CTM360_CyberBlindspot

Take action on incidents derived from CTM360 CBS threat intelligence that is directly linked to your organization.

Analytics & SIEM · CTM360

Details

IDCTM360_CyberBlindspot
ProviderCTM360
CategoryAnalytics & SIEM
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Take action on incidents derived from CTM360 CBS threat intelligence that is directly linked to your organization.
This integration was integrated and tested with version 1.0.0 of CTM360_CyberBlindspot.

Configure CTM360 CyberBlindspot in Cortex

Parameter Description Required
Incident Mirroring Direction Choose the direction to mirror the incident: Incoming (from CyberBlindspot to Cortex XSOAR), Outgoing (from Cortex XSOAR to CyberBlindspot), or Incoming and Outgoing (from/to Cortex XSOAR and CyberBlindspot). False
Module To Use The module to use: Incidents, Compromised Cards, Breached Credentials, Malware Logs, Domain/Subdomain Infringements, Social Media Fraud, Gambling Sites, or Money Mules. False
Retrieve Screenshots   False
First fetch (<number> <time unit>, e.g., 12 hours. Default is 7 days) The time the incidents should be fetched starting from. False
API Key The CTM360 CyberBlindspot API Key to use for fetching data. True
Maximum Number of Incidents per Fetch Default is 25. Maximum is 200. True
Fetch incidents   False
Trust any certificate (not secure)   False
Use system proxy settings   False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ctm360-cbs-incident-list

Get the list of incidents from CBS.

Base Command

ctm360-cbs-incident-list

Input

Argument Name Description Required
dateFrom Select “From” date to fetch incidents starting from it. Optional
dateTo Select “To” date to fetch incidents up to it. Optional
maxHits Set number of results to fetch. Optional
order Set the order of the results. Optional

Context Output

Path Type Description
CyberBlindspot.IncidentList unknown List of all CBS incidents.

Command example

!ctm360-cbs-incident-list dateFrom="23-10-2023 07:00" dateTo="23-10-2023 23:00" order=asc maxHits=2

Context Example

{
    "CyberBlindspot": {
        "IncidentList": [
            {
                "CustomFields": {
                    "cbs_class": "Link",
                    "cbs_coa": "Member Side Action",
                    "cbs_status": "Member Feedback",
                    "cbs_subject": "2 customer credentials compromised (5d65815)",
                    "cbs_timestamp": 1698049692779,
                    "cbs_type": "Leaked Credential",
                    "cbs_updated_date": "2023-10-23T08:00:00+00:00"
                },
                "externalstatus": "Member Feedback",
                "name": "New leaked_credential with severity High found",
                "occurred": "2023-10-23T08:00:00+00:00",
                "rawJson": "{\"name\": \"New leaked_credential with severity High found\", \"occurred\": \"2023-10-23T08:00:00+00:00\", \"type\": \"Leaked Credential\", \"externalstatus\": \"Member Feedback\", \"severity\": 3, \"CustomFields\": {\"cbs_status\": \"Member Feedback\", \"cbs_subject\": \"2 customer credentials compromised (5d65815)\", \"cbs_class\": \"Link\", \"cbs_type\": \"Leaked Credential\", \"cbs_coa\": \"Member Side Action\", \"cbs_timestamp\": 1698049692779, \"cbs_updated_date\": \"2023-10-23T08:00:00+00:00\"}, \"xsoar_mirroring\": {\"mirror_direction\": \"Both\", \"mirror_id\": \"COMY123642991153\", \"mirror_instance\": \"CTM360_CyberBlindspot_instance_1\"}}",
                "severity": 3,
                "type": "Leaked Credential",
                "xsoar_mirroring": {
                    "mirror_direction": "Both",
                    "mirror_id": "COMY123642991153",
                    "mirror_instance": "CTM360_CyberBlindspot_instance_1"
                }
            },
            {
                "CustomFields": {
                    "cbs_class": "Link",
                    "cbs_coa": "Member Side Action",
                    "cbs_status": "Member Feedback",
                    "cbs_subject": "2 customer credentials compromised (a86fda8)",
                    "cbs_timestamp": 1698051145410,
                    "cbs_type": "Leaked Credential",
                    "cbs_updated_date": "2023-10-23T08:00:00+00:00"
                },
                "externalstatus": "Member Feedback",
                "name": "New leaked_credential with severity High found",
                "occurred": "2023-10-23T08:00:00+00:00",
                "rawJson": "{\"name\": \"New leaked_credential with severity High found\", \"occurred\": \"2023-10-23T08:00:00+00:00\", \"type\": \"Leaked Credential\", \"externalstatus\": \"Member Feedback\", \"severity\": 3, \"CustomFields\": {\"cbs_status\": \"Member Feedback\", \"cbs_subject\": \"2 customer credentials compromised (a86fda8)\", \"cbs_class\": \"Link\", \"cbs_type\": \"Leaked Credential\", \"cbs_coa\": \"Member Side Action\", \"cbs_timestamp\": 1698051145410, \"cbs_updated_date\": \"2023-10-23T08:00:00+00:00\"}, \"xsoar_mirroring\": {\"mirror_direction\": \"Both\", \"mirror_id\": \"COMY123073588255\", \"mirror_instance\": \"CTM360_CyberBlindspot_instance_1\"}}",
                "severity": 3,
                "type": "Leaked Credential",
                "xsoar_mirroring": {
                    "mirror_direction": "Both",
                    "mirror_id": "COMY123073588255",
                    "mirror_instance": "CTM360_CyberBlindspot_instance_1"
                }
            }
        ]
    }
}

Human Readable Output

Results

CustomFields externalstatus name occurred rawJson severity type xsoar_mirroring
cbs_status: Member Feedback
cbs_subject: 2 customer credentials compromised (5d65815)
cbs_class: Link
cbs_type: Leaked Credential
cbs_coa: Member Side Action
cbs_timestamp: 1698049692779
cbs_updated_date: 2023-10-23T08:00:00+00:00		 Member Feedback New leaked_credential with severity High found 2023-10-23T08:00:00+00:00 {“name”: “New leaked_credential with severity High found”, “occurred”: “2023-10-23T08:00:00+00:00”, “type”: “Leaked Credential”, “externalstatus”: “Member Feedback”, “severity”: 3, “CustomFields”: {“cbs_status”: “Member Feedback”, “cbs_subject”: “2 customer credentials compromised (5d65815)”, “cbs_class”: “Link”, “cbs_type”: “Leaked Credential”, “cbs_coa”: “Member Side Action”, “cbs_timestamp”: 1698049692779, “cbs_updated_date”: “2023-10-23T08:00:00+00:00”}, “xsoar_mirroring”: {“mirror_direction”: “Both”, “mirror_id”: “COMY123642991153”, “mirror_instance”: “CTM360_CyberBlindspot_instance_1”}} 3 Leaked Credential mirror_direction: Both
mirror_id: COMY123642991153
mirror_instance: CTM360_CyberBlindspot_instance_1
cbs_status: Member Feedback
cbs_subject: 2 customer credentials compromised (a86fda8)
cbs_class: Link
cbs_type: Leaked Credential
cbs_coa: Member Side Action
cbs_timestamp: 1698051145410
cbs_updated_date: 2023-10-23T08:00:00+00:00		 Member Feedback New leaked_credential with severity High found 2023-10-23T08:00:00+00:00 {“name”: “New leaked_credential with severity High found”, “occurred”: “2023-10-23T08:00:00+00:00”, “type”: “Leaked Credential”, “externalstatus”: “Member Feedback”, “severity”: 3, “CustomFields”: {“cbs_status”: “Member Feedback”, “cbs_subject”: “2 customer credentials compromised (a86fda8)”, “cbs_class”: “Link”, “cbs_type”: “Leaked Credential”, “cbs_coa”: “Member Side Action”, “cbs_timestamp”: 1698051145410, “cbs_updated_date”: “2023-10-23T08:00:00+00:00”}, “xsoar_mirroring”: {“mirror_direction”: “Both”, “mirror_id”: “COMY123073588255”, “mirror_instance”: “CTM360_CyberBlindspot_instance_1”}} 3 Leaked Credential mirror_direction: Both
mirror_id: COMY123073588255
mirror_instance: CTM360_CyberBlindspot_instance_1

ctm360-cbs-incident-close

Close a CBS incident.

Base Command

ctm360-cbs-incident-close

Input

Argument Name Description Required
ticketId “Ticket ID” of the incident to close. Required

Context Output

There is no context output for this command.

Command example

!ctm360-cbs-incident-close ticketId="COMX41148897294"

Human Readable Output

Incident closed successfully

ctm360-cbs-incident-request-takedown

Request a takedown of the asset where the incident was found.

Base Command

ctm360-cbs-incident-request-takedown

Input

Argument Name Description Required
ticketId “Ticket ID” of the incident to request takedown. Required

Context Output

There is no context output for this command.

Command example

!ctm360-cbs-incident-request-takedown ticketId="COMX415993788418"

Human Readable Output

Takedown request executed successfully

get-mapping-fields

Returns the list of fields for an incident type.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

ctm360-cbs-incident-details

Fetch details of a single incident from the CyberBlindspot platform.

Base Command

ctm360-cbs-incident-details

Input

Argument Name Description Required
ticketId “Ticket ID” of the incident to close. Required

Context Output

Path Type Description
CyberBlindspot.RemoteIncident.id unknown The unique ID for the incident record.
CyberBlindspot.RemoteIncident.brand unknown The organization the incident is associated with.
CyberBlindspot.RemoteIncident.coa unknown The course of action to take.
CyberBlindspot.RemoteIncident.class unknown The classification of the incident on remote server.
CyberBlindspot.RemoteIncident.status unknown The current status of the incident on remote server.
CyberBlindspot.RemoteIncident.severity unknown The severity of the incident.
CyberBlindspot.RemoteIncident.subject unknown The asset or title of the incident.
CyberBlindspot.RemoteIncident.type unknown The incident type on the remote server.
CyberBlindspot.RemoteIncident.remarks unknown The remarks about the incident.
CyberBlindspot.RemoteIncident.created_date unknown The creation date of the incident (legacy).
CyberBlindspot.RemoteIncident.updated_date unknown The date the incident last got updated (legacy).
CyberBlindspot.RemoteIncident.first_seen unknown The creation date of the incident.
CyberBlindspot.RemoteIncident.last_seen unknown The date the incident last got updated.
CyberBlindspot.RemoteIncident.timestamp unknown The timestamp of when the record was created.
CyberBlindspot.RemoteIncident.card_number unknown The compromised card’s number.
CyberBlindspot.RemoteIncident.cvv unknown The compromised card’s Card Verification Value (CVV).
CyberBlindspot.RemoteIncident.expiry_month unknown The compromised card’s expiration month.
CyberBlindspot.RemoteIncident.expiry_year unknown The compromised card’s expiration year.
CyberBlindspot.RemoteIncident.breach_source unknown The source of the breached data.
CyberBlindspot.RemoteIncident.domain unknown The domain related to the breached data or compromised device.
CyberBlindspot.RemoteIncident.email unknown The email found in the breached data.
CyberBlindspot.RemoteIncident.username unknown The username found in the breached data.
CyberBlindspot.RemoteIncident.password unknown The password found in the breached data or compromised account.
CyberBlindspot.RemoteIncident.executive_name unknown The executive member’s name related to the breached data.
CyberBlindspot.RemoteIncident.confirmation_time unknown The time of infringement confirmation.
CyberBlindspot.RemoteIncident.risks unknown The potential difficulties carried by the infringement.
CyberBlindspot.RemoteIncident.incident_status unknown The status of the infringement incident.
CyberBlindspot.RemoteIncident.screenshots unknown The screenshot evidence if available.
CyberBlindspot.RemoteIncident.date_compromised unknown The date of the compromise.
CyberBlindspot.RemoteIncident.computer_name unknown The name of the computer that was compromised.
CyberBlindspot.RemoteIncident.operating_system unknown The operating system of the compromised device.
CyberBlindspot.RemoteIncident.malware_path unknown The path in which the malware was installed on the compromised device.
CyberBlindspot.RemoteIncident.url_path unknown The path of the URL.
CyberBlindspot.RemoteIncident.masked_password unknown The masked password of the compromised account.
CyberBlindspot.RemoteIncident.software unknown The software that was compromised.
CyberBlindspot.RemoteIncident.user unknown The user of the compromised account.
CyberBlindspot.RemoteIncident.user_domain unknown The domain of the compromised user.
CyberBlindspot.RemoteIncident.website unknown The website that was compromised.
CyberBlindspot.RemoteIncident.sources unknown The sources reporting the compromise.
CyberBlindspot.RemoteIncident.source_uri unknown The source URI of the compromise report.
CyberBlindspot.RemoteIncident.hostname unknown The hostname of the compromised device.
CyberBlindspot.RemoteIncident.stealer_family unknown The family of the malware.
CyberBlindspot.RemoteIncident.external_link unknown The external link to the remote platform.
CyberBlindspot.RemoteIncident.compromise_details unknown The details of the compromise.
CyberBlindspot.RemoteIncident.platform unknown The social network platform for social media fraud findings.
CyberBlindspot.RemoteIncident.risk_score unknown The numeric risk score from CBS.
CyberBlindspot.RemoteIncident.money_mule_id unknown The CBS money mule finding ID.
CyberBlindspot.RemoteIncident.account_identifier unknown The account identifier tied to the money mule.
CyberBlindspot.RemoteIncident.suspect_names unknown The names associated with the money mule.
CyberBlindspot.RemoteIncident.suspect_emails unknown The email addresses associated with the money mule.
CyberBlindspot.RemoteIncident.suspect_phones unknown The phone numbers associated with the money mule.
CyberBlindspot.RemoteIncident.transfer_amount unknown The transfer amount when present.
CyberBlindspot.RemoteIncident.transfer_currency unknown The currency code for the transfer.
CyberBlindspot.RemoteIncident.bank_account_holder_name unknown The name on the bank account.
CyberBlindspot.RemoteIncident.bank_name unknown The bank name tied to the money mule.
CyberBlindspot.RemoteIncident.bank_account_country unknown The country of the bank account.
CyberBlindspot.RemoteIncident.bic unknown The Bank Identifier Code.
CyberBlindspot.RemoteIncident.finding_id unknown The CBS gambling-site finding ID.
CyberBlindspot.RemoteIncident.url unknown The primary gambling site URL.
CyberBlindspot.RemoteIncident.submitted_url unknown The URL submitted to CBS for scanning.
CyberBlindspot.RemoteIncident.landing_url unknown The landing page URL observed for the site.
CyberBlindspot.RemoteIncident.title unknown The page title observed during scan.
CyberBlindspot.RemoteIncident.resolving_ip unknown The resolved IP for the gambling site.
CyberBlindspot.RemoteIncident.tags unknown The tags applied to the gambling site finding.
CyberBlindspot.RemoteIncident.status_code unknown The HTTP status code from scan.
CyberBlindspot.RemoteIncident.url_status unknown The URL reachability status.
CyberBlindspot.RemoteIncident.scan_status unknown The scan completion status.
CyberBlindspot.RemoteIncident.enrichment unknown The DNS enrichment payload.
CyberBlindspot.RemoteIncident.external_links unknown The external links discovered on the gambling site.
CyberBlindspot.RemoteIncident.internal_links unknown The internal links discovered on the gambling site.

ctm360-cbs-incident-retrieve-screenshots

Retrieves screenshot evidence if available.

Base Command

ctm360-cbs-incident-retrieve-screenshots

Input

Argument Name Description Required
files The files to retrieve. Required

Context Output

Path Type Description
InfoFile.Name string FileName.
InfoFile.EntryID string The EntryID of the report.
InfoFile.Size number File Size.
InfoFile.Type string File type e.g. “PE”.
InfoFile.Info string Basic information of the file.

get-remote-data

Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Argument Name Description Required
id The incident ID. Required
lastUpdate Retrieves entries that were created after lastUpdate. Required

Context Output

There is no context output for this command.

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time. Required

Context Output

There is no context output for this command.

update-remote-system

Updates the remote system with local changes.

Base Command

update-remote-system

Input

Argument Name Description Required
remoteId Remote ID of incident to update in the remote system. Required

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and CTM360 CyberBlindspot corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Turns off incident mirroring.
    Incoming Any changes in CTM360 CyberBlindspot events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
    Outgoing Any changes in Cortex XSOAR incidents will be reflected in CTM360 CyberBlindspot events (outgoing mirrored fields).
    Incoming And Outgoing Changes in Cortex XSOAR incidents and CTM360 CyberBlindspot events will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and CTM360 CyberBlindspot.

Configuration parameters

  • mirror_direction — Incident Mirroring Direction
  • module_to_use — Module To Use
  • retrieve_screenshots — Retrieve Screenshots
  • first_fetch — First fetch (<number> <time unit>, e.g., 12 hours. Default is `7 days`)
  • api_key — (required)
  • max_fetch — Maximum Number of Incidents per Fetch (required)
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (9)

  • ctm360-cbs-incident-close

    Close a CBS incident.

  • ctm360-cbs-incident-details

    Fetch details of a single incident from the CyberBlindspot platform.

  • ctm360-cbs-incident-list

    Get the list of incidents from CBS.

  • ctm360-cbs-incident-request-takedown

    Request a takedown of the asset where the incident was found.

  • ctm360-cbs-incident-retrieve-screenshots

    Retrieves screenshot evidence if available.

  • get-mapping-fields

    Returns the list of fields for an incident type.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.

  • get-remote-data

    Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

  • update-remote-system

    Updates the remote system with local changes.

Source

CyberBlindspot.py CyberBlindspot_test.py CyberBlindspot.yml CyberBlindspot_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: CTM360
sectionorder:
- Connect
- Collect
commonfields:
  id: CTM360_CyberBlindspot
  version: -1
configuration:
- additionalinfo: "Choose the direction to mirror the incident: Incoming (from CyberBlindspot to Cortex XSOAR), Outgoing (from Cortex XSOAR to CyberBlindspot), or Incoming and Outgoing (from/to Cortex XSOAR and CyberBlindspot)."
  defaultvalue: Incoming And Outgoing
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- defaultvalue: Incidents
  display: Module To Use
  additionalinfo: "The module to use: Incidents, Compromised Cards, Breached Credentials, Malware Logs, Domain/Subdomain Infringements, Social Media Fraud, Gambling Sites, or Money Mules."
  name: module_to_use
  required: false
  type: 15
  options:
  - Incidents
  - Compromised Cards
  - Breached Credentials
  - Malware Logs
  - Domain Infringement
  - Subdomain Infringement
  - Social Media Fraud
  - Gambling Sites
  - Money Mules
  section: Collect
- name: retrieve_screenshots
  required: false
  type: 8
  defaultvalue: 'true'
  display: Retrieve Screenshots
  section: Collect
  advanced: true
- name: first_fetch
  type: 0
  required: false
  additionalinfo: The time the incidents should be fetched starting from.
  section: Collect
  defaultvalue: 7 days
  display: First fetch (<number> <time unit>, e.g., 12 hours. Default is `7 days`)
  advanced: true
- name: api_key
  type: 9
  required: true
  additionalinfo: The CTM360 CyberBlindspot API Key to use for fetching data.
  section: Connect
  displaypassword: API Key
  hiddenusername: true
- display: Maximum Number of Incidents per Fetch
  name: max_fetch
  type: 0
  required: true
  section: Collect
  defaultvalue: "25"
  additionalinfo: Default is 25. Maximum is 200.
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Incident type
  defaultvalue: CyberBlindspot Incident
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultmapperin: 'CTM360-CyberBlindspot - Incoming Mapper'
description: 'Take action on incidents derived from CTM360 CBS threat intelligence that is directly linked to your organization.'
display: CTM360 CyberBlindspot
name: CTM360_CyberBlindspot
script:
  commands:
  - name: ctm360-cbs-incident-list
    description: Get the list of incidents from CBS.
    arguments:
    - description: Select "From" date to fetch incidents starting from it.
      name: dateFrom
      required: false
    - description: Select "To" date to fetch incidents up to it.
      name: dateTo
      required: false
    - description: Set number of results to fetch.
      name: maxHits
      required: false
    - description: Set the order of the results.
      name: order
      required: false
    outputs:
    - contextPath: CyberBlindspot.IncidentList
      description: List of all CBS incidents.
  - name: ctm360-cbs-incident-close
    description: Close a CBS incident.
    arguments:
    - name: ticketId
      description: '"Ticket ID" of the incident to close.'
      required: true
  - name: ctm360-cbs-incident-request-takedown
    description: Request a takedown of the asset where the incident was found.
    arguments:
    - name: ticketId
      description: '"Ticket ID" of the incident to request takedown.'
      required: true
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type.
    arguments: []
  - name: ctm360-cbs-incident-details
    description: Fetch details of a single incident from the CyberBlindspot platform.
    arguments:
    - description: '"Ticket ID" of the incident to close.'
      name: ticketId
      required: true
    outputs:
    - contextPath: CyberBlindspot.RemoteIncident.id
      description: The unique ID for the incident record.
    - contextPath: CyberBlindspot.RemoteIncident.brand
      description: The organization the incident is associated with.
    - contextPath: CyberBlindspot.RemoteIncident.coa
      description: The course of action to take.
    - contextPath: CyberBlindspot.RemoteIncident.class
      description: The classification of the incident on remote server.
    - contextPath: CyberBlindspot.RemoteIncident.status
      description: The current status of the incident on remote server.
    - contextPath: CyberBlindspot.RemoteIncident.severity
      description: The severity of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.subject
      description: The asset or title of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.type
      description: The incident type on the remote server.
    - contextPath: CyberBlindspot.RemoteIncident.remarks
      description: The remarks about the incident.
    - contextPath: CyberBlindspot.RemoteIncident.created_date
      description: The creation date of the incident (legacy).
    - contextPath: CyberBlindspot.RemoteIncident.updated_date
      description: The date the incident last got updated (legacy).
    - contextPath: CyberBlindspot.RemoteIncident.first_seen
      description: The creation date of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.last_seen
      description: The date the incident last got updated.
    - contextPath: CyberBlindspot.RemoteIncident.timestamp
      description: The timestamp of when the record was created.
    - contextPath: CyberBlindspot.RemoteIncident.card_number
      description: The compromised card's number.
    - contextPath: CyberBlindspot.RemoteIncident.cvv
      description: The compromised card's Card Verification Value (CVV).
    - contextPath: CyberBlindspot.RemoteIncident.expiry_month
      description: The compromised card's expiration month.
    - contextPath: CyberBlindspot.RemoteIncident.expiry_year
      description: The compromised card's expiration year.
    - contextPath: CyberBlindspot.RemoteIncident.breach_source
      description: The source of the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.domain
      description: The domain related to the breached data or compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.email
      description: The email found in the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.username
      description: The username found in the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.password
      description: The password found in the breached data or compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.executive_name
      description: The executive member's name related to the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.confirmation_time
      description: The time of infringement confirmation.
    - contextPath: CyberBlindspot.RemoteIncident.risks
      description: The potential difficulties carried by the infringement.
    - contextPath: CyberBlindspot.RemoteIncident.incident_status
      description: The status of the infringement incident.
    - contextPath: CyberBlindspot.RemoteIncident.screenshots
      description: The screenshot evidence if available.
    - contextPath: CyberBlindspot.RemoteIncident.date_compromised
      description: The date of the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.computer_name
      description: The name of the computer that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.operating_system
      description: The operating system of the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.malware_path
      description: The path in which the malware was installed on the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.url_path
      description: The path of the URL.
    - contextPath: CyberBlindspot.RemoteIncident.masked_password
      description: The masked password of the compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.software
      description: The software that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.user
      description: The user of the compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.user_domain
      description: The domain of the compromised user.
    - contextPath: CyberBlindspot.RemoteIncident.website
      description: The website that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.sources
      description: The sources reporting the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.source_uri
      description: The source URI of the compromise report.
    - contextPath: CyberBlindspot.RemoteIncident.hostname
      description: The hostname of the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.stealer_family
      description: The family of the malware.
    - contextPath: CyberBlindspot.RemoteIncident.external_link
      description: The external link to the remote platform.
    - contextPath: CyberBlindspot.RemoteIncident.compromise_details
      description: The details of the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.platform
      description: The social network platform for social media fraud findings.
    - contextPath: CyberBlindspot.RemoteIncident.risk_score
      description: The numeric risk score from CBS.
    - contextPath: CyberBlindspot.RemoteIncident.money_mule_id
      description: The CBS money mule finding ID.
    - contextPath: CyberBlindspot.RemoteIncident.account_identifier
      description: The account identifier tied to the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_names
      description: The names associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_emails
      description: The email addresses associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_phones
      description: The phone numbers associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.transfer_amount
      description: The transfer amount when present.
    - contextPath: CyberBlindspot.RemoteIncident.transfer_currency
      description: The currency code for the transfer.
    - contextPath: CyberBlindspot.RemoteIncident.bank_account_holder_name
      description: The name on the bank account.
    - contextPath: CyberBlindspot.RemoteIncident.bank_name
      description: The bank name tied to the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.bank_account_country
      description: The country of the bank account.
    - contextPath: CyberBlindspot.RemoteIncident.bic
      description: The Bank Identifier Code.
    - contextPath: CyberBlindspot.RemoteIncident.finding_id
      description: The CBS gambling-site finding ID.
    - contextPath: CyberBlindspot.RemoteIncident.url
      description: The primary gambling site URL.
    - contextPath: CyberBlindspot.RemoteIncident.submitted_url
      description: The URL submitted to CBS for scanning.
    - contextPath: CyberBlindspot.RemoteIncident.landing_url
      description: The landing page URL observed for the site.
    - contextPath: CyberBlindspot.RemoteIncident.title
      description: The page title observed during scan.
    - contextPath: CyberBlindspot.RemoteIncident.resolving_ip
      description: The resolved IP for the gambling site.
    - contextPath: CyberBlindspot.RemoteIncident.tags
      description: The tags applied to the gambling site finding.
    - contextPath: CyberBlindspot.RemoteIncident.status_code
      description: The HTTP status code from scan.
    - contextPath: CyberBlindspot.RemoteIncident.url_status
      description: The URL reachability status.
    - contextPath: CyberBlindspot.RemoteIncident.scan_status
      description: The scan completion status.
    - contextPath: CyberBlindspot.RemoteIncident.enrichment
      description: The DNS enrichment payload.
    - contextPath: CyberBlindspot.RemoteIncident.external_links
      description: The external links discovered on the gambling site.
    - contextPath: CyberBlindspot.RemoteIncident.internal_links
      description: The internal links discovered on the gambling site.
  - name: ctm360-cbs-incident-retrieve-screenshots
    arguments:
    - description: The files to retrieve.
      name: files
      required: true
      isArray: true
    description: Retrieves screenshot evidence if available.
    outputs:
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
  - name: get-remote-data
    arguments:
    - description: The incident ID.
      name: id
      required: true
    - description: Retrieves entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: get-modified-remote-data
    arguments:
    - description: A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
  - name: update-remote-system
    arguments:
    - description: Remote ID of incident to update in the remote system.
      name: remoteId
      required: true
    description: Updates the remote system with local changes.
  isfetch: true
  runonce: false
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)