CybleEvents

Details

ID	`CybleEvents`
Provider	Cyble
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.1983910`
Supported Modules	Agentix

README

Cyble Events is an integration which will help Existing Cyble Vision users. This integration would allow users to access
the API available as part of Vision Licensing and integrate the data into XSOAR.

Configure Cyble Events in Cortex

Parameter	Description	Required
Server URL (e.g. https://example.net)		True
Access Token		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incidents Fetch Interval		False
Incident Fetch Limit	Maximum incidents to be fetched every time. Upper limit is 50 incidents.	True
Incident type		False
Priority	Fetch the events based on priority. All priorities will be considered by default.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you
successfully execute a command, a DBot message appears in the War Room with the command details.

This integration provides the following command(s) which can be used to access Threat Intelligence

cyble-vision-fetch-iocs

Fetch the indicators for the given timeline

Base Command

cyble-vision-fetch-iocs

Input

Argument Name	Description	Required
from	Returns records started with given value. Default is 0.	Optional
limit	Number of records to return (max 1000). Using a smaller limit will get faster responses. Default is 1.	Optional
start_date	Timeline start date in the format “YYYY-MM-DD”. Need to used with end_date as timeline range.	Optional
end_date	Timeline end date in the format “YYYY-MM-DD”. Need to used with start_date as timeline range.	Optional
type	Returns record by type like (CIDR, CVE, domain, email, FileHash-IMPHASH, FileHash-MD5, FileHash-PEHASH, FileHash-SHA1, FileHash-SHA256, FilePath, hostname, IPv4, IPv6, Mutex, NIDS, URI, URL, YARA, osquery, Ja3, Bitcoinaddress, Sslcertfingerprint).	Optional
keyword	Returns records for the specified keyword.	Optional

Context Output

Path	Type	Description
CybleEvents.IoCs.data	String	Returns indicator inital creation date

cyble-vision-fetch-alerts

Fetch Incident Event alerts based on the given parameters. Alerts would have multiple events grouped into one based on
specific service type. So users would see, in certain cases, more events than the limit provides.

Base Command

cyble-vision-fetch-alerts

Input

Argument Name	Description	Required
from	Returns records for the timeline starting from given indice. Default is 0.	Required
limit	Number of records to return (max 50). Using a smaller limit will get faster responses. Default is 5.	Required
start_date	Timeline start date in the format “YYYY/MM/DD”.	Required
end_date	Timeline end date in the format “YYYY/MM/DD”.	Required
order_by	Sorting order for alert fetch either Ascending or Descending. Possible values are: Ascending, Descending. Default is Ascending.	Required
priority	Fetch the events based on priority. Possible values are: high,medium,low,informational.	Optional

Context Output

Path	Type	Description
CybleEvents.Events.eventid	String	Returns the event ID
CybleEvents.Events.eventtype	String	Returns the event type
CybleEvents.Events.severity	Number	Returns the event severity
CybleEvents.Events.occurred	Date	Returns the event occurred timeline
CybleEvents.Events.name	String	Returns the alert title
CybleEvents.Events.cybleeventsname	String	Returns the event name
CybleEvents.Events.cybleeventsbucket	String	Returns the event bucket name
CybleEvents.Events.cybleeventskeyword	String	Returns the event keyword
CybleEvents.Events.cybleeventsalias	String	Returns the event type alias name

cyble-vision-fetch-event-detail

Fetch Incident detail based on event type and event ID

Base Command

cyble-vision-fetch-event-detail

Input

Argument Name	Description	Required
event_type	Event Type of the Incident.	Required
event_id	Event ID of the incident.	Required
from	The value in the field represents the position of records that are retrieved	Required
limit	The value in the field represents the number of events that can be returned, maximum allowed is 1000	Required

Context Output

Path	Type	Description
CybleEvents.Events.Details	String	Returns details for given event of specific type

Configuration parameters

url — URL (required)
token — Access Token (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Incident Fetch Limit (required)
incidentType — Incident type
priority — Priority

Commands (3)

cyble-vision-fetch-alerts
Fetch Incident event alerts based on the given parameters. Alerts would have multiple events grouped into one based on specific service type. So user would see in few cases more events than the limit provided.
cyble-vision-fetch-event-detail
Fetch Incident detail based on event type and event ID.
cyble-vision-fetch-iocs
Fetch the indicators for the given timeline.

Source

CybleEvents.py CybleEvents_test.py CybleEvents.yml CybleEvents_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Cyble
commonfields:
  id: CybleEvents
  version: -1
configuration:
- additionalinfo: Server URL (e.g. https://example.net)
  defaultvalue: https://example.net
  display: URL
  name: url
  required: true
  type: 0
- additionalinfo: Access Token
  display: Access Token
  name: token
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
- additionalinfo: Maximum incidents to be fetched every time. Upper limit is 50 incidents.
  defaultvalue: '1'
  display: Incident Fetch Limit
  name: max_fetch
  required: true
  type: 0
- display: Incident type
  name: incidentType
  type: 13
  required: false
- additionalinfo: Fetch the events based on chosen priority. If not chosen all priority events will be fetched.
  display: Priority
  name: priority
  options:
  - high
  - medium
  - low
  - informational
  type: 15
  required: false
description: Cyble Events for Vision Users. Must have Vision API access to use the threat intelligence.
display: Cyble Events
name: CybleEvents
script:
  commands:
  - arguments:
    - defaultValue: '0'
      description: Returns records started with given value.
      name: from
    - defaultValue: '1'
      description: Number of records to return (max 1000). Using a smaller limit will get faster responses.
      name: limit
    - description: Timeline start date in the format "YYYY-MM-DD". Need to used with end_date as timeline range.
      name: start_date
    - description: Timeline end date in the format "YYYY-MM-DD". Need to used with start_date as timeline range.
      name: end_date
    - description: Returns record by type like (CIDR, CVE, domain, email, FileHash-IMPHASH, FileHash-MD5, FileHash-PEHASH, FileHash-SHA1, FileHash-SHA256, FilePath, hostname, IPv4, IPv6, Mutex, NIDS, URI, URL, YARA, osquery, Ja3, Bitcoinaddress, Sslcertfingerprint).
      name: type
    - description: Returns records for the specified keyword.
      name: keyword
    description: Fetch the indicators for the given timeline.
    name: cyble-vision-fetch-iocs
    outputs:
    - contextPath: CybleEvents.IoCs.data
      description: Returns indicator inital creation date.
      type: String
  - arguments:
    - defaultValue: '0'
      description: Returns records for the timeline starting from given indice.
      name: from
      required: true
    - defaultValue: '5'
      description: Number of records to return (max 50). Using a smaller limit will get faster responses.
      name: limit
      required: true
    - description: Timeline start date in the format "YYYY/MM/DD".
      name: start_date
      required: true
    - description: Timeline end date in the format "YYYY/MM/DD".
      name: end_date
      required: true
    - auto: PREDEFINED
      defaultValue: Ascending
      description: Sorting order for alert fetch either Ascending or Descending.
      name: order_by
      predefined:
      - Ascending
      - Descending
      required: true
    - auto: PREDEFINED
      description: Fetch the events based on priority. All priorities will be considered by default.
      name: priority
      predefined:
      - high
      - medium
      - low
      - informational
    description: Fetch Incident event alerts based on the given parameters. Alerts would have multiple events grouped into one based on specific service type. So user would see in few cases more events than the limit provided.
    name: cyble-vision-fetch-alerts
    outputs:
    - contextPath: CybleEvents.Events.eventid
      description: Returns the event ID.
      type: String
    - contextPath: CybleEvents.Events.eventtype
      description: Returns the event type.
      type: String
    - contextPath: CybleEvents.Events.severity
      description: Returns the event severity.
      type: Number
    - contextPath: CybleEvents.Events.occurred
      description: Returns the event occurred timeline.
      type: Date
    - contextPath: CybleEvents.Events.name
      description: Returns the alert title.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsname
      description: Returns the event name.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsbucket
      description: Returns the event bucket name.
      type: String
    - contextPath: CybleEvents.Events.cybleeventskeyword
      description: Returns the event keyword.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsalias
      description: Returns the event type alias name.
      type: String
  - arguments:
    - description: Event Type of the Incident.
      name: event_type
      required: true
    - description: Event ID of the incident.
      name: event_id
      required: true
    - defaultValue: '0'
      description: The value in the field represents the position of records that are retrieved.
      name: from
      required: true
    - defaultValue: '100'
      description: The value in the field represents the number of events that can be returned, maximum allowed is 1000.
      name: limit
      required: true
    description: Fetch Incident detail based on event type and event ID.
    name: cyble-vision-fetch-event-detail
    outputs:
    - contextPath: CybleEvents.Events.Details
      description: Returns details for given event of specific type.
      type: String
  dockerimage: demisto/python3:3.12.8.1983910
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0