CyCognito

The CyCognito integration fetches issues discovered by the CyCognito platform, thereby providing users with a view of their organization's internet-exposed attack surface. These issues include identification, prioritization, and recommendations for remediation of the risks faced by the organization. The integration contains commands to query assets and issues detected by the CyCognito platform, and includes a rich dashboard and layout with issue management capability.

Vulnerability Management · CyCognito

Details

IDCyCognito
ProviderCyCognito
CategoryVulnerability Management
From Version6.2.0
Docker Imagedemisto/pycountry:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

The CyCognito integration fetches issues discovered by the CyCognito platform, thereby providing users with a view of their organization’s internet-exposed attack surface. These issues include identification, prioritization, and recommendations for remediation of the risks faced by the organization. The integration contains commands to query assets and issues detected by the CyCognito platform, and includes a rich dashboard and layout with issue management capability.
This integration was integrated and tested with CyCognito V1 API.

Configure CyCognito in Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for CyCognito.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
API Key The API Key required to authenticate to the service. True
Region Select the region based on the location of the CyCognito instance. If the region is not listed in the dropdown, choose the “Other” option and specify the region in the “Other Region” text field. False
Other Region Specify the region based on the location of the CyCognito instance. Only applicable if the “Other” option is selected in the Region dropdown. False
Incident type Incident type to map if no classifier is provided. False
Incident Mirroring Direction The mirroring direction in which to mirror the incident. You can mirror only in (from CyCognito to XSOAR), out (from XSOAR to CyCognito), or in both directions. False
Fetch incidents Indicates whether to fetch incident from the instance. False
First Fetch Time The date or relative timestamp from which to begin fetching incidents.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 False
Max Fetch The maximum number of incidents to fetch every time. The maximum value is ‘1000’. False
Issue Type The type of issue to fetch. By default, all types of issues will be fetched. Multiple selection is supported. False
Locations Filters incidents according to the geographic locations in which the issue is found. Multiple selection is supported. False
Severity The severity levels of the issues to fetch from CyCognito. By default, all the severity levels will be fetched, Multiple selection is supported. False
Investigation Status The investigation status of the issues to fetch from CyCognito. By default, it fetches uninvestigated issues. False
Advanced Filter Applies a filter to the list of issues based on a JSON-specific query.

Format:
[{
“field”: “issue-type”,
“op”: “in”,
“values”: [
“Unsafe Authentication”,
“Vulnerable Software”
]
},
{
“op”: “not-in”,
“field”: “severity-score”,
“values”: [10, 9]
}]

Note: When using several filtering options (e.g., ‘Issue Type’ and ‘Advanced Filter’), Advanced Filter parameters will take precedence over other parameters.
For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at
https://docs.cycognito.com/reference/query-issues		 False
Trust any certificate (not secure) Indicates whether to allow connections without verifying SSL certificate’s validity. False
Use system proxy settings Indicates whether to use XSOAR’s system proxy settings to connect to the API. False
Incidents Fetch Interval Time interval for fetching incidents. False
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cycognito-issue-get

Retrieves information about an issue associated with a particular instance based on the provided issue instance ID.

Base Command

cycognito-issue-get

Input

Argument Name Description Required
issue_instance_id Unique issue ID of the instance.

Example: 0.0.0.0-cyc-auth-default-credentials,
example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

Note: Users can retrieve the list of issue instance IDs by executing the “cycognito-issues-list” command.		 Required

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.references Unknown Issue reference.
CyCognito.Issue.potential_threat String The threat that the issue might cause.
CyCognito.Issue.tags Unknown Tags of the issue.
CyCognito.Issue.organizations Unknown Organizations of the instance.
CyCognito.Issue.issue_id String Unique ID of the issue.
CyCognito.Issue.summary String A brief description that summarizes the issue.
CyCognito.Issue.resolved_at String Date/time when the issue was resolved.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.locations Unknown The geographic location of the instance.
CyCognito.Issue.detection_complexity String Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
CyCognito.Issue.title String Title of the issue.
CyCognito.Issue.exploitation_score Number Exploitation score of the issue.
CyCognito.Issue.issue_type String Type of the issue.
CyCognito.Issue.comment String Comment associated with the issue.
CyCognito.Issue.severity String Severity of the issue.
CyCognito.Issue.remediation_steps Unknown A list of actions that describe how to resolve the issue.
CyCognito.Issue.potential_impact Unknown A list of categories that describe what might happen if the issue is exploited.
CyCognito.Issue.exploitation_method String Exploitation method of the issue.
CyCognito.Issue.affected_asset String The unique ID of the asset with which the issue is associated.
CyCognito.Issue.severity_score Number The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
CyCognito.Issue.last_detected Date The time at which the issue was last detected.
CyCognito.Issue.first_detected Date The time at which the issue was first detected.
CyCognito.Issue.issue_status String Status of the issue found.
CyCognito.Issue.evidence Unknown Provides a reason or proof of why the issue was indeed detected by CyCognito.

Command example

!cycognito-issue-get issue_instance_id=127.0.0.1-cve-2019-00000

Context Example

{
    "CyCognito": {
        "Issue": {
            "affected_asset": "ip/127.0.0.1",
            "detection_complexity": "Service Detection",
            "exploitation_method": "Metasploit",
            "exploitation_score": 3,
            "first_detected": "2022-03-31T03:39:22.568Z",
            "id": "127.0.0.1-cve-2019-00000",
            "investigation_status": "investigating",
            "issue_id": "CVE-2019-00000",
            "issue_status": "new",
            "issue_type": "Vulnerable Software",
            "last_detected": "2022-03-31T03:39:22.568Z",
            "locations": [
                "IND"
            ],
            "organizations": [
                "Acme Interior Design",
                "Acme Corporation"
            ],
            "potential_impact": [
                "Loss of integrity",
                "Loss of confidentiality",
                "Data compromise"
            ],
            "references": [],
            "remediation_steps": [
                "Patch the Pulse Secure VPN to the latest version."
            ],
            "severity": "critical",
            "severity_score": 10,
            "summary": "| The Pulse Secure VPN has been confirmed to be vulnerable to an arbitrary file reading vulnerability. | Unauthenticated remote attackers can send the asset a specially crafted URI and thereby access arbitrary sensitive files. | Attackers can leverage the harvested information to perform further attacks.",
            "tags": [
                "Vulnerable Software",
                "Pulse Secure",
                "network vulnerabilities"
            ],
            "potential_threat": "Information Disclosure",
            "title": "Pulse Secure Arbitrary File Reading"
        }
    }
}

Human Readable Output

Issue detail

ID: 127.0.0.1-test

Title Affected Asset Detection Complexity Investigation Status Exploitation Score First Detected Last Detected Organizations Locations Potential Threat Severity Issue Type Issue Status Remediation Steps Potential Impact Tags Summary Link to Platform
Pulse Secure Arbitrary File Reading ip/127.0.0.1 Service Detection investigating 3 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM Acme Interior Design, Acme Corporation India Information Disclosure critical Vulnerable Software new Patch the Pulse Secure VPN to the latest version. Loss of integrity, Loss of confidentiality, Data compromise Vulnerable Software, Pulse Secure, network vulnerabilities The Pulse Secure VPN has been confirmed to be vulnerable to an arbitrary file reading vulnerability. Unauthenticated remote attackers can send the asset a specially crafted URI and thereby access arbitrary sensitive files. Attackers can leverage the harvested information to perform further attacks. Click Here

cycognito-asset-get

Retrieves information about a specific asset according to the specified asset type and asset ID.

Base Command

cycognito-asset-get

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
asset_id The unique asset identifier.

Note: The asset ID value can be found by executing the “cycognito-assets-list” command.		 Required

Context Output

Path Type Description
CyCognito.Asset.alive Boolean Whether the port is alive or not.
CyCognito.Asset.comment String Comment associated with the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: The asset ID is derived from the asset_id input field.
CyCognito.Asset.type String The type of asset.
CyCognito.Asset.business_units Unknown The business units of the asset.
CyCognito.Asset.signature String The identifier of the certificate.
CyCognito.Asset.closed_ports.status String Status of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.port Number Port of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.created Date Creation time of the asset.
CyCognito.Asset.domain String Domain of the asset.
CyCognito.Asset.domains Unknown List of domains associated with the asset.
CyCognito.Asset.domain_names Unknown List of domain names associated with the asset.
CyCognito.Asset.expiration Date The date and time at which the asset expires.
CyCognito.Asset.first_seen Date The time and date at which the asset was first discovered.
CyCognito.Asset.hosting_type String Hosting type of the asset.
CyCognito.Asset.ip String IP address of the asset.
CyCognito.Asset.ip_addresses Unknown IP name of the asset.
CyCognito.Asset.issuer_alt_names Unknown List of alternative names of the issuers.
CyCognito.Asset.issuer_common_name String Common name of the Issuer.
CyCognito.Asset.issuer_country String Country of the issuer.
CyCognito.Asset.issuer_locality String Locality of the issuer.
CyCognito.Asset.issuer_organization String The issuer’s organization.
CyCognito.Asset.issuer_organization_unit String The issuer’s organization unit.
CyCognito.Asset.issuer_state String The state of the issuer.
CyCognito.Asset.issues_count Number Count of the issues.
CyCognito.Asset.last_seen Date The time and date at which the asset was last seen.
CyCognito.Asset.locations Unknown Location of the asset.
CyCognito.Asset.open_ports.status String Status of the open ports object associated with the asset.
CyCognito.Asset.open_ports.port Number Port of the open ports object associated with the asset.
CyCognito.Asset.open_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.organizations Unknown Organizations of the asset.
CyCognito.Asset.status String Status of the asset.
CyCognito.Asset.security_grade String Security rating of the asset.
CyCognito.Asset.severe_issues Number The number of severe issues associated with the asset.
CyCognito.Asset.signature_algorithm String Signature algorithm of the asset.
CyCognito.Asset.sub_domains Unknown Subdomains of the asset.
CyCognito.Asset.subject_alt_names Unknown List of alternate subject names.
CyCognito.Asset.subject_common_name String Common name of the subject.
CyCognito.Asset.subject_country String Subject’s country.
CyCognito.Asset.subject_locality String Locality of the subject.
CyCognito.Asset.subject_organization String Subject’s Organization.
CyCognito.Asset.subject_organization_unit String The organization unit of the subject.
CyCognito.Asset.subject_state String State of the subject.
CyCognito.Asset.tags Unknown Tags of the asset.
CyCognito.Asset.dynamically_resolved String Whether the asset has a rotating IP address.
CyCognito.Asset.investigation_status String Investigation status of the asset.
CyCognito.Asset.discoverability String Quantifies an asset’s level of exposure.

Command example

!cycognito-asset-get asset_type=ip asset_id=127.0.0.1

Context Example

{
    "CyCognito": {
        "Asset": {
            "alive": true,
            "closed_ports": [
                {
                    "port": 8080,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 102,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 445,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 161,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 4040,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 7070,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 1723,
                    "protocol": "tcp",
                    "status": "closed"
                }
            ],
            "comment": {
                "content": "A grade",
                "last_update": "2022-05-06T05:19:05.931Z"
            },
            "dynamically_resolved": "no",
            "first_seen": "2022-01-20T03:58:36.696Z",
            "hosting_type": "owned",
            "id": "127.0.0.1",
            "investigation_status": "investigated",
            "ip": "127.0.0.1",
            "issues_count": 1,
            "last_seen": "2022-03-31T03:39:22.568Z",
            "locations": [
                "IND"
            ],
            "open_ports": [
                {
                    "port": 9999,
                    "protocol": "tcp",
                    "status": "open"
                },
                {
                    "port": 2000,
                    "protocol": "tcp",
                    "status": "open"
                }
            ],
            "organizations": [
                "Acme Interior Design",
                "Acme Corporation"
            ],
            "security_grade": "B",
            "severe_issues": 0,
            "status": "new",
            "tags": [
                "Gateways",
                "ACME"
            ],
            "type": "ip"
        }
    }
}

Human Readable Output

Asset Details

Asset ID Asset Type Hosting Type Alive Locations First Seen Last Seen Status Security Grade Tags Organizations Severe Issues Investigation Status Open Ports
127.0.0.1 ip owned true India 20 Jan 2022, 03:58 AM 31 Mar 2022, 03:39 AM new B Gateways,
ACME		 Acme Interior Design, Acme Corporation 0 investigated TCP - 9999, TCP - 2000

cycognito-asset-investigation-status-change

Modifies the investigation status of the specified asset.

Base Command

cycognito-asset-investigation-status-change

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
asset_id The unique asset identifier.

Note: The asset ID value can be found by executing the “cycognito-assets-list” command.		 Required
investigation_status The investigation status of the asset.

Supported values: ‘uninvestigated’, ‘investigating’, ‘investigated’.		 Required

Context Output

Path Type Description
CyCognito.Asset.type String The type of the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: The asset ID is derived from the asset_ID input field.
CyCognito.Asset.investigation_status String Investigation status of the Asset.
CyCognito.Asset.action_status String Whether the status update is successful or failed.

Command example

!cycognito-asset-investigation-status-change asset_type=ip asset_id=127.0.0.1 investigation_status=investigated

Context Example

{
    "CyCognito": {
        "Asset": {
            "action_status": "Success",
            "asset_type": "ip",
            "id": "127.0.0.1",
            "investigation_status": "investigated"
        }
    }
}

Human Readable Output

Investigation Status has been successfully updated for 127.0.0.1

Asset Type Asset ID Investigation Status Action Status
ip 127.0.0.1 investigated Success

cycognito-issue-investigation-status-change

Modifies the investigation status of the specified issue.

Base Command

cycognito-issue-investigation-status-change

Input

Argument Name Description Required
issue_instance_id The unique issue ID of the instance whose investigation status is to be changed.

Example: 0.0.0.0-cyc-auth-default-credentials,
example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

Note: Users can retrieve the list of issue instance IDs by executing the “cycognito-issues-list” command.		 Required
investigation_status The investigation status of the issue.

Supported values: ‘uninvestigated’, ‘investigating’, ‘investigated’		 Required

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.action_status String Whether the update is successful or failed.

Command example

!cycognito-issue-investigation-status-change issue_instance_id=127.0.0.1-cve-2019-00000 investigation_status=investigated

Context Example

{
    "CyCognito": {
        "Issue": {
            "action_status": "Success",
            "id": "127.0.0.1-cve-2019-00000",
            "investigation_status": "investigated"
        }
    }
}

Human Readable Output

Investigation Status has been successfully updated for 127.0.0.1-cve-2019-00000

Issue ID Investigation Status Action Status
127.0.0.1-cve-2019-00000 investigated Success

cycognito-issues-list

Retrieves the list of the issues that meet the specified filter criteria.

Base Command

cycognito-issues-list

Input

Argument Name Description Required
count The number of results to retrieve.

Maximum value is ‘1000’. Default is 50.		 Optional
offset Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

Note: If a negative value is provided then the default value of 0 will be used. Default is 0.		 Optional
search An Advanced Search parameter to query the response.

Note: Retrieves all the occurrences that are included in the string.		 Optional
first_detected The date and time at which CyCognito first discovered and attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
last_detected The date and time at which CyCognito most recently attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
organizations Filters the issues according to the provided organizations. Supports comma-separated values. Optional
locations The geographical locations in which the issue is found. Supported values contain the three-letter ISO country code for the respective countries–e.g., IND, USA. Optional
issue_type Filters the records according to the issue type. Supports comma-separated values.

Supported values: “Abandoned Asset”, “Certificate Validity”, “Cryptographic Vulnerability”, “E-mail Security”, “Exposed Asset”, “Exposed Data”, “Exposed Dev Environment”, “Information Gathering”, “Phishing Threat”, “Potential Imposter Asset”, “Security Hygiene”, “Unmaintained Asset”, “Unsafe Authentication”, “Vulnerable Software”, “Weak Encryption”, “XSS”		 Optional
sort_by The name of the field by which to sort the results. The response fields available for sorting the data are found in the following documentation:
https://docs.cycognito.com/reference/reference-getting-started.		 Optional
sort_order Specifies whether to sort the results in either ascending or descending order.

Supported values: ‘asc’, ‘desc’		 Optional
advanced_filter Applies a filter to the list of issues based on a JSON-specific query.

Format:
[{
“field”: “issue-type”,
“op”: “in”,
“values”: [
“Unsafe Authentication”,
“Vulnerable Software”
]
},
{
“op”: “not-in”,
“field”: “severity-score”,
“values”: [10, 9]
}]

Note: When using several filtering options (e.g., ‘Issue Type’ and ‘Advanced Filter’), advance_json parameters will take precedence over other parameters.
For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at
https://docs.cycognito.com/reference/query-issues.		 Optional

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.references Unknown Reference of the issue.
CyCognito.Issue.potential_threat String The threat that the issue might cause.
CyCognito.Issue.tags Unknown Tags of the issue.
CyCognito.Issue.organizations Unknown Organizations of the instance.
CyCognito.Issue.issue_id String Unique ID of the issue.
CyCognito.Issue.summary String A brief description that summarizes the issue.
CyCognito.Issue.resolved_at String Date/time when the issue was resolved.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.locations Unknown The geographic location of the instance.
CyCognito.Issue.detection_complexity String Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
CyCognito.Issue.title String Title of the issue.
CyCognito.Issue.exploitation_score Number Exploitation score of the issue.
CyCognito.Issue.issue_type String Type of the issue.
CyCognito.Issue.comment String Comment associated with the issue.
CyCognito.Issue.severity String Severity of the issue.
CyCognito.Issue.remediation_steps Unknown A list of actions that describe how to resolve the issue.
CyCognito.Issue.potential_impact Unknown A list of categories that describe what might happen if the issue is exploited.
CyCognito.Issue.exploitation_method String Exploitation method of the issue.
CyCognito.Issue.affected_asset String The unique ID of the asset with which the issue is associated.
CyCognito.Issue.severity_score Number The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
CyCognito.Issue.last_detected Date The time at which the issue was last detected.
CyCognito.Issue.first_detected Date The time at which the issue was first detected.
CyCognito.Issue.issue_status String Status of the issue found.
CyCognito.Issue.evidence Unknown Provides a reason or proof of why the issue was indeed detected by CyCognito.

Command example

!cycognito-issues-list count=2

Context Example

{
    "CyCognito": {
        "Issue": [
            {
                "affected_asset": "ip/127.0.0.1",
                "detection_complexity": "Service Detection",
                "exploitation_method": "Metasploit",
                "exploitation_score": 3,
                "first_detected": "2022-03-31T03:39:22.568Z",
                "id": "issue/127.0.0.1-cve-2019-00000",
                "investigation_status": "investigating",
                "issue_id": "CVE-2019-00000",
                "issue_status": "new",
                "issue_type": "Vulnerable Software",
                "last_detected": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "USA"
                ],
                "organizations": [
                    "ACME Ticketing",
                    "ACME Cleantech Solutions",
                    "Acme Holdings"
                ],
                "potential_impact": [
                    "Loss of integrity",
                    "Loss of confidentiality",
                    "Loss of availability",
                    "Data compromise",
                    "Network breach"
                ],
                "references": [],
                "remediation_steps": [
                    "Patch the NetScaler to the latest version.",
                    "If a patch is not feasible, perform \"work-around\" mitigations per Citrix's instructions."
                ],
                "severity": "critical",
                "severity_score": 10,
                "summary": "| The NetScaler has been confirmed to be vulnerable to CVE-2019-00000 (first made public in December 2019). | Due to improper handling of the path names, CVE-2019-00000 enables attackers to perform directory traversal and unauthenticated, remote arbitrary code execution via specially crafted HTTP requests. | As NetScalers serve as entry-points to organization networks, attackers can exploit this vulnerability to breach organization networks and leverage the NetScaler for further attacks. | This vulnerability has been exploited \"in the wild\" by unknown attackers.",
                "tags": [
                    "Pulse Secure"
                ],
                "potential_threat": "Remote Code Execution",
                "title": "CVE-2019-00000 (Unauthenticated Remote Directory Traversal & Code Execution)"
            },
            {
                "affected_asset": "ip/127.0.0.2",
                "comment": {
                    "content": "hello",
                    "last_update": "2022-06-14T06:42:20.952Z"
                },
                "detection_complexity": "Handshake",
                "exploitation_method": "Man-in-the-Middle",
                "exploitation_score": 4,
                "first_detected": "2022-03-20T18:48:33.528Z",
                "id": "issue/127.0.0.2-cyc-tls-hsts-dummy",
                "investigation_status": "investigating",
                "issue_id": "CYC-TLS-HSTS-DUMMY",
                "issue_status": "new",
                "issue_type": "Cryptographic Vulnerability",
                "last_detected": "2022-03-20T18:48:33.528Z",
                "locations": [
                    "USA"
                ],
                "organizations": [
                    "Acme Homes"
                ],
                "potential_impact": [
                    "Loss of integrity",
                    "Loss of confidentiality"
                ],
                "remediation_steps": [
                    "Enable an HSTS policy of at least 180 days."
                ],
                "severity": "critical",
                "severity_score": 10,
                "summary": "The server's HSTS policy is either too short or non-existent. | HTTP Strict Transport Security is an optional HTTP header that instructs browsers to only communicate with the server using HTTPS (and not HTTP) for a certain period of time, thus helping prevent \"SSL-stripping\" attacks.",
                "potential_threat": "Trust",
                "title": "Insecure HSTS"
            }
        ]
    }
}

Human Readable Output

Issues

ID Title Severity Score Severity Issue Type Issue Status Organizations Investigation Status First Detected Last Detected Locations
127.0.0.1-cve-2019-00000 Pulse Secure Arbitrary File Reading 10.0 critical Vulnerable Software new Acme Interior Design, Acme Corporation investigating 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM India
127.0.0.2-cve-2019-00000 CVE-2019-00000 (Unauthenticated Remote Directory Traversal & Code Execution) 10.0 critical Vulnerable Software new ACME Ticketing, ACME Cleantech Solutions, Acme Holdings uninvestigated 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM United States

cycognito-assets-list

Retrieves the list of assets that meet specified filter criteria.

Base Command

cycognito-assets-list

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
count The number of results to be retrieved in a response.

Maximum value is ‘1000’. Default is 50.		 Optional
offset Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

Note: If a negative value is provided then the default value of 0 will be used. Default is 0.		 Optional
search An Advanced Search parameter to query the response.

Note: Retrieves all the occurrences that are included in the string.		 Optional
status Filters the assets according to the selected status. Supports comma-separated values.

Supported values: ‘changed’, ‘new’, ‘normal’		 Optional
organizations Filters the assets according to the provided organizations. Supports comma-separated values. Optional
security_grade Filters the assets according to the provided security ratings. Supports comma-separated values.

Supported values: ‘A’, ‘B’, ‘C’, ‘D’, ‘F’

Where:
A = Very strong
B = Strong
C = Less vulnerable
D = Vulnerable
F = Highly vulnerable		 Optional
locations The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries’e.g., IND, USA.
Locations are available only for IP, Domain, and Certificate asset types.		 Optional
first_seen The date and time at which CyCognito first discovered and attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
last_seen The date and time at which CyCognito most recently attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
sort_by Specifies the field by which to sort.

Note: The response fields available for sorting the data are found in the following documentation:
https://docs.cycognito.com/reference/query-assets.		 Optional
sort_order Specifies whether to sort the results in either ascending or descending order.

Supported values: ‘asc’, ‘desc’. Default is desc.		 Optional
advanced_filter Applies a filter to the list of assets based on a JSON-specific query.

Format:
[{
“field”: “status”,
“op”: “in”,
“values”: [
“new”,
“changed”
]
},
{
“op”: “not-in”,
“field”: “security-rating”,
“values”: [“A”]
}]

Note: For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at https://docs.cycognito.com/reference/query-assets.		 Optional

Context Output

Path Type Description
CyCognito.Asset.alive Boolean Whether the port is alive or not.
CyCognito.Asset.comment String Comments related to the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: Asset ID is derived from the asset_id input field.
CyCognito.Asset.type String Type of the asset.
CyCognito.Asset.business_units Unknown Business units of the asset.
CyCognito.Asset.signature String The identifier of the certificate.
CyCognito.Asset.closed_ports.status String Status of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.port Number Port of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.created Date Date and time at which the asset was created.
CyCognito.Asset.domain String Domain name of the asset.
CyCognito.Asset.domains Unknown Domain of the asset.
CyCognito.Asset.domain_names Unknown List of domain names associated with the asset.
CyCognito.Asset.expiration Date Date and time at which the asset is expired.
CyCognito.Asset.first_seen Date Time at which an asset was first discovered and attributed to the organization.
CyCognito.Asset.hosting_type String Hosting type of the asset.
CyCognito.Asset.investigation_status String Investigation status of the asset.
CyCognito.Asset.ip String IP of the asset.
CyCognito.Asset.ip_addresses Unknown List of IP associated with the asset.
CyCognito.Asset.issuer_alt_names Unknown List of alternate issuer names.
CyCognito.Asset.issuer_common_name String Common name of the Issuer.
CyCognito.Asset.issuer_country String Country of Issuer.
CyCognito.Asset.issuer_locality String Locality of issuer.
CyCognito.Asset.issuer_organization String Organization of the issuer.
CyCognito.Asset.issuer_organization_unit String The organization unit of the issuer.
CyCognito.Asset.issuer_state String State of the issuer.
CyCognito.Asset.issues_count Number Count of issues associated with the asset.
CyCognito.Asset.last_seen Date Time at which an asset was discovered and attributed to the organization.
CyCognito.Asset.locations Unknown List of geographic locations with which an asset might be associated.
CyCognito.Asset.open_ports.status String Status of the open ports object associated with the asset.
CyCognito.Asset.open_ports.port Number Port of the open ports object associated with the asset.
CyCognito.Asset.open_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.organizations Unknown List of organizations associated with the asset.
CyCognito.Asset.status String Last status of the asset.
CyCognito.Asset.security_grade String Security rating of the asset based on the number and severity of the associated issues.
CyCognito.Asset.severe_issues Number The number of severe issues associated with the asset.
CyCognito.Asset.signature_algorithm String Signature algorithm associated with the asset.
CyCognito.Asset.sub_domains Unknown List of subdomains associated with the asset.
CyCognito.Asset.subject_alt_names Unknown List of alternate subject names.
CyCognito.Asset.subject_common_name String Common name of the subject.
CyCognito.Asset.subject_country String Subject’s country.
CyCognito.Asset.subject_locality String Locality of the subject.
CyCognito.Asset.subject_organization String Subject’s organization.
CyCognito.Asset.subject_organization_unit String The organization unit of the subject.
CyCognito.Asset.subject_state String State of the subject.
CyCognito.Asset.tags Unknown List of tags associated with the asset.
CyCognito.Asset.dynamically_resolved String Whether the asset has a rotating IP address.
CyCognito.Asset.discoverability String Quantifies an asset’s level of exposure.

Command example

!cycognito-assets-list asset_type=ip count=2

Context Example

{
    "CyCognito": {
        "Asset": [
            {
                "alive": true,
                "closed_ports": [
                    {
                        "port": 6001,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 47808,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 5900,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 111,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 9200,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 11211,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 1723,
                        "protocol": "tcp",
                        "status": "closed"
                    }
                ],
                "dynamically_resolved": "no",
                "first_seen": "2022-03-23T12:36:17.808Z",
                "hosting_type": "owned",
                "id": "ip/127.0.0.1",
                "investigation_status": "investigated",
                "ip": "127.0.0.1",
                "issues_count": 1,
                "last_seen": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "MYS"
                ],
                "open_ports": [
                    {
                        "port": 465,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 993,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 80,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 53,
                        "protocol": "udp",
                        "status": "open"
                    }
                ],
                "organizations": [
                    "Acme Corporation"
                ],
                "security_grade": "F",
                "severe_issues": 1,
                "status": "new",
                "tags": [
                    "Vulnerable Software",
                    "Red Hat"
                ],
                "type": "ip"
            },
            {
                "alive": true,
                "closed_ports": [
                    {
                        "port": 3389,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 8888,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 110,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 548,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 23,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 11211,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 1723,
                        "protocol": "tcp",
                        "status": "closed"
                    }
                ],
                "dynamically_resolved": "no",
                "first_seen": "2022-03-23T12:27:04.354Z",
                "hosting_type": "owned",
                "id": "ip/127.0.0.2",
                "investigation_status": "investigated",
                "ip": "127.0.0.2",
                "issues_count": 2,
                "last_seen": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "MYS"
                ],
                "open_ports": [
                    {
                        "port": 587,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 21,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 22,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 465,
                        "protocol": "tcp",
                        "status": "open"
                    }
                ],
                "organizations": [
                    "Acme Corporation"
                ],
                "security_grade": "F",
                "severe_issues": 1,
                "status": "new",
                "tags": [
                    "Block Cipher"
                ],
                "type": "ip"
            }
        ]
    }
}

Human Readable Output

Asset List

Assets Type: IP

Asset ID Security Grade Status Organizations Investigation Status Severe Issues First Seen Last Seen Hosting Type Locations
127.0.0.1 F new Acme Corporation investigated 1 23 Mar 2022, 12:27 PM 31 Mar 2022, 03:39 AM owned Malaysia
127.0.0.2 F new Acme Corporation investigated 1 23 Mar 2022, 12:27 PM 31 Mar 2022, 03:39 AM owned Malaysia

Configuration parameters

  • api_key — API Key (required)
  • region — Region
  • other_region — Other Region
  • incidentType — Incident type
  • mirror_direction — Incident Mirroring Direction
  • isFetch — Fetch incidents
  • first_fetch — First Fetch Time
  • max_fetch — Max Fetch
  • issue_type — Issue Type
  • locations — Locations
  • severity_filter — Severity
  • investigation_status — Investigation Status
  • advanced_filter — Advanced Filter
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (6)

  • cycognito-asset-get

    Retrieves information about a specific asset according to the specified asset type and asset ID.

  • cycognito-asset-investigation-status-change

    Modifies the investigation status of the specified asset.

  • cycognito-assets-list

    Retrieves the list of assets that meet specified filter criteria.

  • cycognito-issue-get

    Retrieves information about an issue associated with a particular instance based on the provided issue instance ID.

  • cycognito-issue-investigation-status-change

    Modifies the investigation status of the specified issue.

  • cycognito-issues-list

    Retrieves the list of the issues that meet the specified filter criteria.

Source

CyCognito.py CyCognito_test.py CyCognito.yml CyCognito_description.md
Download History Raw 
category: Vulnerability Management
provider: CyCognito
sectionorder:
- Connect
- Collect
commonfields:
  id: CyCognito
  version: -1
configuration:
- additionalinfo: The API Key required to authenticate to the service.
  display: API Key
  name: api_key
  required: true
  type: 4
  section: Connect
- additionalinfo: Select the region based on the location of the CyCognito instance. If the region is not listed in the dropdown, choose the "Other" option and specify the region in the "Other Region" text field.
  defaultvalue: General
  display: Region
  name: region
  options:
  - General
  - US
  - Other
  type: 15
  required: false
  section: Connect
- additionalinfo: Specify the region based on the location of the CyCognito instance. Only applicable if the "Other" option is selected in the Region dropdown.
  display: Other Region
  hidden: false
  name: other_region
  required: false
  type: 0
  section: Connect
- defaultvalue: CyCognito Issue
  display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- additionalinfo: The mirroring direction in which to mirror the incident. You can mirror only in (from CyCognito to XSOAR), out (from XSOAR to CyCognito), or in both directions.
  display: Incident Mirroring Direction
  hidden:
  - marketplacev2
  - platform
  name: mirror_direction
  required: false
  type: 15
  defaultvalue: Incoming and Outgoing
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming and Outgoing
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- additionalinfo: |-
    The date or relative timestamp from which to begin fetching incidents.

    Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

    For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
  display: First Fetch Time
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: The maximum number of incidents to fetch every time. The maximum value is '1000'.
  defaultvalue: '50'
  display: Max Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: The type of issue to fetch. By default, all types of issues will be fetched. Multiple selection is supported.
  display: Issue Type
  name: issue_type
  type: 16
  required: false
  options:
  - Abandoned Asset
  - Certificate Validity
  - Cryptographic Vulnerability
  - E-mail Security
  - Exposed Asset
  - Exposed Data
  - Exposed Dev Environment
  - Information Gathering
  - Phishing Threat
  - Potential Imposter Asset
  - Security Hygiene
  - Unmaintained Asset
  - Unsafe Authentication
  - Vulnerable Software
  - Weak Encryption
  - XSS
  section: Collect
- additionalinfo: Filters incidents according to the geographic locations in which the issue is found. Multiple selection is supported.
  display: Locations
  name: locations
  type: 16
  required: false
  options: ["Afghanistan", "Aland Islands", "Albania", "Algeria", "American Samoa", "Andorra", "Angola", "Anguilla", "Antarctica", "Antigua and Barbuda", "Argentina", "Armenia", "Aruba", "Australia", "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", "Bermuda", "Bhutan", "Bolivia, Plurinational State of", "Bonaire, Sint Eustatius and Saba", "Bosnia and Herzegovina", "Botswana", "Bouvet Island", "Brazil", "British Indian Ocean Territory", "Brunei Darussalam", "Bulgaria", "Burkina Faso", "Burundi", "Cabo Verde", "Cambodia", "Cameroon", "Canada", "Cayman Islands", "Central African Republic", "Chad", "Chile", "China", "Christmas Island", "Cocos (Keeling) Islands", "Colombia", "Comoros", "Congo", "Congo, The Democratic Republic of the", "Cook Islands", "Costa Rica", "Cote d'Ivoire", "Croatia", "Cuba", "Curacao", "Cyprus", "Czechia", "Denmark", "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", "Estonia", "Eswatini", "Ethiopia", "Falkland Islands (Malvinas)", "Faroe Islands", "Fiji", "Finland", "France", "French Guiana", "French Polynesia", "French Southern Territories", "Gabon", "Gambia", "Georgia", "Germany", "Ghana", "Gibraltar", "Greece", "Greenland", "Grenada", "Guadeloupe", "Guam", "Guatemala", "Guernsey", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Heard Island and McDonald Islands", "Holy See", "Honduras", "Hong Kong", "Hungary", "Iceland", "India", "Indonesia", "Iran, Islamic Republic of", "Iraq", "Ireland", "Isle of Man", "Israel", "Italy", "Jamaica", "Japan", "Jersey", "Jordan", "Kazakhstan", "Kenya", "Kiribati", "Korea, Democratic People's Republic of", "Korea, Republic of", "Kuwait", "Kyrgyzstan", "Lao People's Democratic Republic", "Latvia", "Lebanon", "Lesotho", "Liberia", "Libya", "Liechtenstein", "Lithuania", "Luxembourg", "Macao", "Madagascar", "Malawi", "Malaysia", "Maldives", "Mali", "Malta", "Marshall Islands", "Martinique", "Mauritania", "Mauritius", "Mayotte", "Mexico", "Micronesia, Federated States of", "Moldova, Republic of", "Monaco", "Mongolia", "Montenegro", "Montserrat", "Morocco", "Mozambique", "Myanmar", "Namibia", "Nauru", "Nepal", "Netherlands", "New Caledonia", "New Zealand", "Nicaragua", "Niger", "Nigeria", "Niue", "Norfolk Island", "North Macedonia", "Northern Mariana Islands", "Norway", "Oman", "Pakistan", "Palau", "Palestine, State of", "Panama", "Papua New Guinea", "Paraguay", "Peru", "Philippines", "Pitcairn", "Poland", "Portugal", "Puerto Rico", "Qatar", "Reunion", "Romania", "Russian Federation", "Rwanda", "Saint Barthelemy", "Saint Helena, Ascension and Tristan da Cunha", "Saint Kitts and Nevis", "Saint Lucia", "Saint Martin (French part)", "Saint Pierre and Miquelon", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Sint Maarten (Dutch part)", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", "South Georgia and the South Sandwich Islands", "South Sudan", "Spain", "Sri Lanka", "Sudan", "Suriname", "Svalbard and Jan Mayen", "Sweden", "Switzerland", "Syrian Arab Republic", "Taiwan, Province of China", "Tajikistan", "Tanzania, United Republic of", "Thailand", "Timor-Leste", "Togo", "Tokelau", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", "Turks and Caicos Islands", "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "United Kingdom of Great Britain and Northern Ireland", "United States of America", "United States Minor Outlying Islands", "Uruguay", "Uzbekistan", "Vanuatu", "Venezuela, Bolivarian Republic of", "Vietnam", "Virgin Islands, British", "Virgin Islands, U.S.", "Wallis and Futuna", "Western Sahara", "Yemen", "Zambia", "Zimbabwe"]
  section: Collect
- additionalinfo: The severity levels of the issues to fetch from CyCognito. By default, all the severity levels will be fetched, Multiple selection is supported.
  display: Severity
  name: severity_filter
  options:
  - low
  - high
  - medium
  - critical
  type: 16
  required: false
  section: Collect
- additionalinfo: The investigation status of the issues to fetch from CyCognito. By default, it fetches uninvestigated issues.
  display: Investigation Status
  name: investigation_status
  options: ["uninvestigated", "investigating", "investigated"]
  type: 15
  required: false
  section: Collect
- additionalinfo: "Applies a filter to the list of issues based on a JSON-specific query.\n\nFormat:\n[{\n    \"field\": \"issue-type\",\n    \"op\": \"in\",\n    \"values\": [\n       \"Unsafe Authentication\",\n       \"Vulnerable Software\"\n    ]\t\n},\n{\n    \"op\": \"not-in\",\n    \"field\": \"severity-score\",\n    \"values\": [10, 9]\n}]\n\nNote: When using several filtering options (e.g., 'Issue Type' and 'Advanced Filter'), Advanced Filter parameters will take precedence over other parameters.\nFor a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at \nhttps://docs.cycognito.com/reference/query-issues"
  display: Advanced Filter
  name: advanced_filter
  type: 12
  required: false
  section: Collect
- additionalinfo: Indicates whether to allow connections without verifying SSL certificate's validity.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- defaultvalue: '1440'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
description: The CyCognito integration fetches issues discovered by the CyCognito platform, thereby providing users with a view of their organization's internet-exposed attack surface. These issues include identification, prioritization, and recommendations for remediation of the risks faced by the organization. The integration contains commands to query assets and issues detected by the CyCognito platform, and includes a rich dashboard and layout with issue management capability.
display: CyCognito
name: CyCognito
script:
  commands:
  - arguments:
    - description: |-
        Unique issue ID of the instance.

        Example: 0.0.0.0-cyc-auth-default-credentials,
        example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

        Note: Users can retrieve the list of issue instance IDs by executing the "cycognito-issues-list" command.
      name: issue_instance_id
      required: true
    description: Retrieves information about an issue associated with a particular instance based on the provided issue instance ID.
    name: cycognito-issue-get
    outputs:
    - contextPath: CyCognito.Issue.id
      description: Unique ID of the issue.
      type: String
    - contextPath: CyCognito.Issue.references
      description: Issue reference.
      type: Unknown
    - contextPath: CyCognito.Issue.potential_threat
      description: The threat that the issue might cause.
      type: String
    - contextPath: CyCognito.Issue.tags
      description: Tags of the issue.
      type: Unknown
    - contextPath: CyCognito.Issue.organizations
      description: Organizations of the instance.
      type: Unknown
    - contextPath: CyCognito.Issue.issue_id
      description: Unique ID of the issue.
      type: String
    - contextPath: CyCognito.Issue.summary
      description: A brief description that summarizes the issue.
      type: String
    - contextPath: CyCognito.Issue.resolved_at
      description: Date/time when the issue was resolved.
      type: String
    - contextPath: CyCognito.Issue.investigation_status
      description: Investigation status of the issue.
      type: String
    - contextPath: CyCognito.Issue.locations
      description: The geographic location of the instance.
      type: Unknown
    - contextPath: CyCognito.Issue.detection_complexity
      description: Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
      type: String
    - contextPath: CyCognito.Issue.title
      description: Title of the issue.
      type: String
    - contextPath: CyCognito.Issue.exploitation_score
      description: Exploitation score of the issue.
      type: Number
    - contextPath: CyCognito.Issue.issue_type
      description: Type of the issue.
      type: String
    - contextPath: CyCognito.Issue.comment
      description: Comment associated with the issue.
      type: String
    - contextPath: CyCognito.Issue.severity
      description: Severity of the issue.
      type: String
    - contextPath: CyCognito.Issue.remediation_steps
      description: A list of actions that describe how to resolve the issue.
      type: Unknown
    - contextPath: CyCognito.Issue.potential_impact
      description: A list of categories that describe what might happen if the issue is exploited.
      type: Unknown
    - contextPath: CyCognito.Issue.exploitation_method
      description: Exploitation method of the issue.
      type: String
    - contextPath: CyCognito.Issue.affected_asset
      description: The unique ID of the asset with which the issue is associated.
      type: String
    - contextPath: CyCognito.Issue.severity_score
      description: The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
      type: Number
    - contextPath: CyCognito.Issue.last_detected
      description: The time at which the issue was last detected.
      type: Date
    - contextPath: CyCognito.Issue.first_detected
      description: The time at which the issue was first detected.
      type: Date
    - contextPath: CyCognito.Issue.issue_status
      description: Status of the issue found.
      type: String
    - contextPath: CyCognito.Issue.evidence
      description: Provides a reason or proof of why the issue was indeed detected by CyCognito.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      description: |-
        The type of asset.

        Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'.
      name: asset_type
      predefined:
      - ip
      - domain
      - iprange
      - cert
      - webapp
      required: true
    - description: |-
        The unique asset identifier.

        Note: The asset ID value can be found by executing the "cycognito-assets-list" command.
      name: asset_id
      required: true
    description: Retrieves information about a specific asset according to the specified asset type and asset ID.
    name: cycognito-asset-get
    outputs:
    - contextPath: CyCognito.Asset.alive
      description: Whether the port is alive or not.
      type: Boolean
    - contextPath: CyCognito.Asset.comment
      description: Comment associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.id
      description: |-
        Unique identifier of the asset.

        Note: The asset ID is derived from the asset_id input field.
      type: String
    - contextPath: CyCognito.Asset.type
      description: The type of asset.
      type: String
    - contextPath: CyCognito.Asset.business_units
      description: The business units of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.signature
      description: The identifier of the certificate.
      type: String
    - contextPath: CyCognito.Asset.closed_ports.status
      description: Status of the closed ports object associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.closed_ports.port
      description: Port of the closed ports object associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.closed_ports.protocol
      description: Protocol associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.created
      description: Creation time of the asset.
      type: Date
    - contextPath: CyCognito.Asset.domain
      description: Domain of the asset.
      type: String
    - contextPath: CyCognito.Asset.domains
      description: List of domains associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.domain_names
      description: List of domain names associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.expiration
      description: The date and time at which the asset expires.
      type: Date
    - contextPath: CyCognito.Asset.first_seen
      description: The time and date at which the asset was first discovered.
      type: Date
    - contextPath: CyCognito.Asset.hosting_type
      description: Hosting type of the asset.
      type: String
    - contextPath: CyCognito.Asset.ip
      description: IP address of the asset.
      type: String
    - contextPath: CyCognito.Asset.ip_addresses
      description: IP name of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.issuer_alt_names
      description: List of alternative names of the issuers.
      type: Unknown
    - contextPath: CyCognito.Asset.issuer_common_name
      description: Common name of the Issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_country
      description: Country of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_locality
      description: Locality of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_organization
      description: The issuer's organization.
      type: String
    - contextPath: CyCognito.Asset.issuer_organization_unit
      description: The issuer's organization unit.
      type: String
    - contextPath: CyCognito.Asset.issuer_state
      description: The state of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issues_count
      description: Count of the issues.
      type: Number
    - contextPath: CyCognito.Asset.last_seen
      description: The time and date at which the asset was last seen.
      type: Date
    - contextPath: CyCognito.Asset.locations
      description: Location of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.open_ports.status
      description: Status of the open ports object associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.open_ports.port
      description: Port of the open ports object associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.open_ports.protocol
      description: Protocol associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.organizations
      description: Organizations of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.status
      description: Status of the asset.
      type: String
    - contextPath: CyCognito.Asset.security_grade
      description: Security rating of the asset.
      type: String
    - contextPath: CyCognito.Asset.severe_issues
      description: The number of severe issues associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.signature_algorithm
      description: Signature algorithm of the asset.
      type: String
    - contextPath: CyCognito.Asset.sub_domains
      description: Subdomains of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.subject_alt_names
      description: List of alternate subject names.
      type: Unknown
    - contextPath: CyCognito.Asset.subject_common_name
      description: Common name of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_country
      description: Subject's country.
      type: String
    - contextPath: CyCognito.Asset.subject_locality
      description: Locality of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_organization
      description: Subject's Organization.
      type: String
    - contextPath: CyCognito.Asset.subject_organization_unit
      description: The organization unit of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_state
      description: State of the subject.
      type: String
    - contextPath: CyCognito.Asset.tags
      description: Tags of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.dynamically_resolved
      description: Whether the asset has a rotating IP address.
      type: String
    - contextPath: CyCognito.Asset.investigation_status
      description: Investigation status of the asset.
      type: String
    - contextPath: CyCognito.Asset.discoverability
      description: Quantifies an asset's level of exposure.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: |-
        The type of asset.

        Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'.
      name: asset_type
      predefined:
      - ip
      - domain
      - cert
      - webapp
      - iprange
      required: true
    - description: |-
        The unique asset identifier.

        Note: The asset ID value can be found by executing the "cycognito-assets-list" command.
      name: asset_id
      required: true
    - auto: PREDEFINED
      description: |-
        The investigation status of the asset. 

        Supported values: 'uninvestigated', 'investigating', 'investigated'.
      name: investigation_status
      predefined:
      - uninvestigated
      - investigating
      - investigated
      required: true
    description: Modifies the investigation status of the specified asset.
    name: cycognito-asset-investigation-status-change
    outputs:
    - contextPath: CyCognito.Asset.type
      description: The type of the asset.
      type: String
    - contextPath: CyCognito.Asset.id
      description: |-
        Unique identifier of the asset.

        Note: The asset ID is derived from the asset_ID input field."
      type: String
    - contextPath: CyCognito.Asset.investigation_status
      description: Investigation status of the Asset.
      type: String
    - contextPath: CyCognito.Asset.action_status
      description: Whether the status update is successful or failed.
      type: String
  - arguments:
    - description: |-
        The unique issue ID of the instance whose investigation status is to be changed.

        Example: 0.0.0.0-cyc-auth-default-credentials,
        example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

        Note: Users can retrieve the list of issue instance IDs by executing the "cycognito-issues-list" command.
      name: issue_instance_id
      required: true
    - auto: PREDEFINED
      description: |-
        The investigation status of the issue.

        Supported values: 'uninvestigated', 'investigating', 'investigated'.
      name: investigation_status
      predefined:
      - uninvestigated
      - investigating
      - investigated
      required: true
    description: Modifies the investigation status of the specified issue.
    name: cycognito-issue-investigation-status-change
    outputs:
    - contextPath: CyCognito.Issue.id
      description: Unique ID of the issue.
      type: String
    - contextPath: CyCognito.Issue.investigation_status
      description: Investigation status of the issue.
      type: String
    - contextPath: CyCognito.Issue.action_status
      description: Whether the update is successful or failed.
      type: String
  - arguments:
    - defaultValue: '50'
      description: |-
        The number of results to retrieve.

        Maximum value is '1000'.
      name: count
    - defaultValue: '0'
      description: |-
        Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

        Note: If a negative value is provided then the default value of 0 will be used.
      name: offset
    - description: |-
        An Advanced Search parameter to query the response.

        Note: Retrieves all the occurrences that are included in the string.
      name: search
    - description: |-
        The date and time at which CyCognito first discovered and attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: first_detected
    - description: |-
        The date and time at which CyCognito most recently attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: last_detected
    - description: Filters the issues according to the provided organizations. Supports comma-separated values.
      name: organizations
    - description: The geographical locations in which the issue is found. Supported values contain the three-letter ISO country code for the respective countries--e.g., IND, USA.
      name: locations
    - description: |-
        Filters the records according to the issue type. Supports comma-separated values.

        Supported values: "Abandoned Asset", "Certificate Validity", "Cryptographic Vulnerability", "E-mail Security", "Exposed Asset", "Exposed Data", "Exposed Dev Environment", "Information Gathering", "Phishing Threat", "Potential Imposter Asset", "Security Hygiene", "Unmaintained Asset", "Unsafe Authentication", "Vulnerable Software", "Weak Encryption", "XSS".
      name: issue_type
    - description: |-
        The name of the field by which to sort the results. The response fields available for sorting the data are found in the following documentation:
        https://docs.cycognito.com/reference/reference-getting-started
      name: sort_by
    - auto: PREDEFINED
      description: |-
        Specifies whether to sort the results in either ascending or descending order.

        Supported values: 'asc', 'desc'.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: "Applies a filter to the list of issues based on a JSON-specific query.\n\nFormat:\n[{\n    \"field\": \"issue-type\",\n    \"op\": \"in\",\n    \"values\": [\n       \"Unsafe Authentication\",\n       \"Vulnerable Software\"\n    ]\t\n},\n{\n    \"op\": \"not-in\",\n    \"field\": \"severity-score\",\n    \"values\": [10, 9]\n}]\n\nNote: When using several filtering options (e.g., 'Issue Type' and 'Advanced Filter'), advance_json parameters will take precedence over other parameters. \nFor a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at \nhttps://docs.cycognito.com/reference/query-issues"
      name: advanced_filter
    description: Retrieves the list of the issues that meet the specified filter criteria.
    name: cycognito-issues-list
    outputs:
    - contextPath: CyCognito.Issue.id
      description: Unique ID of the issue.
      type: String
    - contextPath: CyCognito.Issue.references
      description: Reference of the issue.
      type: Unknown
    - contextPath: CyCognito.Issue.potential_threat
      description: The threat that the issue might cause.
      type: String
    - contextPath: CyCognito.Issue.tags
      description: Tags of the issue.
      type: Unknown
    - contextPath: CyCognito.Issue.organizations
      description: Organizations of the instance.
      type: Unknown
    - contextPath: CyCognito.Issue.issue_id
      description: Unique ID of the issue.
      type: String
    - contextPath: CyCognito.Issue.summary
      description: A brief description that summarizes the issue.
      type: String
    - contextPath: CyCognito.Issue.resolved_at
      description: Date/time when the issue was resolved.
      type: String
    - contextPath: CyCognito.Issue.investigation_status
      description: Investigation status of the issue.
      type: String
    - contextPath: CyCognito.Issue.locations
      description: The geographic location of the instance.
      type: Unknown
    - contextPath: CyCognito.Issue.detection_complexity
      description: Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
      type: String
    - contextPath: CyCognito.Issue.title
      description: Title of the issue.
      type: String
    - contextPath: CyCognito.Issue.exploitation_score
      description: Exploitation score of the issue.
      type: Number
    - contextPath: CyCognito.Issue.issue_type
      description: Type of the issue.
      type: String
    - contextPath: CyCognito.Issue.comment
      description: Comment associated with the issue.
      type: String
    - contextPath: CyCognito.Issue.severity
      description: Severity of the issue.
      type: String
    - contextPath: CyCognito.Issue.remediation_steps
      description: A list of actions that describe how to resolve the issue.
      type: Unknown
    - contextPath: CyCognito.Issue.potential_impact
      description: A list of categories that describe what might happen if the issue is exploited.
      type: Unknown
    - contextPath: CyCognito.Issue.exploitation_method
      description: Exploitation method of the issue.
      type: String
    - contextPath: CyCognito.Issue.affected_asset
      description: The unique ID of the asset with which the issue is associated.
      type: String
    - contextPath: CyCognito.Issue.severity_score
      description: The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
      type: Number
    - contextPath: CyCognito.Issue.last_detected
      description: The time at which the issue was last detected.
      type: Date
    - contextPath: CyCognito.Issue.first_detected
      description: The time at which the issue was first detected.
      type: Date
    - contextPath: CyCognito.Issue.issue_status
      description: Status of the issue found.
      type: String
    - contextPath: CyCognito.Issue.evidence
      description: Provides a reason or proof of why the issue was indeed detected by CyCognito.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      description: |-
        The type of asset.

        Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'.
      name: asset_type
      predefined:
      - ip
      - domain
      - iprange
      - webapp
      - cert
      required: true
    - defaultValue: '50'
      description: |-
        The number of results to be retrieved in a response. 

        Maximum value is '1000'.
      name: count
    - defaultValue: '0'
      description: |-
        Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

        Note: If a negative value is provided then the default value of 0 will be used.
      name: offset
    - description: |-
        An Advanced Search parameter to query the response.

        Note: Retrieves all the occurrences that are included in the string.
      name: search
    - description: |-
        Filters the assets according to the selected status. Supports comma-separated values.

        Supported values: 'changed', 'new', 'normal'.
      name: status
    - description: Filters the assets according to the provided organizations. Supports comma-separated values.
      name: organizations
    - description: |-
        Filters the assets according to the provided security ratings. Supports comma-separated values.

        Supported values: 'A', 'B', 'C', 'D', 'F'

        Where:
        A = Very strong
        B = Strong
        C = Less vulnerable
        D = Vulnerable
        F = Highly vulnerable.
      name: security_grade
    - description: |-
        The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries'e.g., IND, USA.
        Locations are available only for IP, Domain, and Certificate asset types.
      name: locations
    - description: |-
        The date and time at which CyCognito first discovered and attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: first_seen
    - description: |-
        The date and time at which CyCognito most recently attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: last_seen
    - description: |-
        Specifies the field by which to sort.

        Note: The response fields available for sorting the data are found in the following documentation:
        https://docs.cycognito.com/reference/query-assets
      name: sort_by
    - auto: PREDEFINED
      defaultValue: desc
      description: |-
        Specifies whether to sort the results in either ascending or descending order.

        Supported values: 'asc', 'desc'.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: "Applies a filter to the list of assets based on a JSON-specific query.\n\nFormat:\n[{\n    \"field\": \"status\",\n    \"op\": \"in\",\n    \"values\": [\n        \"new\",\n        \"changed\"\n    ]\t\n},\n{\n    \"op\": \"not-in\",\n    \"field\": \"security-rating\",\n    \"values\": [\"A\"]\n}]\n\nNote: For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at https://docs.cycognito.com/reference/query-assets."
      name: advanced_filter
    description: Retrieves the list of assets that meet specified filter criteria.
    name: cycognito-assets-list
    outputs:
    - contextPath: CyCognito.Asset.alive
      description: Whether the port is alive or not.
      type: Boolean
    - contextPath: CyCognito.Asset.comment
      description: Comments related to the asset.
      type: String
    - contextPath: CyCognito.Asset.id
      description: "Unique identifier of the asset. \n\nNote: Asset ID is derived from the asset_id input field."
      type: String
    - contextPath: CyCognito.Asset.type
      description: Type of the asset.
      type: String
    - contextPath: CyCognito.Asset.business_units
      description: Business units of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.signature
      description: The identifier of the certificate.
      type: String
    - contextPath: CyCognito.Asset.closed_ports.status
      description: Status of the closed ports object associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.closed_ports.port
      description: Port of the closed ports object associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.closed_ports.protocol
      description: Protocol associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.created
      description: Date and time at which the asset was created.
      type: Date
    - contextPath: CyCognito.Asset.domain
      description: Domain name of the asset.
      type: String
    - contextPath: CyCognito.Asset.domains
      description: Domain of the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.domain_names
      description: List of domain names associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.expiration
      description: Date and time at which the asset is expired.
      type: Date
    - contextPath: CyCognito.Asset.first_seen
      description: Time at which an asset was first discovered and attributed to the organization.
      type: Date
    - contextPath: CyCognito.Asset.hosting_type
      description: Hosting type of the asset.
      type: String
    - contextPath: CyCognito.Asset.investigation_status
      description: Investigation status of the asset.
      type: String
    - contextPath: CyCognito.Asset.ip
      description: IP of the asset.
      type: String
    - contextPath: CyCognito.Asset.ip_addresses
      description: List of IP associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.issuer_alt_names
      description: List of alternate issuer names.
      type: Unknown
    - contextPath: CyCognito.Asset.issuer_common_name
      description: Common name of the Issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_country
      description: Country of Issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_locality
      description: Locality of issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_organization
      description: Organization of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_organization_unit
      description: The organization unit of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issuer_state
      description: State of the issuer.
      type: String
    - contextPath: CyCognito.Asset.issues_count
      description: Count of issues associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.last_seen
      description: Time at which an asset was discovered and attributed to the organization.
      type: Date
    - contextPath: CyCognito.Asset.locations
      description: List of geographic locations with which an asset might be associated.
      type: Unknown
    - contextPath: CyCognito.Asset.open_ports.status
      description: Status of the open ports object associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.open_ports.port
      description: Port of the open ports object associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.open_ports.protocol
      description: Protocol associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.organizations
      description: List of organizations associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.status
      description: Last status of the asset.
      type: String
    - contextPath: CyCognito.Asset.security_grade
      description: Security rating of the asset based on the number and severity of the associated issues.
      type: String
    - contextPath: CyCognito.Asset.severe_issues
      description: The number of severe issues associated with the asset.
      type: Number
    - contextPath: CyCognito.Asset.signature_algorithm
      description: Signature algorithm associated with the asset.
      type: String
    - contextPath: CyCognito.Asset.sub_domains
      description: List of subdomains associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.subject_alt_names
      description: List of alternate subject names.
      type: Unknown
    - contextPath: CyCognito.Asset.subject_common_name
      description: Common name of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_country
      description: Subject's country.
      type: String
    - contextPath: CyCognito.Asset.subject_locality
      description: Locality of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_organization
      description: Subject's organization.
      type: String
    - contextPath: CyCognito.Asset.subject_organization_unit
      description: The organization unit of the subject.
      type: String
    - contextPath: CyCognito.Asset.subject_state
      description: State of the subject.
      type: String
    - contextPath: CyCognito.Asset.tags
      description: List of tags associated with the asset.
      type: Unknown
    - contextPath: CyCognito.Asset.dynamically_resolved
      description: Whether the asset has a rotating IP address.
      type: String
    - contextPath: CyCognito.Asset.discoverability
      description: Quantifies an asset's level of exposure.
      type: String
  dockerimage: demisto/pycountry:1.0.0.10120494
  isfetch: true
  isremotesyncin: true
  isremotesyncout: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- CyCognito-Test
defaultmapperin: CyCognito - Incoming Mapper
marketplaces:
- xsoar
- marketplacev2
- platform
fromversion: 6.2.0