""
    from CofenseTriagev3 import cofense_cluster_list_command

    mocker_http_request.return_value = {}

    args = {"page_size": "2"}

    result = cofense_cluster_list_command(client, args)

    assert result.readable_output == "No cluster(s) were found for the given argument(s)."


@pytest.mark.parametrize("args, err_msg", input_data.list_cluster_cmd_arg)
def test_validate_list_cluster_args_when_invalid_args_are_provided(args, err_msg):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import validate_list_cluster_args

    with pytest.raises(ValueError) as err:
        validate_list_cluster_args(args)
    assert str(err.value) == err_msg


def test_validate_list_cluster_args_when_valid_args_are_provided():
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import validate_list_cluster_args

    # Arguments to be passed
    args = {
        "match_priority": "2",
        "tags": " ",
        "total_reports_count": "15",
        "filter_by": '{"match_priority":"4","tags_any":"clusterTest","total_reports_count":"20"}',
    }
    # Expected response
    params = {"filter[match_priority]": "2", "filter[tags_any]": "clusterTest", "filter[total_reports_count]": "15"}
    assert validate_list_cluster_args(args) == params


@patch(MOCKER_HTTP_METHOD)
def test_get_modified_remote_data(mocker_http_request, client):
    """Test case scenario for successful execution of get-modified-remote-data command"""
    from CofenseTriagev3 import get_modified_remote_data_command

    raw_response = util_load_json(os.path.join("test_data", "fetch_incidents/get_modified_remote_data_command.json"))

    mocker_http_request.return_value = raw_response
    args = {"lastUpdate": "2021-05-17T05:11:51.667Z"}

    command_response = get_modified_remote_data_command(client, args)
    assert command_response.modified_incident_ids == ["4", "6"]


@patch(MOCKER_HTTP_METHOD)
def test_cofense_report_image_download_command_when_valid_response_is_returned(mocker_http_request, client):
    """Test case scenario for successful execution of cofense-report-image-download command."""

    from CofenseTriagev3 import cofense_report_image_download_command

    mocker_http_request.return_value = b"\u2715"

    result = cofense_report_image_download_command(client, args={"id": "4"})
    assert result.get("File") == "Report ID - 4.png"


@pytest.mark.parametrize("args, err_msg", input_data.report_image_download)
def test_cofense_report_image_download_command_when_invalid_args_are_provided(mocked_client, args, err_msg):
    """Test case scenario for failure execution of cofense-report-image-download command."""

    from CofenseTriagev3 import cofense_report_image_download_command

    with pytest.raises(ValueError) as err:
        cofense_report_image_download_command(mocked_client, args)
    assert str(err.value) == err_msg


def test_cofense_report_attachment_payload_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-attachment-payload-list command."""

    from CofenseTriagev3 import cofense_report_attachment_payload_list_command

    response = util_load_json(os.path.join("test_data", "report_attachment_payload/report_attachment_payload_list_response.json"))

    mocked_client.http_request.return_value = response

    context_output = util_load_json(
        os.path.join("test_data", "report_attachment_payload/report_attachment_payload_list_context.json")
    )

    with open(os.path.join("test_data", "report_attachment_payload/report_attachment_payload_list.md")) as f:
        readable_output = f.read()

    # Execute
    args = {"id": "4720", "updated_at": "2020-10-21T20:30:24.185Z"}

    command_response = cofense_report_attachment_payload_list_command(mocked_client, args)
    # Assert
    assert command_response.outputs_prefix == "Cofense.AttachmentPayload"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_report_attachment_payload_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-attachment-payload-list command with an empty
    response."""

    from CofenseTriagev3 import cofense_report_attachment_payload_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No attachment payloads were found for the given argument(s)."

    # Execute
    command_response = cofense_report_attachment_payload_list_command(mocked_client, {"id": "test"})
    # Assert
    assert command_response.readable_output == readable_output


def test_validate_report_attachment_payload_list_args_when_invalid_args_are_provided(mocked_client):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import MESSAGES, cofense_report_attachment_payload_list_command

    args = {
        "id": None,
    }

    with pytest.raises(ValueError) as err:
        cofense_report_attachment_payload_list_command(mocked_client, args)
    assert str(err.value) == MESSAGES["REQUIRED_ARGUMENT"].format("id")


def test_cofense_report_attachment_list_command_when_invalid_args_are_provided(mocked_client):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import MESSAGES, cofense_report_attachment_list_command

    args = {
        "id": None,
    }

    with pytest.raises(ValueError) as err:
        cofense_report_attachment_list_command(mocked_client, args)
    assert str(err.value) == MESSAGES["REQUIRED_ARGUMENT"].format("id")


def test_cofense_report_attachment_list_command_when_empty_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-attachment-list command with an empty
    response."""

    from CofenseTriagev3 import cofense_report_attachment_list_command

    mocked_client.http_request.return_value = {"data": {}}
    readable_output = "No attachments were found for the given argument(s)."

    # Execute
    command_response = cofense_report_attachment_list_command(mocked_client, {"id": "test"})
    # Assert
    assert command_response.readable_output == readable_output


def test_cofense_report_attachment_list_command_when_valid_response_is_returned(mocked_client):
    """Test case scenario for successful execution of cofense-report-attachment-list command."""

    from CofenseTriagev3 import cofense_report_attachment_list_command

    response = util_load_json(
        os.path.join("test_data", os.path.join("report_attachment", "report_attachment_list_response.json"))
    )

    mocked_client.http_request.return_value = response

    context_output = util_load_json(
        os.path.join("test_data", os.path.join("report_attachment", "report_attachment_list_context.json"))
    )

    with open(os.path.join("test_data", os.path.join("report_attachment", "report_attachment_list.md"))) as f:
        readable_output = f.read()

    # Execute
    args = {"id": "30339", "updated_at": "2020-10-21T20:30:24.185Z"}

    command_response = cofense_report_attachment_list_command(mocked_client, args)
    # Assert
    assert command_response.outputs_prefix == "Cofense.Attachment"
    assert command_response.outputs_key_field == "id"
    assert command_response.outputs == context_output
    assert command_response.readable_output == readable_output
    assert command_response.raw_response == response


def test_cofense_report_attachment_download_command_when_invalid_args_are_provided(mocked_client):
    """Test case scenario when the arguments provided are not valid."""

    from CofenseTriagev3 import MESSAGES, cofense_report_attachment_download_command

    args = {
        "id": None,
    }

    with pytest.raises(ValueError) as err:
        cofense_report_attachment_download_command(mocked_client, args)
    assert str(err.value) == MESSAGES["REQUIRED_ARGUMENT"].format("id")


def test_cofense_report_attachment_download_command_when_valid_args_are_provided(mocked_client):
    """Test case scenario when the arguments provided are valid."""

    from CofenseTriagev3 import cofense_report_attachment_download_command

    with open(os.path.join("test_data", os.path.join("report_attachment", "report_attachment_download_response.xml"))) as f:
        response = f.read()

    # Mock response with the valid headers.
    class MockResponse:
        content = response
        headers = {"Content-Disposition": """attachment; filename="xl%2FordStrings.xml"; filename*=UTF-8''xl%2FordStrings.xml"""}

    mocked_client.http_request.return_value = MockResponse

    args = {"id": "30339"}
    command_response = cofense_report_attachment_download_command(mocked_client, args)

    # Assert for file name based on the header.
    assert command_response["File"] == "xl/ordStrings.xml"

    # Mock response with empty headers
    MockResponse.headers = {}

    mocked_client.http_request.return_value = MockResponse

    args = {"id": "30339"}
    command_response = cofense_report_attachment_download_command(mocked_client, args)

    # Assert for file name based on the attachment ID.
    assert command_response["File"] == "Attachment ID - 30339"