Cortex Core

Details

ID	`Cortex Core - IOC`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/google-cloud-storage:1.0.0.10120494`
Supported Modules	Exposure Management Cortex Cloud Cloud Runtime Security Agentix Cloud Posture Security XSIAM EDR

README

The Cortex Core - IOCs integration uses the Cortex API for detection and response, by natively integrating network, endpoint, and cloud data to stop sophisticated attacks.

Configure Indicators detection

Parameter	Description	Required
Cortex XDR Severity	Map the severity of each indicator that will be synced to Cortex.	True
Tags	Supports CSV values.	False
Sync Query	The query used to collect indicators to sync from Cortex.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

core-iocs-sync

Sync your IOC with Cortex and delete the previous version.

Base Command

core-iocs-sync

Input

Argument Name	Description	Required
firstTime	For first sync, set to true. (do NOT run this twice!). Possible values are: true, false. Default is false.	Optional

Context Output

There is no context output for this command.

core-iocs-push

Push modified IOCs to Cortex.

Base Command

core-iocs-push

Input

Argument Name	Description	Required
indicator	IOCs to push. leave empty to push all recently modified IOCs.the indicators.	Optional

Context Output

There is no context output for this command.

Command example

!core-iocs-push indicator='test.com'

Human Readable Output

push done.

core-iocs-set-sync-time

Set sync time manually (Do not use this command unless you unredstandard the consequences).

Base Command

core-iocs-set-sync-time

Input

Argument Name	Description	Required
time	The time of the file creation (use UTC time zone).	Required

Context Output

There is no context output for this command.

core-iocs-create-sync-file

Creates the sync file for the manual process. Run this command when instructed by the Cortex support team.

Base Command

core-iocs-create-sync-file

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

core-iocs-enable

Enables IOCs in the Cortex tenant.

Note: This command applies only to TIM-managed indicators (indicators that were synced/pushed to the Cortex tenant by this integration). Enabling an indicator not managed by TIM has no effect.

Base Command

core-iocs-enable

Input

Argument Name	Description	Required
indicator	The indicator to enable. Only TIM-managed indicators can be enabled; indicators from other sources are not affected.	Required

Context Output

There is no context output for this command.

Command example

!core-iocs-enable indicator=1.1.1.1

Human Readable Output

indicators 1.1.1.1 enabled.

core-iocs-disable

Disables IOCs in the Cortex tenant.

Note: This command applies only to TIM-managed indicators (indicators that were synced/pushed to the Cortex tenant by this integration). Disabling an indicator not managed by TIM has no effect.

Base Command

core-iocs-disable

Input

Argument Name	Description	Required
indicator	The indicator to disable. Only TIM-managed indicators can be disabled; indicators from other sources are not affected.	Required

Context Output

There is no context output for this command.

Command example

!core-iocs-disable indicator=22.22.22.22

Human Readable Output

indicators 22.22.22.22 disabled.

Configuration parameters

url — Server URL (e.g. https://example.net)
apikey_id — API Key ID
apikey — API Key
severity — Cortex Severity
query — Sync Query

Commands (6)

core-iocs-create-sync-file
Creates the sync file for the manual process. Run this command when instructed by the Cortex support team.
core-iocs-disable
Disables IOCs in the Cortex server. Applies only to TIM-managed indicators (indicators synced/pushed by this integration); indicators from other sources are not affected.
core-iocs-enable
Enables IOCs in the Cortex tenant. Applies only to TIM-managed indicators (indicators synced/pushed by this integration); indicators from other sources are not affected.
core-iocs-push
Push modified IOCs to Cortex.
core-iocs-set-sync-time
Set sync time manually (Do not use this command unless you unredstandard the consequences).
core-iocs-sync
Sync your IOC with Cortex and delete the previous version.

Source

CoreIOCs.py CoreIOCs_test.py CoreIOCs.yml CoreIOCs_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: Cortex Core - IOC
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL (e.g. https://example.net)
  name: url
  type: 0
  hidden: true
  required: false
  section: Connect
- display: API Key ID
  name: apikey_id
  type: 4
  hidden: true
  required: false
  section: Connect
- display: API Key
  name: apikey
  type: 4
  hidden: true
  required: false
  section: Connect
- additionalinfo: Map the severity of each indicator that will be synced to Cortex.
  display: Cortex Severity
  name: severity
  options:
  - info
  - low
  - medium
  - high
  required: false
  defaultvalue: low
  type: 15
  section: Connect
- additionalinfo: The query used to collect indicators to sync from Cortex.
  defaultvalue: reputation:Bad and (type:File or type:Domain or type:IP)
  display: Sync Query
  name: query
  required: false
  type: 0
  section: Collect
description: The Cortex Core - IOCs integration uses the Cortex API for detection and response, by natively integrating network, endpoint, and cloud data to stop sophisticated attacks.
display: Indicators detection
name: Cortex Core - IOC
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      default: true
      defaultValue: 'false'
      description: |-
        For first sync, set to true.
        (do NOT run this twice!).
      name: firstTime
      predefined:
      - 'true'
      - 'false'
    description: Sync your IOC with Cortex and delete the previous version.
    name: core-iocs-sync
  - arguments:
    - description: IOCs to push. leave empty to push all recently modified IOCs.the indicators.
      isArray: true
      name: indicator
    description: Push modified IOCs to Cortex.
    name: core-iocs-push
  - arguments:
    - description: The time of the file creation (use UTC time zone).
      name: time
      required: true
    description: Set sync time manually (Do not use this command unless you unredstandard the consequences).
    name: core-iocs-set-sync-time
  - description: Creates the sync file for the manual process. Run this command when instructed by the Cortex support team.
    name: core-iocs-create-sync-file
  - arguments:
    - description: The indicator to enable. Only indicators managed by TIM (indicators that were synced/pushed to the Cortex tenant by this integration) can be enabled. Indicators created in the tenant, via the API, or by other sources are not affected.
      isArray: true
      name: indicator
      required: true
    description: Enables IOCs in the Cortex tenant. Applies only to TIM-managed indicators (indicators synced/pushed by this integration); indicators from other sources are not affected.
    name: core-iocs-enable
  - arguments:
    - description: The indicator to disable. Only indicators managed by TIM (indicators that were synced/pushed to the Cortex server by this integration) can be disabled. Indicators created in the UI, via the API, or by other sources are not affected.
      isArray: true
      name: indicator
      required: true
    description: Disables IOCs in the Cortex server. Applies only to TIM-managed indicators (indicators synced/pushed by this integration); indicators from other sources are not affected.
    name: core-iocs-disable
  dockerimage: demisto/google-cloud-storage:1.0.0.10120494
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.5.0
defaultEnabled: true
supportedModules:
- xsiam
- cloud
- cloud_posture
- cloud_runtime_security
- edr