Cybersixgill_Actionable_Alerts

Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined organization assets, and automatically alerts users in real time of any relevant intelligence items.

Data Enrichment & Threat Intelligence · Cybersixgill Actionable Alerts

Details

ID	`Cybersixgill_Actionable_Alerts`
Provider	Bitsight
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/sixgill:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined
organization assets, and automatically alerts users in real time of any relevant intelligence items.

The integration will focus on retrieving Cybersixgill’s Actionable Alerts as incidents

Use Cases

Fetch Incidents & Events

Configure Cybersixgill on XSOAR

Parameter	Description	Required
client_id	Cybersixgill API client ID	True
client_secret	Cybersixgill API client secret	True
threat_level	Filter by alert threat level	False
threat_type	Filter by alert threat type	False

Fetch incidents

You can execute these commands from the XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

output

[{
'name': "<alert name>",
'occurred': '<occurred>',
'details': '<details>',
'severity': <severity>,
'rawJSON': '{
    "alert_name": "<alert name>",
    "category": "regular",
    "content": "<some content>",
    "date": "<date>",
    "id": "<id>",
    "lang": "English",
    "langcode": "en",
    "read": false,
    "threat_level": "imminent",
    "threats": ["Fraud"],
    "title": "<title>",
    "user_id": "<id>",
    "sixgill_severity": 10}'
}]

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cybersixgill-update-alert-status

updates the existing actionable alert status

Base Command

cybersixgill-update-alert-status

Input

Argument Name	Description	Required
alert_id	The alert id to update.	Required
alert_status	The new status.	Required
aggregate_alert_id	The aggregate alert id.	Optional

Context Output

There is no context output for this command.

Additional Information

Configuration parameters

client_id — Cybersixgill API client ID (required)
client_secret — Cybersixgill API client secret (required)
org_id — Cybersixgill Organization ID
max_fetch — Maximum number of incidents to fetch - maximum is 25
first_fetch_days — How many days back to fetch incidents on the first run - maximum is 30
threat_level — Filter by alert threat level
threat_type — Filter by alert threat type
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (1)

cybersixgill-update-alert-status
updates the existing actionable alert status.

Source

CybersixgillActionableAlerts.py CybersixgillActionableAlerts_test.py CybersixgillActionableAlerts.yml CybersixgillActionableAlerts_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Bitsight
sectionorder:
- Connect
- Collect
commonfields:
  id: Cybersixgill_Actionable_Alerts
  version: -1
configuration:
- display: Cybersixgill API client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- display: Cybersixgill API client secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Cybersixgill Organization ID
  name: org_id
  type: 0
  defaultvalue: ''
  section: Connect
  required: false
- defaultvalue: '25'
  display: Maximum number of incidents to fetch - maximum is 25
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '1'
  display: How many days back to fetch incidents on the first run - maximum is 30
  name: first_fetch_days
  type: 0
  section: Collect
  required: false
- display: Filter by alert threat level
  name: threat_level
  options:
  - imminent
  - emerging
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Filter by alert threat type
  name: threat_type
  options:
  - Brand Protection
  - Data Leak
  - Malware
  - Phishing
  - Fraud
  - Vulnerability Exploit
  - Insider Threat
  - Defacement
  - Compromised Accounts
  - DDoS Attack
  - Web Attack
  - Trend Anomaly
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: Cybersixgill Actionable Alerts
  display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- defaultvalue: '5'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
description: Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined organization assets, and automatically alerts users in real time of any relevant intelligence items.
display: Cybersixgill Actionable Alerts
name: Cybersixgill_Actionable_Alerts
script:
  commands:
  - description: updates the existing actionable alert status.
    name: cybersixgill-update-alert-status
    arguments:
    - required: true
      description: The alert id to update.
      name: alert_id
    - required: true
      description: The new status.
      name: alert_status
    - description: The aggregate alert id.
      name: aggregate_alert_id
  dockerimage: demisto/sixgill:1.0.0.10120494
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0
defaultmapperin: Cybersixgill Actionable Alerts - Incoming Mapper