Cybersixgill_Actionable_Alerts

Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined organization assets, and automatically alerts users in real time of any relevant intelligence items.

Data Enrichment & Threat Intelligence · Cybersixgill Actionable Alerts

Details

ID	`Cybersixgill_Actionable_Alerts`
Provider	Bitsight
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/sixgill:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined
organization assets, and automatically alerts users in real time of any relevant intelligence items.

The integration will focus on retrieving Cybersixgill’s Actionable Alerts as incidents

Use Cases

Fetch Incidents & Events

Configure Cybersixgill on XSOAR

Parameter	Description	Required
client_id	Cybersixgill API client ID	True
client_secret	Cybersixgill API client secret	True
threat_level	Filter by alert threat level	False
threat_type	Filter by alert threat type	False

Fetch incidents

You can execute these commands from the XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

output

[{
'name': "<alert name>",
'occurred': '<occurred>',
'details': '<details>',
'severity': <severity>,
'rawJSON': '{
    "alert_name": "<alert name>",
    "category": "regular",
    "content": "<some content>",
    "date": "<date>",
    "id": "<id>",
    "lang": "English",
    "langcode": "en",
    "read": false,
    "threat_level": "imminent",
    "threats": ["Fraud"],
    "title": "<title>",
    "user_id": "<id>",
    "sixgill_severity": 10}'
}]

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cybersixgill-update-alert-status

updates the existing actionable alert status

Base Command

cybersixgill-update-alert-status

Input

Argument Name	Description	Required
alert_id	The alert id to update.	Required
alert_status	The new status.	Required
aggregate_alert_id	The aggregate alert id.	Optional

Context Output

There is no context output for this command.

Additional Information

Configuration parameters

client_id — Cybersixgill API client ID (required)
client_secret — Cybersixgill API client secret (required)
org_id — Cybersixgill Organization ID
max_fetch — Maximum number of incidents to fetch - maximum is 25
first_fetch_days — How many days back to fetch incidents on the first run - maximum is 30
threat_level — Filter by alert threat level
threat_type — Filter by alert threat type
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (1)

cybersixgill-update-alert-status
updates the existing actionable alert status.

Source

CybersixgillActionableAlerts.py CybersixgillActionableAlerts_test.py CybersixgillActionableAlerts.yml CybersixgillActionableAlerts_description.md

Download History Raw

 ## Configure an API account
To configure an instance of Cybersixgill's integration in XSOAR, you need to supply your API key and client Secret. Please contact support@cybersixgill.com to receive these.