Details

ID	`CybelAngel`
Provider	CybelAngel
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CybelAngel XSOAR Integration

This integration enables Cortex XSOAR to fetch and manage alerts from the CybelAngel platform, allowing security teams to monitor and respond to digital risk exposure incidents.

Configuration

Prerequisites

CybelAngel API client ID and secret
CybelAngel tenant ID
XSOAR platform version 6.0.0 or later

Setup Instructions

Navigate to Settings > Integrations > Servers & Services
Search for CybelAngel
Click Add instance
Input the following parameters:
- Client ID
- Client Secret
- Tenant ID
- First fetch interval (optional)

Commands

Fetch Incidents

Automatically fetches new CybelAngel alerts as XSOAR incidents.

cybelangel-get-report-by-id

Retrieves detailed information about a specific report.

!cybelangel-get-report-by-id report_id=<report_id>

cybelangel-get-report-attachment

Downloads an attachment from a specified report.

!cybelangel-get-report-attachment report_id=<report_id> attachment_id=<attachment_id> filename=<filename>

cybelangel-remediate

Creates a remediation request for a specific report.

!cybelangel-remediate report_id=<report_id> email=<email> requester_fullname=<name>

cybelangel-get-comments

Retrieves comments associated with a report.

!cybelangel-get-comments report_id=<report_id>

cybelangel-post-comment

Adds a comment to a specified report.

!cybelangel-post-comment report_id=<report_id> comment=<comment>

cybelangel-update-status

Updates the status of a report.

!cybelangel-update-status report_id=<report_id> status=<status>

cybelangel-get-report-pdf

Downloads the PDF version of a report.

!cybelangel-get-report-pdf report_id=<report_id>

Troubleshooting

Authentication Issues

Verify API credentials are correct
Check token expiration (tokens automatically refresh after 1 hour)
Ensure proper network connectivity to CybelAngel endpoints

Incident Fetching

First fetch interval determines initial data pull window
Subsequent fetches use last run time
Check logs for any API errors or rate limiting issues

Known Limitations

Maximum fetch interval is capped at 500 minutes
PDF reports may take longer to download for large files
Attachments must be downloaded individually

Configuration parameters

credentials — CybelAngel Client ID (required)
tenant_id — CybelAngel Tenant ID (required)
first_fetch — First fetch Interval (Select amount of days to fetch back in time) (required)
base_url — Base URL
max_fetch — Max Fetch
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type

Commands (7)

cybelangel-get-comments
Get comments for a report.
cybelangel-get-report-attachment
Get an attachment of a report.
cybelangel-get-report-by-id
Get a report by ID.
cybelangel-get-report-pdf
Downloads a PDF report from CybelAngel by report ID and saves it to the War Room.
cybelangel-post-comment
Post a comment on a report.
cybelangel-remediate
Remediate a report by ID.
cybelangel-update-status
Update the status of a report.

Source

CybelAngel.py CybelAngel_test.py CybelAngel.yml CybelAngel_description.md command_examples.txt

Download History Raw

!cybelangel-get-report-by-id report_id="abcdef12-3456-7890-abcd-ef1234567890"
!cybelangel-get-report-attachment report_id="abcdef12-3456-7890-abcd-ef1234567890" attachment_id="attach123-4567-89ab-cdef-123456789012" file_name="exposed_credentials.pdf"
!cybelangel-get-report-pdf report_id="abcdef12-3456-7890-abcd-ef1234567890"
!cybelangel-remediate report_id="abcdef12-3456-7890-abcd-ef1234567890" email="security.analyst@company.com" requester_fullname="Security Analyst"
!cybelangel-get-comments report_id="abcdef12-3456-7890-abcd-ef1234567890"
!cybelangel-post-comment report_id="abcdef12-3456-7890-abcd-ef1234567890" comment="We have verified this exposure and are taking steps to remediate it."
!cybelangel-update-status report_id="abcdef12-3456-7890-abcd-ef1234567890" status=in_progress