Details

ID	`CybelAngel`
Provider	CybelAngel
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CybelAngel XSOAR Integration

This integration enables Cortex XSOAR to fetch and manage alerts from the CybelAngel platform, allowing security teams to monitor and respond to digital risk exposure incidents.

Configuration

Prerequisites

CybelAngel API client ID and secret
CybelAngel tenant ID
XSOAR platform version 6.0.0 or later

Setup Instructions

Navigate to Settings > Integrations > Servers & Services
Search for CybelAngel
Click Add instance
Input the following parameters:
- Client ID
- Client Secret
- Tenant ID
- First fetch interval (optional)

Commands

Fetch Incidents

Automatically fetches new CybelAngel alerts as XSOAR incidents.

cybelangel-get-report-by-id

Retrieves detailed information about a specific report.

!cybelangel-get-report-by-id report_id=<report_id>

cybelangel-get-report-attachment

Downloads an attachment from a specified report.

!cybelangel-get-report-attachment report_id=<report_id> attachment_id=<attachment_id> filename=<filename>

cybelangel-remediate

Creates a remediation request for a specific report.

!cybelangel-remediate report_id=<report_id> email=<email> requester_fullname=<name>

cybelangel-get-comments

Retrieves comments associated with a report.

!cybelangel-get-comments report_id=<report_id>

cybelangel-post-comment

Adds a comment to a specified report.

!cybelangel-post-comment report_id=<report_id> comment=<comment>

cybelangel-update-status

Updates the status of a report.

!cybelangel-update-status report_id=<report_id> status=<status>

cybelangel-get-report-pdf

Downloads the PDF version of a report.

!cybelangel-get-report-pdf report_id=<report_id>

Troubleshooting

Authentication Issues

Verify API credentials are correct
Check token expiration (tokens automatically refresh after 1 hour)
Ensure proper network connectivity to CybelAngel endpoints

Incident Fetching

First fetch interval determines initial data pull window
Subsequent fetches use last run time
Check logs for any API errors or rate limiting issues

Known Limitations

Maximum fetch interval is capped at 500 minutes
PDF reports may take longer to download for large files
Attachments must be downloaded individually

Configuration parameters

credentials — CybelAngel Client ID (required)
tenant_id — CybelAngel Tenant ID (required)
first_fetch — First fetch Interval (Select amount of days to fetch back in time) (required)
base_url — Base URL
max_fetch — Max Fetch
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type

Commands (7)

cybelangel-get-comments
Get comments for a report.
cybelangel-get-report-attachment
Get an attachment of a report.
cybelangel-get-report-by-id
Get a report by ID.
cybelangel-get-report-pdf
Downloads a PDF report from CybelAngel by report ID and saves it to the War Room.
cybelangel-post-comment
Post a comment on a report.
cybelangel-remediate
Remediate a report by ID.
cybelangel-update-status
Update the status of a report.

Source

CybelAngel.py CybelAngel_test.py CybelAngel.yml CybelAngel_description.md command_examples.txt

Download History Raw

# CybelAngel Integration for Cortex XSOAR

This integration connects Cortex XSOAR with CybelAngel's API to manage and fetch alerts. This document details the setup and configuration using abstracted methods without a direct client class.

## Prerequisites

Ensure you have the following CybelAngel account information:
- **Client ID** 
- **Client Secret** 
- **Tenant ID**

## Configuration Parameters

- **Client ID**: Provided by CybelAngel.
- **Client Secret**: Provided by CybelAngel.
- **Tenant ID**: Required for posting comments on reports.

### Fetch Interval Parameters

- **First Fetch Interval**: Defines how many days of historical data to fetch on the initial connection (in days).
- **Incident Fetch Interval**: Sets the time between regular fetches (in minutes or specified time format).

## Integration Steps

1. **Set Up Authentication**
   - Authentication is based on OAuth 2.0, using Client ID and Client Secret.
   - A token is fetched initially and refreshed based on the token's validity. 

2. **Fetch Incidents Setup**
   - The `first_fetch_interval` parameter is used only on the first run to fetch historical alerts.
   - Subsequent fetches occur based on the `incident_fetch_interval` time.

3. **CybelAngel API Endpoints Used**
   - **Token Fetch**: `/oauth/token`
   - **Reports Fetch**: `/api/v2/reports`
   - **Single Report by ID**: `/api/v2/reports/{report_id}`
   - **Report Attachments**: `/api/v1/reports/{report_id}/attachments/{attachment_id}`
   - **Remediation Request**: `/api/v1/reports/remediation-request`
   - **Comments**: `/api/v1/reports/{report_id}/comments`
   - **Status Update**: `/api/v1/reports/{report_id}/status`
   - **PDF Report**: `/api/v1/reports/{report_id}/pdf`

## Commands Implemented

### Fetch Incidents
Fetches alerts from CybelAngel based on the defined interval. On the first run, it retrieves alerts as per the `first_fetch_interval`.

### Get Report by ID
Retrieves a specific report using the report ID.

### Get Report Attachment
Fetches a specific attachment for a report.

### Remediate
Creates a remediation request for a given report ID.

### Get Comments
Fetches comments associated with a report.

### Post Comment
Posts a comment on a specified report.

### Update Status
Updates the status of a report.

### Get Report PDF
Downloads a PDF version of a report.

## Support and Contact

For further assistance, please contact CybelAngel:
- **Email**: [support@cybelangel.com](mailto:support@cybelangel.com)
- **Support URL**: [CybelAngel Support](https://support.cybelangel.com)

## Example Code Structure (Abstracted)

Refer to the CybelAngel developer documentation for specific API details and response structures.

```python
# Basic example function to fetch a token
def fetch_token(client_id, client_secret):
    # Token fetching logic using client_id and client_secret
    pass

# Example function to fetch reports based on interval
def fetch_reports(interval_minutes):
    # Implement the fetching logic here
    pass