cybleeventsv2

Cyble Events for Vision Users. Must have Vision API access to use the threat intelligence.

Data Enrichment & Threat Intelligence · CybleEventsV2

Details

IDcybleeventsv2
ProviderCyble
CategoryData Enrichment & Threat Intelligence
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Cyble Events for Vision Users. Must have Vision API access to use the threat intelligence.
This integration was integrated and tested with version 2.0 of cybleeventsv2

Configure CybleEventsV2 on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
    Search for CybleEventsV2.
    Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    URL Server URL (e.g., https://example.net\) True
    Access Token Access Token True
    Collections to Fetch Select collections of incidents to be fetched from the dropdown menu False
    Severities to Fetch Select severities of incident to be fetched from the dropdown menu False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
    Incident Fetch Limit Maximum incidents to be fetched every time. Upper limit is 50 incidents False
    Hide Card Details Select to hide CVV and Expiry date of card False
    Update Incident to Remote System Select to update changes in any incident to Vision False
  2. To ensure that fetch incidents works:
    • Select the Fetches incidents radio button.
    • Under Incident type, select Cyble Vision Alert V2.
  3. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyble-vision-subscribed-services

Get list of Subscribed services

Base Command

cyble-vision-subscribed-services

Input

There are no input arguments for this command.

Context Output

Path Type Description
CybleEvents.SubscribedServices String A list of subscribed services from Cyble vision

cyble-vision-fetch-iocs

Fetch the indicators in the given timeline.

Base Command

cyble-vision-fetch-iocs

Input

Argument Name Description Required
ioc_type Returns records according to their type (Domain, FileHash-MD5, FileHash-SHA1, FileHash-SHA256, IPv4, IPv6, URL, Email, Wallet-Address). Default is Domain. Optional
ioc Returns records for the specified indicator value. Optional
from Returns records that starts from the given page number (the value of the form parameter) in the results list. Default is 1. Optional
limit Number of records to return (max 100). Using a smaller limit will get faster responses. Default is 1. Optional
sort_by Sorting based on the column(last_seen,first_seen,ioc_type). Possible values are: last_seen, first_seen, ioc_type. Default is last_seen. Optional
order Sorting order for ioc either Ascending or Descending based on sort by. Default is desc. Optional
tags Returns records for the specified tags. Optional
start_date Timeline start date in the format “YYYY-MM-DD”. Should be used with start_date as timeline range. Optional
end_date Timeline end date in the format “YYYY-MM-DD”. Should be used with end_date as timeline range. Optional

Context Output

Path Type Description
CybleEvents.IoCs.Data String Returns indicator with risk score, confident rating, first seen and last seen

cyble-vision-fetch-alerts

Fetch alerts based on the given parameters. The alerts would have multiple events grouped into one, based on a specific service type. This way the user will see, in some cases, more events than the limit provides.

Base Command

cyble-vision-fetch-alerts

Input

Argument Name Description Required
limit Number of records to return (max 50). Using a smaller limit will get faster responses. Default is 5. Optional
start_date Timeline start date in the format “%Y-%m-%dT%H:%M:%S%z” (iso-8601). Required
end_date Timeline end date in the format “%Y-%m-%dT%H:%M:%S%z” (iso-8601). Required
order_by Sorting order for alert fetch either Ascending or Descending. Possible values are: asc, desc. Default is asc. Optional
from Returns records for the timeline starting from the given indice. Default is 0. Optional

Context Output

Path Type Description
CybleEvents.Events.name String Return Event name
CybleEvents.Events.alert_group_id String Return alert group id
CybleEvents.Events.event_id String Return event id
CybleEvents.Events.keyword Unknown Return keywords

cyble-vision-fetch-alert-groups

Fetch incident event group

Base Command

cyble-vision-fetch-alert-groups

Input

Argument Name Description Required
order_by Sorting order for alert fetch either Ascending or Descending. Possible values are: asc, desc. Default is asc. Optional
limit Number of records to return (max 50). Using a smaller limit will get faster responses. Default is 5. Optional
start_date Timeline start date in the format “%Y-%m-%dT%H:%M:%S%z” (iso-8601). Required
end_date Timeline end date in the format “%Y-%m-%dT%H:%M:%S%z” (iso-8601). Required
from `Returns records that starts from the given page number (the value of the form parameter) in the results list. Default is 0. Required

Context Output

Path Type Description
CybleEvents.AlertGroup String Fetch all the alert groups

update-alert-data

Update the status and/or severity of one or more alerts by ID.

Base Command

cyble-vision-update-alerts

Input

Argument Name Description Required
ids The alert ID(s) to update. Comma-separated if multiple. Required
status The new status to assign to the alert(s). Provide a single value or one per alert, comma-separated. Optional
severity The new severity to assign to the alert(s). Provide a single value or one per alert, comma-separated. Optional

Context Output

Path Type Description
CybleEvents.AlertUpdate.id String The alert ID that was updated.
CybleEvents.AlertUpdate.status String The updated status.
CybleEvents.AlertUpdate.user_severity String The updated user severity.
CybleEvents.AlertUpdate.service String The service associated with the alert.

Command Example

```bash
!update-alert-data ids=”id1,id2” status=”UNDER_REVIEW,RESOLVED” severity=”HIGH,LOW”

Configuration parameters

  • base_url — URL (required)
  • credentials — (required)
  • incident_collections — Colletions to fetch
  • incident_severity — Severity
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • max_fetch — Incident Fetch Limit
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • first_fetch_timestamp — First fetch time (by hours)
  • hide_data — Hide Card Details
  • mirror — Update Incident to Remote System

Commands (9)

  • cyble-vision-fetch-alert-groups

    Fetch incident event group.

  • cyble-vision-fetch-alerts

    Fetch alerts based on the given parameters. The alerts would have multiple events grouped into one, based on a specific service type. This way the user will see, in some cases, more events than the limit provides.

  • cyble-vision-fetch-iocs

    Fetch the indicators in the given timeline.

  • cyble-vision-subscribed-services

    Get list of Subscribed services.

  • cyble-vision-update-alerts

    Update multiple Cyble alerts with new status/severity. Service is auto-resolved per alert ID.

  • get-mapping-fields

    Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

  • get-modified-remote-data

    Checks for incidents modified since the last synchronization time to enable incremental data fetching.

  • get-remote-data

    Retrieves the latest data for a specific remote incident by its ID, updating only if modified since the given timestamp.

  • update-remote-system

    Updates alert status/severity on Cyble Vision when mirrored incidents change in Cortex (outgoing mirroring).

Source

CybleEventsV2.py CybleEventsV2_test.py CybleEventsV2.yml CybleEventsV2_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Cyble
commonfields:
  id: cybleeventsv2
  version: -1
configuration:
- additionalinfo: Server URL (e.g. <https://example.net>)
  defaultvalue: <https://example.net>
  display: URL
  name: base_url
  required: true
  type: 0
  section: Connect
- displaypassword: Access Token
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Colletions to fetch
  name: incident_collections
  type: 16
  required: false
  additionalinfo: Type(s) of incidents to fetch.
  options:
  - Darkweb Marketplaces
  - Data Breaches
  - Compromised Endpoints
  - Compromised Cards
  - All collections
  hidden: false
  section: Collect
- display: Severity
  name: incident_severity
  type: 16
  required: false
  additionalinfo: Severity of incidents to fetch.
  options:
  - Low
  - Medium
  - High
  - All severities
  hidden: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Incident Fetch Limit
  name: max_fetch
  type: 0
  required: false
  additionalinfo: Maximum incidents to be fetched every time. Upper limit is 1000 incidents.
  defaultvalue: '300'
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: First fetch time (by hours)
  name: first_fetch_timestamp
  required: false
  type: 0
  additionalinfo: Time interval for first fetch (retroactive), by hours only. Maximum of 3 hours for retroactive value is allowed.
  defaultvalue: '1'
  section: Collect
- display: Hide Card Details
  hidden: false
  name: hide_data
  required: false
  type: 8
  section: Collect
- display: Update Incident to Remote System
  hidden: false
  name: mirror
  required: false
  type: 8
  section: Collect
description: Cyble Events for Vision Users. Must have Vision API access to use the threat intelligence.
display: CybleEvents v2
name: cybleeventsv2
script:
  commands:
  - description: Update multiple Cyble alerts with new status/severity. Service is auto-resolved per alert ID.
    name: cyble-vision-update-alerts
    outputs:
    - contextPath: CybleEvents.AlertUpdate.id
      description: Alert ID that was updated.
      type: string
    - contextPath: CybleEvents.AlertUpdate.service
      description: Service corresponding to the alert.
      type: string
    - contextPath: CybleEvents.AlertUpdate.status
      description: Updated alert status (if provided).
      type: string
    - contextPath: CybleEvents.AlertUpdate.user_severity
      description: Updated alert severity (if provided).
      type: string

    arguments:
    - name: ids
      description: |
        Comma-separated list of alert IDs to update.
        Example: b9c5573d-4c3e-54c1-b340-7d9d7244350e,8a8e2bfc-2c39-5cd2-ae1f-8a8dc6f67b94 .
      required: true
    - name: status
      description: |
        Comma-separated list of statuses. Must be one value (applied to all alerts) or exactly match the number of IDs.
        Example: INFORMATIONAL or REVIEWED,RESOLVED .
      required: false
    - name: severity
      description: |
        Comma-separated list of user severity levels. Must be one value or exactly match the number of IDs.
        Example: HIGH or LOW,MEDIUM.
      required: false
  - description: Get list of Subscribed services.
    name: cyble-vision-subscribed-services
    outputs:
    - contextPath: CybleEvents.SubscribedServices
      description: A list of subscribed services from Cyble vision.
      type: String
  - arguments:
    - defaultValue: 'Domain'
      description: Returns records according to their type (Domain, FileHash-MD5, FileHash-SHA1, FileHash-SHA256, IPv4, IPv6, URL, Email).
      name: ioc_type
      auto: PREDEFINED
      isArray: true
      predefined:
      - Domain
      - FileHash-MD5
      - FileHash-SHA1
      - FileHash-SHA256
      - IPv4
      - IPv6
      - URL
      - Emai
    - description: Returns records for the specified indicator value.
      name: ioc
    - description: Returns records that starts from the given page number (the value of the form parameter) in the results list.
      name: from
      defaultValue: '1'
    - defaultValue: '1'
      description: Number of records to return (max 100). Using a smaller limit will get faster responses.
      name: limit
    - defaultValue: 'last_seen'
      description: Sorting based on the column (last_seen, first_seen, ioc_type).
      name: sort_by
      auto: PREDEFINED
      predefined:
      - last_seen
      - first_seen
      - ioc_type
    - auto: PREDEFINED
      default: true
      defaultValue: asc
      description: A sorting order for ioc.
      name: order
      predefined:
      - asc
      - desc
    - description: Returns records for the specified tags.
      name: tags
    - description: Timeline start date in the format "YYYY-MM-DD". Should be used with start_date as timeline range.
      name: start_date
    - description: Timeline end date in the format "YYYY-MM-DD". Should be used with end_date as timeline range.
      name: end_date
    description: Fetch the indicators in the given timeline.
    name: cyble-vision-fetch-iocs
    outputs:
    - contextPath: CybleEvents.IoCs.Data
      description: Returns indicator with risk score, confident rating, first seen and last seen.
      type: String
  - arguments:
    - defaultValue: '5'
      description: Number of records to return (max 50). Using a smaller limit will get faster responses.
      name: limit
    - description: Timeline start date in the format "%Y-%m-%dT%H:%M:%S%z" (iso-8601).
      name: start_date
      required: true
    - description: Timeline end date in the format "%Y-%m-%dT%H:%M:%S%z" (iso-8601).
      name: end_date
      required: true
    - description: A sorting order for the fetched alerts.
      name: order_by
      auto: PREDEFINED
      defaultValue: asc
      predefined:
      - asc
      - desc
    - defaultValue: '0'
      description: Returns records for the timeline starting from the given indice.
      name: from
    description: Fetch alerts based on the given parameters. The alerts would have multiple events grouped into one, based on a specific service type. This way the user will see, in some cases, more events than the limit provides.
    name: cyble-vision-fetch-alerts
    outputs:
    - contextPath: CybleEvents.Events.name
      description: Return Event name.
      type: String
    - contextPath: CybleEvents.Events.alert_group_id
      description: Return alert group id.
      type: String
    - contextPath: CybleEvents.Events.event_id
      description: Return event id.
      type: String
    - contextPath: CybleEvents.Events.keyword
      description: Return keywords.
      type: Unknown

    execution: true
  - description: Fetch incident event group.
    name: cyble-vision-fetch-alert-groups
    arguments:
    - auto: PREDEFINED
      defaultValue: asc
      description: A sorting order for the fetched alerts.
      name: order_by
      predefined:
      - asc
      - desc
    - defaultValue: '5'
      description: Number of records to return (max 50). Using a smaller limit will get faster responses.
      name: limit
    - description: Timeline start date in the format "%Y-%m-%dT%H:%M:%S%z" (iso-8601).
      name: start_date
      required: true
    - description: Timeline end date in the format "%Y-%m-%dT%H:%M:%S%z"  (iso-8601).
      name: end_date
      required: true
    - defaultValue: '0'
      description: Returns records for the timeline starting from the given indice.
      name: from
      required: true
    outputs:
    - contextPath: CybleEvents.AlertGroup
      description: Fetch all the alert groups.
      type: String

  - description: Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  - arguments:
    - description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Checks for incidents modified since the last synchronization time to enable incremental data fetching.
    name: get-modified-remote-data
  - name: get-remote-data
    description: Retrieves the latest data for a specific remote incident by its ID, updating only if modified since the given timestamp.
    arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
  - name: update-remote-system
    description: Updates alert status/severity on Cyble Vision when mirrored incidents change in Cortex (outgoing mirroring).
    arguments: []

  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
tests:
- No tests (auto formatted)
fromversion: 6.2.0
sectionorder:
- Connect
- Collect