CyCognito

The CyCognito integration fetches issues discovered by the CyCognito platform, thereby providing users with a view of their organization's internet-exposed attack surface. These issues include identification, prioritization, and recommendations for remediation of the risks faced by the organization. The integration contains commands to query assets and issues detected by the CyCognito platform, and includes a rich dashboard and layout with issue management capability.

Vulnerability Management · CyCognito

Details

IDCyCognito
ProviderCyCognito
CategoryVulnerability Management
From Version6.2.0
Docker Imagedemisto/pycountry:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

The CyCognito integration fetches issues discovered by the CyCognito platform, thereby providing users with a view of their organization’s internet-exposed attack surface. These issues include identification, prioritization, and recommendations for remediation of the risks faced by the organization. The integration contains commands to query assets and issues detected by the CyCognito platform, and includes a rich dashboard and layout with issue management capability.
This integration was integrated and tested with CyCognito V1 API.

Configure CyCognito in Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for CyCognito.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
API Key The API Key required to authenticate to the service. True
Region Select the region based on the location of the CyCognito instance. If the region is not listed in the dropdown, choose the “Other” option and specify the region in the “Other Region” text field. False
Other Region Specify the region based on the location of the CyCognito instance. Only applicable if the “Other” option is selected in the Region dropdown. False
Incident type Incident type to map if no classifier is provided. False
Incident Mirroring Direction The mirroring direction in which to mirror the incident. You can mirror only in (from CyCognito to XSOAR), out (from XSOAR to CyCognito), or in both directions. False
Fetch incidents Indicates whether to fetch incident from the instance. False
First Fetch Time The date or relative timestamp from which to begin fetching incidents.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 False
Max Fetch The maximum number of incidents to fetch every time. The maximum value is ‘1000’. False
Issue Type The type of issue to fetch. By default, all types of issues will be fetched. Multiple selection is supported. False
Locations Filters incidents according to the geographic locations in which the issue is found. Multiple selection is supported. False
Severity The severity levels of the issues to fetch from CyCognito. By default, all the severity levels will be fetched, Multiple selection is supported. False
Investigation Status The investigation status of the issues to fetch from CyCognito. By default, it fetches uninvestigated issues. False
Advanced Filter Applies a filter to the list of issues based on a JSON-specific query.

Format:
[{
“field”: “issue-type”,
“op”: “in”,
“values”: [
“Unsafe Authentication”,
“Vulnerable Software”
]
},
{
“op”: “not-in”,
“field”: “severity-score”,
“values”: [10, 9]
}]

Note: When using several filtering options (e.g., ‘Issue Type’ and ‘Advanced Filter’), Advanced Filter parameters will take precedence over other parameters.
For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at
https://docs.cycognito.com/reference/query-issues		 False
Trust any certificate (not secure) Indicates whether to allow connections without verifying SSL certificate’s validity. False
Use system proxy settings Indicates whether to use XSOAR’s system proxy settings to connect to the API. False
Incidents Fetch Interval Time interval for fetching incidents. False
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cycognito-issue-get

Retrieves information about an issue associated with a particular instance based on the provided issue instance ID.

Base Command

cycognito-issue-get

Input

Argument Name Description Required
issue_instance_id Unique issue ID of the instance.

Example: 0.0.0.0-cyc-auth-default-credentials,
example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

Note: Users can retrieve the list of issue instance IDs by executing the “cycognito-issues-list” command.		 Required

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.references Unknown Issue reference.
CyCognito.Issue.potential_threat String The threat that the issue might cause.
CyCognito.Issue.tags Unknown Tags of the issue.
CyCognito.Issue.organizations Unknown Organizations of the instance.
CyCognito.Issue.issue_id String Unique ID of the issue.
CyCognito.Issue.summary String A brief description that summarizes the issue.
CyCognito.Issue.resolved_at String Date/time when the issue was resolved.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.locations Unknown The geographic location of the instance.
CyCognito.Issue.detection_complexity String Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
CyCognito.Issue.title String Title of the issue.
CyCognito.Issue.exploitation_score Number Exploitation score of the issue.
CyCognito.Issue.issue_type String Type of the issue.
CyCognito.Issue.comment String Comment associated with the issue.
CyCognito.Issue.severity String Severity of the issue.
CyCognito.Issue.remediation_steps Unknown A list of actions that describe how to resolve the issue.
CyCognito.Issue.potential_impact Unknown A list of categories that describe what might happen if the issue is exploited.
CyCognito.Issue.exploitation_method String Exploitation method of the issue.
CyCognito.Issue.affected_asset String The unique ID of the asset with which the issue is associated.
CyCognito.Issue.severity_score Number The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
CyCognito.Issue.last_detected Date The time at which the issue was last detected.
CyCognito.Issue.first_detected Date The time at which the issue was first detected.
CyCognito.Issue.issue_status String Status of the issue found.
CyCognito.Issue.evidence Unknown Provides a reason or proof of why the issue was indeed detected by CyCognito.

Command example

!cycognito-issue-get issue_instance_id=127.0.0.1-cve-2019-00000

Context Example

{
    "CyCognito": {
        "Issue": {
            "affected_asset": "ip/127.0.0.1",
            "detection_complexity": "Service Detection",
            "exploitation_method": "Metasploit",
            "exploitation_score": 3,
            "first_detected": "2022-03-31T03:39:22.568Z",
            "id": "127.0.0.1-cve-2019-00000",
            "investigation_status": "investigating",
            "issue_id": "CVE-2019-00000",
            "issue_status": "new",
            "issue_type": "Vulnerable Software",
            "last_detected": "2022-03-31T03:39:22.568Z",
            "locations": [
                "IND"
            ],
            "organizations": [
                "Acme Interior Design",
                "Acme Corporation"
            ],
            "potential_impact": [
                "Loss of integrity",
                "Loss of confidentiality",
                "Data compromise"
            ],
            "references": [],
            "remediation_steps": [
                "Patch the Pulse Secure VPN to the latest version."
            ],
            "severity": "critical",
            "severity_score": 10,
            "summary": "| The Pulse Secure VPN has been confirmed to be vulnerable to an arbitrary file reading vulnerability. | Unauthenticated remote attackers can send the asset a specially crafted URI and thereby access arbitrary sensitive files. | Attackers can leverage the harvested information to perform further attacks.",
            "tags": [
                "Vulnerable Software",
                "Pulse Secure",
                "network vulnerabilities"
            ],
            "potential_threat": "Information Disclosure",
            "title": "Pulse Secure Arbitrary File Reading"
        }
    }
}

Human Readable Output

Issue detail

ID: 127.0.0.1-test

Title Affected Asset Detection Complexity Investigation Status Exploitation Score First Detected Last Detected Organizations Locations Potential Threat Severity Issue Type Issue Status Remediation Steps Potential Impact Tags Summary Link to Platform
Pulse Secure Arbitrary File Reading ip/127.0.0.1 Service Detection investigating 3 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM Acme Interior Design, Acme Corporation India Information Disclosure critical Vulnerable Software new Patch the Pulse Secure VPN to the latest version. Loss of integrity, Loss of confidentiality, Data compromise Vulnerable Software, Pulse Secure, network vulnerabilities The Pulse Secure VPN has been confirmed to be vulnerable to an arbitrary file reading vulnerability. Unauthenticated remote attackers can send the asset a specially crafted URI and thereby access arbitrary sensitive files. Attackers can leverage the harvested information to perform further attacks. Click Here

cycognito-asset-get

Retrieves information about a specific asset according to the specified asset type and asset ID.

Base Command

cycognito-asset-get

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
asset_id The unique asset identifier.

Note: The asset ID value can be found by executing the “cycognito-assets-list” command.		 Required

Context Output

Path Type Description
CyCognito.Asset.alive Boolean Whether the port is alive or not.
CyCognito.Asset.comment String Comment associated with the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: The asset ID is derived from the asset_id input field.
CyCognito.Asset.type String The type of asset.
CyCognito.Asset.business_units Unknown The business units of the asset.
CyCognito.Asset.signature String The identifier of the certificate.
CyCognito.Asset.closed_ports.status String Status of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.port Number Port of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.created Date Creation time of the asset.
CyCognito.Asset.domain String Domain of the asset.
CyCognito.Asset.domains Unknown List of domains associated with the asset.
CyCognito.Asset.domain_names Unknown List of domain names associated with the asset.
CyCognito.Asset.expiration Date The date and time at which the asset expires.
CyCognito.Asset.first_seen Date The time and date at which the asset was first discovered.
CyCognito.Asset.hosting_type String Hosting type of the asset.
CyCognito.Asset.ip String IP address of the asset.
CyCognito.Asset.ip_addresses Unknown IP name of the asset.
CyCognito.Asset.issuer_alt_names Unknown List of alternative names of the issuers.
CyCognito.Asset.issuer_common_name String Common name of the Issuer.
CyCognito.Asset.issuer_country String Country of the issuer.
CyCognito.Asset.issuer_locality String Locality of the issuer.
CyCognito.Asset.issuer_organization String The issuer’s organization.
CyCognito.Asset.issuer_organization_unit String The issuer’s organization unit.
CyCognito.Asset.issuer_state String The state of the issuer.
CyCognito.Asset.issues_count Number Count of the issues.
CyCognito.Asset.last_seen Date The time and date at which the asset was last seen.
CyCognito.Asset.locations Unknown Location of the asset.
CyCognito.Asset.open_ports.status String Status of the open ports object associated with the asset.
CyCognito.Asset.open_ports.port Number Port of the open ports object associated with the asset.
CyCognito.Asset.open_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.organizations Unknown Organizations of the asset.
CyCognito.Asset.status String Status of the asset.
CyCognito.Asset.security_grade String Security rating of the asset.
CyCognito.Asset.severe_issues Number The number of severe issues associated with the asset.
CyCognito.Asset.signature_algorithm String Signature algorithm of the asset.
CyCognito.Asset.sub_domains Unknown Subdomains of the asset.
CyCognito.Asset.subject_alt_names Unknown List of alternate subject names.
CyCognito.Asset.subject_common_name String Common name of the subject.
CyCognito.Asset.subject_country String Subject’s country.
CyCognito.Asset.subject_locality String Locality of the subject.
CyCognito.Asset.subject_organization String Subject’s Organization.
CyCognito.Asset.subject_organization_unit String The organization unit of the subject.
CyCognito.Asset.subject_state String State of the subject.
CyCognito.Asset.tags Unknown Tags of the asset.
CyCognito.Asset.dynamically_resolved String Whether the asset has a rotating IP address.
CyCognito.Asset.investigation_status String Investigation status of the asset.
CyCognito.Asset.discoverability String Quantifies an asset’s level of exposure.

Command example

!cycognito-asset-get asset_type=ip asset_id=127.0.0.1

Context Example

{
    "CyCognito": {
        "Asset": {
            "alive": true,
            "closed_ports": [
                {
                    "port": 8080,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 102,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 445,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 161,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 4040,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 7070,
                    "protocol": "tcp",
                    "status": "closed"
                },
                {
                    "port": 1723,
                    "protocol": "tcp",
                    "status": "closed"
                }
            ],
            "comment": {
                "content": "A grade",
                "last_update": "2022-05-06T05:19:05.931Z"
            },
            "dynamically_resolved": "no",
            "first_seen": "2022-01-20T03:58:36.696Z",
            "hosting_type": "owned",
            "id": "127.0.0.1",
            "investigation_status": "investigated",
            "ip": "127.0.0.1",
            "issues_count": 1,
            "last_seen": "2022-03-31T03:39:22.568Z",
            "locations": [
                "IND"
            ],
            "open_ports": [
                {
                    "port": 9999,
                    "protocol": "tcp",
                    "status": "open"
                },
                {
                    "port": 2000,
                    "protocol": "tcp",
                    "status": "open"
                }
            ],
            "organizations": [
                "Acme Interior Design",
                "Acme Corporation"
            ],
            "security_grade": "B",
            "severe_issues": 0,
            "status": "new",
            "tags": [
                "Gateways",
                "ACME"
            ],
            "type": "ip"
        }
    }
}

Human Readable Output

Asset Details

Asset ID Asset Type Hosting Type Alive Locations First Seen Last Seen Status Security Grade Tags Organizations Severe Issues Investigation Status Open Ports
127.0.0.1 ip owned true India 20 Jan 2022, 03:58 AM 31 Mar 2022, 03:39 AM new B Gateways,
ACME		 Acme Interior Design, Acme Corporation 0 investigated TCP - 9999, TCP - 2000

cycognito-asset-investigation-status-change

Modifies the investigation status of the specified asset.

Base Command

cycognito-asset-investigation-status-change

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
asset_id The unique asset identifier.

Note: The asset ID value can be found by executing the “cycognito-assets-list” command.		 Required
investigation_status The investigation status of the asset.

Supported values: ‘uninvestigated’, ‘investigating’, ‘investigated’.		 Required

Context Output

Path Type Description
CyCognito.Asset.type String The type of the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: The asset ID is derived from the asset_ID input field.
CyCognito.Asset.investigation_status String Investigation status of the Asset.
CyCognito.Asset.action_status String Whether the status update is successful or failed.

Command example

!cycognito-asset-investigation-status-change asset_type=ip asset_id=127.0.0.1 investigation_status=investigated

Context Example

{
    "CyCognito": {
        "Asset": {
            "action_status": "Success",
            "asset_type": "ip",
            "id": "127.0.0.1",
            "investigation_status": "investigated"
        }
    }
}

Human Readable Output

Investigation Status has been successfully updated for 127.0.0.1

Asset Type Asset ID Investigation Status Action Status
ip 127.0.0.1 investigated Success

cycognito-issue-investigation-status-change

Modifies the investigation status of the specified issue.

Base Command

cycognito-issue-investigation-status-change

Input

Argument Name Description Required
issue_instance_id The unique issue ID of the instance whose investigation status is to be changed.

Example: 0.0.0.0-cyc-auth-default-credentials,
example.com-cyc-sql-injection, 0.0.0.0-cyc-exposed-bucket-with-data.

Note: Users can retrieve the list of issue instance IDs by executing the “cycognito-issues-list” command.		 Required
investigation_status The investigation status of the issue.

Supported values: ‘uninvestigated’, ‘investigating’, ‘investigated’		 Required

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.action_status String Whether the update is successful or failed.

Command example

!cycognito-issue-investigation-status-change issue_instance_id=127.0.0.1-cve-2019-00000 investigation_status=investigated

Context Example

{
    "CyCognito": {
        "Issue": {
            "action_status": "Success",
            "id": "127.0.0.1-cve-2019-00000",
            "investigation_status": "investigated"
        }
    }
}

Human Readable Output

Investigation Status has been successfully updated for 127.0.0.1-cve-2019-00000

Issue ID Investigation Status Action Status
127.0.0.1-cve-2019-00000 investigated Success

cycognito-issues-list

Retrieves the list of the issues that meet the specified filter criteria.

Base Command

cycognito-issues-list

Input

Argument Name Description Required
count The number of results to retrieve.

Maximum value is ‘1000’. Default is 50.		 Optional
offset Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

Note: If a negative value is provided then the default value of 0 will be used. Default is 0.		 Optional
search An Advanced Search parameter to query the response.

Note: Retrieves all the occurrences that are included in the string.		 Optional
first_detected The date and time at which CyCognito first discovered and attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
last_detected The date and time at which CyCognito most recently attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
organizations Filters the issues according to the provided organizations. Supports comma-separated values. Optional
locations The geographical locations in which the issue is found. Supported values contain the three-letter ISO country code for the respective countries–e.g., IND, USA. Optional
issue_type Filters the records according to the issue type. Supports comma-separated values.

Supported values: “Abandoned Asset”, “Certificate Validity”, “Cryptographic Vulnerability”, “E-mail Security”, “Exposed Asset”, “Exposed Data”, “Exposed Dev Environment”, “Information Gathering”, “Phishing Threat”, “Potential Imposter Asset”, “Security Hygiene”, “Unmaintained Asset”, “Unsafe Authentication”, “Vulnerable Software”, “Weak Encryption”, “XSS”		 Optional
sort_by The name of the field by which to sort the results. The response fields available for sorting the data are found in the following documentation:
https://docs.cycognito.com/reference/reference-getting-started.		 Optional
sort_order Specifies whether to sort the results in either ascending or descending order.

Supported values: ‘asc’, ‘desc’		 Optional
advanced_filter Applies a filter to the list of issues based on a JSON-specific query.

Format:
[{
“field”: “issue-type”,
“op”: “in”,
“values”: [
“Unsafe Authentication”,
“Vulnerable Software”
]
},
{
“op”: “not-in”,
“field”: “severity-score”,
“values”: [10, 9]
}]

Note: When using several filtering options (e.g., ‘Issue Type’ and ‘Advanced Filter’), advance_json parameters will take precedence over other parameters.
For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at
https://docs.cycognito.com/reference/query-issues.		 Optional

Context Output

Path Type Description
CyCognito.Issue.id String Unique ID of the issue.
CyCognito.Issue.references Unknown Reference of the issue.
CyCognito.Issue.potential_threat String The threat that the issue might cause.
CyCognito.Issue.tags Unknown Tags of the issue.
CyCognito.Issue.organizations Unknown Organizations of the instance.
CyCognito.Issue.issue_id String Unique ID of the issue.
CyCognito.Issue.summary String A brief description that summarizes the issue.
CyCognito.Issue.resolved_at String Date/time when the issue was resolved.
CyCognito.Issue.investigation_status String Investigation status of the issue.
CyCognito.Issue.locations Unknown The geographic location of the instance.
CyCognito.Issue.detection_complexity String Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.
CyCognito.Issue.title String Title of the issue.
CyCognito.Issue.exploitation_score Number Exploitation score of the issue.
CyCognito.Issue.issue_type String Type of the issue.
CyCognito.Issue.comment String Comment associated with the issue.
CyCognito.Issue.severity String Severity of the issue.
CyCognito.Issue.remediation_steps Unknown A list of actions that describe how to resolve the issue.
CyCognito.Issue.potential_impact Unknown A list of categories that describe what might happen if the issue is exploited.
CyCognito.Issue.exploitation_method String Exploitation method of the issue.
CyCognito.Issue.affected_asset String The unique ID of the asset with which the issue is associated.
CyCognito.Issue.severity_score Number The numeric severity of the issue is in the range of 0 (not severe) through 10 (severe).
CyCognito.Issue.last_detected Date The time at which the issue was last detected.
CyCognito.Issue.first_detected Date The time at which the issue was first detected.
CyCognito.Issue.issue_status String Status of the issue found.
CyCognito.Issue.evidence Unknown Provides a reason or proof of why the issue was indeed detected by CyCognito.

Command example

!cycognito-issues-list count=2

Context Example

{
    "CyCognito": {
        "Issue": [
            {
                "affected_asset": "ip/127.0.0.1",
                "detection_complexity": "Service Detection",
                "exploitation_method": "Metasploit",
                "exploitation_score": 3,
                "first_detected": "2022-03-31T03:39:22.568Z",
                "id": "issue/127.0.0.1-cve-2019-00000",
                "investigation_status": "investigating",
                "issue_id": "CVE-2019-00000",
                "issue_status": "new",
                "issue_type": "Vulnerable Software",
                "last_detected": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "USA"
                ],
                "organizations": [
                    "ACME Ticketing",
                    "ACME Cleantech Solutions",
                    "Acme Holdings"
                ],
                "potential_impact": [
                    "Loss of integrity",
                    "Loss of confidentiality",
                    "Loss of availability",
                    "Data compromise",
                    "Network breach"
                ],
                "references": [],
                "remediation_steps": [
                    "Patch the NetScaler to the latest version.",
                    "If a patch is not feasible, perform \"work-around\" mitigations per Citrix's instructions."
                ],
                "severity": "critical",
                "severity_score": 10,
                "summary": "| The NetScaler has been confirmed to be vulnerable to CVE-2019-00000 (first made public in December 2019). | Due to improper handling of the path names, CVE-2019-00000 enables attackers to perform directory traversal and unauthenticated, remote arbitrary code execution via specially crafted HTTP requests. | As NetScalers serve as entry-points to organization networks, attackers can exploit this vulnerability to breach organization networks and leverage the NetScaler for further attacks. | This vulnerability has been exploited \"in the wild\" by unknown attackers.",
                "tags": [
                    "Pulse Secure"
                ],
                "potential_threat": "Remote Code Execution",
                "title": "CVE-2019-00000 (Unauthenticated Remote Directory Traversal & Code Execution)"
            },
            {
                "affected_asset": "ip/127.0.0.2",
                "comment": {
                    "content": "hello",
                    "last_update": "2022-06-14T06:42:20.952Z"
                },
                "detection_complexity": "Handshake",
                "exploitation_method": "Man-in-the-Middle",
                "exploitation_score": 4,
                "first_detected": "2022-03-20T18:48:33.528Z",
                "id": "issue/127.0.0.2-cyc-tls-hsts-dummy",
                "investigation_status": "investigating",
                "issue_id": "CYC-TLS-HSTS-DUMMY",
                "issue_status": "new",
                "issue_type": "Cryptographic Vulnerability",
                "last_detected": "2022-03-20T18:48:33.528Z",
                "locations": [
                    "USA"
                ],
                "organizations": [
                    "Acme Homes"
                ],
                "potential_impact": [
                    "Loss of integrity",
                    "Loss of confidentiality"
                ],
                "remediation_steps": [
                    "Enable an HSTS policy of at least 180 days."
                ],
                "severity": "critical",
                "severity_score": 10,
                "summary": "The server's HSTS policy is either too short or non-existent. | HTTP Strict Transport Security is an optional HTTP header that instructs browsers to only communicate with the server using HTTPS (and not HTTP) for a certain period of time, thus helping prevent \"SSL-stripping\" attacks.",
                "potential_threat": "Trust",
                "title": "Insecure HSTS"
            }
        ]
    }
}

Human Readable Output

Issues

ID Title Severity Score Severity Issue Type Issue Status Organizations Investigation Status First Detected Last Detected Locations
127.0.0.1-cve-2019-00000 Pulse Secure Arbitrary File Reading 10.0 critical Vulnerable Software new Acme Interior Design, Acme Corporation investigating 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM India
127.0.0.2-cve-2019-00000 CVE-2019-00000 (Unauthenticated Remote Directory Traversal & Code Execution) 10.0 critical Vulnerable Software new ACME Ticketing, ACME Cleantech Solutions, Acme Holdings uninvestigated 31 Mar 2022, 03:39 AM 31 Mar 2022, 03:39 AM United States

cycognito-assets-list

Retrieves the list of assets that meet specified filter criteria.

Base Command

cycognito-assets-list

Input

Argument Name Description Required
asset_type The type of asset.

Supported values: ‘ip’, ‘domain’, ‘cert’, ‘webapp’, ‘iprange’		 Required
count The number of results to be retrieved in a response.

Maximum value is ‘1000’. Default is 50.		 Optional
offset Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.

Note: If a negative value is provided then the default value of 0 will be used. Default is 0.		 Optional
search An Advanced Search parameter to query the response.

Note: Retrieves all the occurrences that are included in the string.		 Optional
status Filters the assets according to the selected status. Supports comma-separated values.

Supported values: ‘changed’, ‘new’, ‘normal’		 Optional
organizations Filters the assets according to the provided organizations. Supports comma-separated values. Optional
security_grade Filters the assets according to the provided security ratings. Supports comma-separated values.

Supported values: ‘A’, ‘B’, ‘C’, ‘D’, ‘F’

Where:
A = Very strong
B = Strong
C = Less vulnerable
D = Vulnerable
F = Highly vulnerable		 Optional
locations The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries’e.g., IND, USA.
Locations are available only for IP, Domain, and Certificate asset types.		 Optional
first_seen The date and time at which CyCognito first discovered and attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
last_seen The date and time at which CyCognito most recently attributed the asset to the organization.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z		 Optional
sort_by Specifies the field by which to sort.

Note: The response fields available for sorting the data are found in the following documentation:
https://docs.cycognito.com/reference/query-assets.		 Optional
sort_order Specifies whether to sort the results in either ascending or descending order.

Supported values: ‘asc’, ‘desc’. Default is desc.		 Optional
advanced_filter Applies a filter to the list of assets based on a JSON-specific query.

Format:
[{
“field”: “status”,
“op”: “in”,
“values”: [
“new”,
“changed”
]
},
{
“op”: “not-in”,
“field”: “security-rating”,
“values”: [“A”]
}]

Note: For a complete reference to the CyCognito fields and operations, please refer to the CyCognito API V0 documentation at https://docs.cycognito.com/reference/query-assets.		 Optional

Context Output

Path Type Description
CyCognito.Asset.alive Boolean Whether the port is alive or not.
CyCognito.Asset.comment String Comments related to the asset.
CyCognito.Asset.id String Unique identifier of the asset.
Note: Asset ID is derived from the asset_id input field.
CyCognito.Asset.type String Type of the asset.
CyCognito.Asset.business_units Unknown Business units of the asset.
CyCognito.Asset.signature String The identifier of the certificate.
CyCognito.Asset.closed_ports.status String Status of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.port Number Port of the closed ports object associated with the asset.
CyCognito.Asset.closed_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.created Date Date and time at which the asset was created.
CyCognito.Asset.domain String Domain name of the asset.
CyCognito.Asset.domains Unknown Domain of the asset.
CyCognito.Asset.domain_names Unknown List of domain names associated with the asset.
CyCognito.Asset.expiration Date Date and time at which the asset is expired.
CyCognito.Asset.first_seen Date Time at which an asset was first discovered and attributed to the organization.
CyCognito.Asset.hosting_type String Hosting type of the asset.
CyCognito.Asset.investigation_status String Investigation status of the asset.
CyCognito.Asset.ip String IP of the asset.
CyCognito.Asset.ip_addresses Unknown List of IP associated with the asset.
CyCognito.Asset.issuer_alt_names Unknown List of alternate issuer names.
CyCognito.Asset.issuer_common_name String Common name of the Issuer.
CyCognito.Asset.issuer_country String Country of Issuer.
CyCognito.Asset.issuer_locality String Locality of issuer.
CyCognito.Asset.issuer_organization String Organization of the issuer.
CyCognito.Asset.issuer_organization_unit String The organization unit of the issuer.
CyCognito.Asset.issuer_state String State of the issuer.
CyCognito.Asset.issues_count Number Count of issues associated with the asset.
CyCognito.Asset.last_seen Date Time at which an asset was discovered and attributed to the organization.
CyCognito.Asset.locations Unknown List of geographic locations with which an asset might be associated.
CyCognito.Asset.open_ports.status String Status of the open ports object associated with the asset.
CyCognito.Asset.open_ports.port Number Port of the open ports object associated with the asset.
CyCognito.Asset.open_ports.protocol String Protocol associated with the asset.
CyCognito.Asset.organizations Unknown List of organizations associated with the asset.
CyCognito.Asset.status String Last status of the asset.
CyCognito.Asset.security_grade String Security rating of the asset based on the number and severity of the associated issues.
CyCognito.Asset.severe_issues Number The number of severe issues associated with the asset.
CyCognito.Asset.signature_algorithm String Signature algorithm associated with the asset.
CyCognito.Asset.sub_domains Unknown List of subdomains associated with the asset.
CyCognito.Asset.subject_alt_names Unknown List of alternate subject names.
CyCognito.Asset.subject_common_name String Common name of the subject.
CyCognito.Asset.subject_country String Subject’s country.
CyCognito.Asset.subject_locality String Locality of the subject.
CyCognito.Asset.subject_organization String Subject’s organization.
CyCognito.Asset.subject_organization_unit String The organization unit of the subject.
CyCognito.Asset.subject_state String State of the subject.
CyCognito.Asset.tags Unknown List of tags associated with the asset.
CyCognito.Asset.dynamically_resolved String Whether the asset has a rotating IP address.
CyCognito.Asset.discoverability String Quantifies an asset’s level of exposure.

Command example

!cycognito-assets-list asset_type=ip count=2

Context Example

{
    "CyCognito": {
        "Asset": [
            {
                "alive": true,
                "closed_ports": [
                    {
                        "port": 6001,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 47808,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 5900,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 111,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 9200,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 11211,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 1723,
                        "protocol": "tcp",
                        "status": "closed"
                    }
                ],
                "dynamically_resolved": "no",
                "first_seen": "2022-03-23T12:36:17.808Z",
                "hosting_type": "owned",
                "id": "ip/127.0.0.1",
                "investigation_status": "investigated",
                "ip": "127.0.0.1",
                "issues_count": 1,
                "last_seen": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "MYS"
                ],
                "open_ports": [
                    {
                        "port": 465,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 993,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 80,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 53,
                        "protocol": "udp",
                        "status": "open"
                    }
                ],
                "organizations": [
                    "Acme Corporation"
                ],
                "security_grade": "F",
                "severe_issues": 1,
                "status": "new",
                "tags": [
                    "Vulnerable Software",
                    "Red Hat"
                ],
                "type": "ip"
            },
            {
                "alive": true,
                "closed_ports": [
                    {
                        "port": 3389,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 8888,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 110,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 548,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 23,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 11211,
                        "protocol": "tcp",
                        "status": "closed"
                    },
                    {
                        "port": 1723,
                        "protocol": "tcp",
                        "status": "closed"
                    }
                ],
                "dynamically_resolved": "no",
                "first_seen": "2022-03-23T12:27:04.354Z",
                "hosting_type": "owned",
                "id": "ip/127.0.0.2",
                "investigation_status": "investigated",
                "ip": "127.0.0.2",
                "issues_count": 2,
                "last_seen": "2022-03-31T03:39:22.568Z",
                "locations": [
                    "MYS"
                ],
                "open_ports": [
                    {
                        "port": 587,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 21,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 22,
                        "protocol": "tcp",
                        "status": "open"
                    },
                    {
                        "port": 465,
                        "protocol": "tcp",
                        "status": "open"
                    }
                ],
                "organizations": [
                    "Acme Corporation"
                ],
                "security_grade": "F",
                "severe_issues": 1,
                "status": "new",
                "tags": [
                    "Block Cipher"
                ],
                "type": "ip"
            }
        ]
    }
}

Human Readable Output

Asset List

Assets Type: IP

Asset ID Security Grade Status Organizations Investigation Status Severe Issues First Seen Last Seen Hosting Type Locations
127.0.0.1 F new Acme Corporation investigated 1 23 Mar 2022, 12:27 PM 31 Mar 2022, 03:39 AM owned Malaysia
127.0.0.2 F new Acme Corporation investigated 1 23 Mar 2022, 12:27 PM 31 Mar 2022, 03:39 AM owned Malaysia

Configuration parameters

  • api_key — API Key (required)
  • region — Region
  • other_region — Other Region
  • incidentType — Incident type
  • mirror_direction — Incident Mirroring Direction
  • isFetch — Fetch incidents
  • first_fetch — First Fetch Time
  • max_fetch — Max Fetch
  • issue_type — Issue Type
  • locations — Locations
  • severity_filter — Severity
  • investigation_status — Investigation Status
  • advanced_filter — Advanced Filter
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (6)

  • cycognito-asset-get

    Retrieves information about a specific asset according to the specified asset type and asset ID.

  • cycognito-asset-investigation-status-change

    Modifies the investigation status of the specified asset.

  • cycognito-assets-list

    Retrieves the list of assets that meet specified filter criteria.

  • cycognito-issue-get

    Retrieves information about an issue associated with a particular instance based on the provided issue instance ID.

  • cycognito-issue-investigation-status-change

    Modifies the investigation status of the specified issue.

  • cycognito-issues-list

    Retrieves the list of the issues that meet the specified filter criteria.

Source

CyCognito.py CyCognito_test.py CyCognito.yml CyCognito_description.md
Download History Raw 
## CyCognito

In order to receive your API key, please contact CyCognito's support team at <support@cycognito.com>.