Details

ID	`CybleThreatIntel`
Provider	Cyble
Category	Data Enrichment & Threat Intelligence
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cyble Threat Intelligence – Cortex XSOAR Integration

This integration enables Cortex XSOAR to ingest and query Indicators of
Compromise (IOCs) from the Cyble Vision API.
It supports two capabilities:

IOC Lookup (Interactive command for analysts)
IOC Fetching (Fetch Indicators)

Overview

The Cyble Vision platform provides enriched, high-fidelity threat
intelligence including malware associations, threat actor links,
behaviour tags, risk scoring, and more.
This integration allows XSOAR to:

Pull fresh IOCs at scheduled intervals
Tag, score, and store indicators in the Cortex XSOAR indicator store
Support analyst lookups for a single IOC via the command line or
playbooks

Configuration

Required Parameters

Parameter	Description	Example
Base URL	Cyble Vision API endpoint	`https://api.cyble.ai/engine/api/v4`
API Key (Access Token)	Cyble Vision API Bearer token	(stored securely in XSOAR)
First fetch time (hours)	Number of hours to fetch backward on first run	`2`
	(1–3 hours allowed)
Indicator Fetch Limit	Maximum indicators per API page	`100`

Fetch Behavior

Fetch is performed in 1-hour chunks until the full range is covered.
Each page of IOCs is inserted immediately using
demisto.createIndicators.
Fetch uses a retry mechanism (up to 5 attempts per page).
last_run is updated after every chunk.
Supported fetch window: 1–3 hours (anything outside is
automatically corrected).

Commands

📌 1. cyble-vision-ioc-lookup

Lookup a single IOC using the Cyble Vision API.

Command

!cyble-vision-ioc-lookup ioc=<IOC_VALUE>

Arguments

Name	Required	Description
ioc	Yes	IOC string (IP / Domain / URL / Hash)

Outputs

Prefix: CybleIntel.IOCLookup

Field	Description
IOC	IOC value
IOC Type	Type (IP / Domain / URL / Hash)
First Seen	UTC timestamp
Last Seen	UTC timestamp
Risk Score	0–100
Sources	Reporting sources
Behaviour Tags	Tags assigned by Cyble
Confidence Rating	Low / Medium / High
Target Countries	Target geography
Target Regions	Regions affected
Target Industries	Target verticals
Related Malware	Linked malware families
Related Threat Actors	Associated threat actors

Example

!cyble-vision-ioc-lookup ioc=45.67.23.9

📌 2. fetch-indicators

Fetch IOCs from Cyble Vision and insert them into XSOAR’s indicator store.

Execution

This command is not run manually.
It is used by the XSOAR engine when Fetches Indicators is enabled.

Behavior

Builds indicators with:
- cybleverdict
- cybleriskscore
- cyblefirstseen
- cyblelastseen
- cyblebehaviourtags
- cyblesources
- cybletargetcountries
- cybletargetregions
- cybletargetindustries
- cyblerelatedmalware
- cyblerelatedthreatactors
Automatically maps each IOC into XSOAR Indicator fields.
Updates last_run after each successful chunk.

Known Limitations

Fetching supports hours only (days are not supported).
Maximum initial backfill is 3 hours.

Support

For issues, contact support@cyble.com
or your assigned Cyble Technical Advisor.

Configuration parameters

tlp_color — Traffic Light Protocol Color
feedFetchInterval — Feed Fetch Interval
feed — Fetch indicators
feedReliability — Source Reliability (required)
feedReputation — Indicator Reputation
feedTags — Tags
feedExpirationPolicy —
feedExpirationInterval —
feedBypassExclusionList — Bypass exclusion list
base_url — Base URL
credentials — Access Token
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
collection — Collection Name
discovery_service — Discovery Service
initial_interval — First fetch time (by days) (required)
limit — Indicator Fetch Limit

Commands (3)

cyble-vision-fetch-taxii Deprecated
Deprecated command. Do not use.
cyble-vision-get-collection-names Deprecated
Deprecated command. Do not use.
cyble-vision-ioc-lookup
Lookup a single IOC using the Cyble Vision API.

Source

CybleThreatIntel.py CybleThreatIntel_test.py CybleThreatIntel.yml CybleThreatIntel_description.md

Download History Raw

commonfields:
  id: CybleThreatIntel
  version: -1
name: CybleThreatIntel
display: Cyble Threat Intel
category: Data Enrichment & Threat Intelligence
provider: Cyble
description: Cyble Threat Intelligence for Vision Users. Must have access to Cyble TAXII Feed to access the threat intelligence.
configuration:
  - display: Traffic Light Protocol Color
    additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
    name: tlp_color
    type: 15
    options:
      - RED
      - AMBER
      - GREEN
      - WHITE
    required: false
    section: Collect
  - display: Feed Fetch Interval
    name: feedFetchInterval
    type: 19
    section: Collect
    defaultvalue: '1440'
    required: false
  - display: Fetch indicators
    name: feed
    type: 8
    section: Collect
    defaultvalue: 'true'
    required: false
  - display: Source Reliability
    name: feedReliability
    type: 15
    required: true
    defaultvalue: A - Completely reliable
    additionalinfo: Reliability of the source providing the intelligence data.
    options:
      - A - Completely reliable
      - B - Usually reliable
      - C - Fairly reliable
      - D - Not usually reliable
      - E - Unreliable
      - F - Reliability cannot be judged
    section: Collect
  - display: Indicator Reputation
    name: feedReputation
    type: 18
    defaultvalue: None
    options:
      - None
      - Good
      - Suspicious
      - Bad
    required: false
    additionalinfo: Indicators from this integration instance will be marked with
      this reputation.
    section: Collect
  - display: Tags
    name: feedTags
    type: 0
    required: false
    additionalinfo: Supports CSV values.
    section: Collect
  - display: ''
    name: feedExpirationPolicy
    type: 17
    options:
      - never
      - interval
      - indicatorType
      - suddenDeath
    required: false
    section: Collect
  - display: ''
    name: feedExpirationInterval
    type: 1
    required: false
    section: Collect
  - display: Bypass exclusion list
    name: feedBypassExclusionList
    type: 8
    required: false
    section: Collect
    additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  - display: Base URL
    name: base_url
    type: 0
    required: false
    section: Connect
  - display: Access Token
    name: credentials
    type: 9
    hiddenusername: true
    required: false
    section: Connect
  - display: Trust any certificate (not secure)
    name: insecure
    defaultvalue: 'false'
    type: 8
    section: Connect
    additionalinfo:
    required: false
  - display: Use system proxy settings
    name: proxy
    section: Connect
    defaultvalue: 'false'
    type: 8
    required: false
  - display: Collection Name
    name: collection
    type: 0
    required: false
    hidden: true
    section: Collect
    additionalinfo: Deprecated. TAXII-based ingestion is no longer supported.
  - display: Discovery Service
    name: discovery_service
    type: 0
    required: false
    section: Collect
    hidden: true
    additionalinfo: Collection name to fetch indicators from.
  - display: First fetch time (by days)
    name: initial_interval
    type: 0
    defaultvalue: 1
    required: true
    additionalinfo: How many hours back to fetch IOCs on first run. Max 3 hours.
    section: Collect
    hidden: true
  - display: Indicator Fetch Limit
    name: limit
    type: 0
    defaultvalue: '100'
    section: Collect
    additionalinfo: Maximum number of indicators to fetch per execution.
    hidden: true
script:
  type: python
  subtype: python3
  script: "-"
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  commands:
    - name: cyble-vision-ioc-lookup
      description: Lookup a single IOC using the Cyble Vision API.
      arguments:
        - name: ioc
          required: true
          description: IOC value.
      outputs:
        - contextPath: CybleIntel.IOCLookup
          description: IOC lookup response.
          type: String

    # --------------------------
    # Deprecated commands — must retain outputs for BC
    # --------------------------
    - name: cyble-vision-fetch-taxii
      deprecated: true
      description: Deprecated command. Do not use.
      arguments: []
      outputs:
        - contextPath: CybleIntel.Threat.details
          description: Backward compatibility placeholder.
          type: String
    - name: cyble-vision-get-collection-names
      deprecated: true
      description: Deprecated command. Do not use.
      arguments: []
      outputs:
        - contextPath: CybleIntel.collection.names
          description: Backward compatibility placeholder.
          type: String
fromversion: 6.2.0
tests:
- No tests (auto formatted)
sectionorder:
  - Connect
  - Collect