CybelAngel

This integration connects your alerts from CybelAngel.

Data Enrichment & Threat Intelligence · CybelAngel

Details

ID	`CybelAngel`
Provider	CybelAngel
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CybelAngel XSOAR Integration

This integration enables Cortex XSOAR to fetch and manage alerts from the CybelAngel platform, allowing security teams to monitor and respond to digital risk exposure incidents.

Configuration

Prerequisites

CybelAngel API client ID and secret
CybelAngel tenant ID
XSOAR platform version 6.0.0 or later

Setup Instructions

Navigate to Settings > Integrations > Servers & Services
Search for CybelAngel
Click Add instance
Input the following parameters:
- Client ID
- Client Secret
- Tenant ID
- First fetch interval (optional)

Commands

Fetch Incidents

Automatically fetches new CybelAngel alerts as XSOAR incidents.

cybelangel-get-report-by-id

Retrieves detailed information about a specific report.

!cybelangel-get-report-by-id report_id=<report_id>

cybelangel-get-report-attachment

Downloads an attachment from a specified report.

!cybelangel-get-report-attachment report_id=<report_id> attachment_id=<attachment_id> filename=<filename>

cybelangel-remediate

Creates a remediation request for a specific report.

!cybelangel-remediate report_id=<report_id> email=<email> requester_fullname=<name>

cybelangel-get-comments

Retrieves comments associated with a report.

!cybelangel-get-comments report_id=<report_id>

cybelangel-post-comment

Adds a comment to a specified report.

!cybelangel-post-comment report_id=<report_id> comment=<comment>

cybelangel-update-status

Updates the status of a report.

!cybelangel-update-status report_id=<report_id> status=<status>

cybelangel-get-report-pdf

Downloads the PDF version of a report.

!cybelangel-get-report-pdf report_id=<report_id>

Troubleshooting

Authentication Issues

Verify API credentials are correct
Check token expiration (tokens automatically refresh after 1 hour)
Ensure proper network connectivity to CybelAngel endpoints

Incident Fetching

First fetch interval determines initial data pull window
Subsequent fetches use last run time
Check logs for any API errors or rate limiting issues

Known Limitations

Maximum fetch interval is capped at 500 minutes
PDF reports may take longer to download for large files
Attachments must be downloaded individually

Configuration parameters

credentials — CybelAngel Client ID (required)
tenant_id — CybelAngel Tenant ID (required)
first_fetch — First fetch Interval (Select amount of days to fetch back in time) (required)
base_url — Base URL
max_fetch — Max Fetch
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type

Commands (7)

cybelangel-get-comments
Get comments for a report.
cybelangel-get-report-attachment
Get an attachment of a report.
cybelangel-get-report-by-id
Get a report by ID.
cybelangel-get-report-pdf
Downloads a PDF report from CybelAngel by report ID and saves it to the War Room.
cybelangel-post-comment
Post a comment on a report.
cybelangel-remediate
Remediate a report by ID.
cybelangel-update-status
Update the status of a report.

Source

CybelAngel.py CybelAngel_test.py CybelAngel.yml CybelAngel_description.md command_examples.txt

Download History Raw

commonfields:
  id: CybelAngel
  version: -1
configuration:
- section: Connect
  additionalinfo: Client ID & Secret for OAuth 2.0 Authentication for CybelAngel API
  display: CybelAngel Client ID
  name: credentials
  required: true
  type: 9
- section: Connect
  additionalinfo: CybelAngel Tenant ID to create comments on reports
  display: CybelAngel Tenant ID
  name: tenant_id
  required: true
  type: 0
- section: Collect
  defaultvalue: 7
  display: First fetch Interval (Select amount of days to fetch back in time)
  name: first_fetch
  required: true
  type: 0
- section: Collect
  additionalinfo: Base Url for CybelAngel platform
  defaultvalue: https://platform.cybelangel.com
  display: Base URL
  name: base_url
  required: false
  type: 0
- section: Collect
  additionalinfo: Maximum number of incidents to fetch per fetch cycle (This doesn't do anything)
  defaultvalue: 50
  display: Max Fetch
  name: max_fetch
  required: false
  type: 0
- section: Collect
  display: Fetch incidents
  name: isFetch
  required: false
  type: 8
- section: Collect
  defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
- section: Collect
  display: Incident type
  name: incidentType
  required: false
  type: 13
description: This integration connects your alerts from CybelAngel.
display: CybelAngel EASM
name: CybelAngel
script:
  commands:
  - arguments:
    - description: The ID of the report to retrieve.
      name: report_id
      required: true
    description: Get a report by ID.
    name: cybelangel-get-report-by-id
    outputs:
    - contextPath: CybelAngel.Report
      description: Details of the report.
      type: String
  - arguments:
    - description: The ID of the report to get the attachment from.
      name: report_id
      required: true
    - description: The ID of the attachment to retrieve.
      name: attachment_id
      required: true
    - description: The the name of the file.
      name: file_name
      required: true
    description: Get an attachment of a report.
    name: cybelangel-get-report-attachment
    outputs:
    - contextPath: CybelAngel.ReportAttachment
      description: Attachment details.
      type: String
  - arguments:
    - description: The ID of the report to download as PDF.
      name: report_id
      required: true
    description: Downloads a PDF report from CybelAngel by report ID and saves it to the War Room.
    name: cybelangel-get-report-pdf
    outputs:
    - contextPath: CybelAngel.PDFReport.fileID
      description: The War Room file ID of the downloaded PDF.
      type: String
    - contextPath: CybelAngel.PDFReport.reportID
      description: The report ID corresponding to the downloaded PDF.
      type: String
    - contextPath: CybelAngel.PDFReport.fileName
      description: The filename of the downloaded PDF.
      type: String
  - arguments:
    - description: The ID of the report to remediate.
      name: report_id
      required: true
    - description: Email needed for the request.
      name: email
      required: true
    - description: The full name of the requestor.
      name: requester_fullname
      required: true
    description: Remediate a report by ID.
    name: cybelangel-remediate
    outputs:
    - contextPath: CybelAngel.Remediation
      description: Remediation status.
      type: String
  - arguments:
    - description: The ID of the report to get comments for.
      name: report_id
      required: true
    description: Get comments for a report.
    name: cybelangel-get-comments
    outputs:
    - contextPath: CybelAngel.Comments
      description: Comments on the report.
      type: String
  - arguments:
    - description: The ID of the report to post a comment on.
      name: report_id
      required: true
    - description: The comment to post.
      name: comment
      required: true
    description: Post a comment on a report.
    name: cybelangel-post-comment
  - arguments:
    - description: The ID of the report to update the status of.
      name: report_id
      required: true
    - description: The new status of the report.
      name: status
      predefined:
      - open
      - in_progress
      - resolved
      - discarded
      required: true
      auto: PREDEFINED
    description: Update the status of a report.
    name: cybelangel-update-status
    outputs:
    - contextPath: CybelAngel.StatusUpdate
      description: Status update details.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)
category: "Data Enrichment & Threat Intelligence"
provider: CybelAngel
sectionorder:
- Connect
- Collect