DHS Feed v2

category: Data Enrichment & Threat Intelligence
provider: DHS
commonfields:
  id: DHS Feed v2
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- defaultvalue: https://ais2.cisa.dhs.gov/taxii2/
  display: Discovery Service URL (e.g., https://ais2.cisa.dhs.gov/taxii2/)
  name: url
  required: true
  type: 0
- displaypassword: Key File as Text
  additionalinfo: For more information, visit https://us-cert.cisa.gov/ais.
  name: key
  type: 9
  required: true
  hiddenusername: true
- additionalinfo: For more information, visit https://us-cert.cisa.gov/ais.
  display: Certificate File as Text
  name: certificate
  required: true
  type: 12
- additionalinfo: The default API root to use (e.g., default, public). If left empty, the server default API root will be used. When the server has no default root, the first available API root will be used instead. The user must be authorized to reach the selected API root.
  defaultvalue: 'public'
  display: Default API Root to use
  name: default_api_root
  type: 0
  required: false
- additionalinfo: Indicators will be fetched from this collection. Run the "dhs-get-collections" command to get a valid value. If left empty, the instance will try to fetch from all the collections in the given discovery service.
  display: Collection Name To Fetch Indicators From
  name: collection_to_fetch
  type: 0
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Bad
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  type: 17
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: 'The time interval for the first fetch (retroactive) in the following format: <number> <time unit> of type minute/hour/day. For example, 1 minute, 12 hours. Limited to 48 hours.'
  defaultvalue: 24 hours
  display: First Fetch Time
  name: initial_interval
  type: 0
  required: false
- additionalinfo: 'The objects to fetch, most likely indicators. Specifying the types of objects to fetch may slow down the fetch time.'
  display: STIX Objects To Fetch
  name: objects_to_fetch
  type: 16
  options:
  - indicator
  - relationship
  - report
  - malware
  - campaign
  - attack-pattern
  - course-of-action
  - intrusion-set
  - tool
  - threat-actor
  - infrastructure
  - autonomous-system
  - domain-name
  - email-addr
  - file
  - ipv4-addr
  - ipv6-addr
  - mutex
  - url
  - user-account
  - windows-registry-key
  - identity
  - location
  - vulnerability
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- additionalinfo: The maximum number of indicators that can be fetched per fetch. If this field is left empty, there will be no limit on the number of indicators fetched.
  display: Max Indicators Per Fetch
  name: limit
  type: 0
  required: false
- additionalinfo: Set the number of STIX objects that will be requested with each TAXII poll (http request). A single fetch is made of several TAXII polls. Changing this setting can help speed up fetches, or fix issues on slower networks. Please note server restrictions may apply, overriding and limiting the requested limit.
  defaultvalue: '1000'
  display: Max STIX Objects Per Poll
  name: limit_per_request
  type: 0
  required: false
- additionalinfo: Choose how to handle complex observations. Two or more Observation Expressions MAY be combined using a complex observation operator such as "AND", "OR". For example, `[ IP = 'b' ] AND [ URL = 'd' ]`
  defaultvalue: Skip indicators with more than a single observation
  display: Complex Observation Mode
  name: observation_operator_mode
  options:
  - Create indicator for each observation
  - Skip indicators with more than a single observation
  type: 15
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental Feed
  hidden: true
  name: feedIncremental
  type: 8
  required: false
description: The Cybersecurity and Infrastructure Security Agency’s (CISA’s) free Automated Indicator Sharing (AIS) capability enables the exchange of cyber threat indicators, at machine speed, to the Federal Government community.
display: DHS Feed v2
name: DHS Feed v2
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Will return only the rawJSON of the indicator object.
      name: raw
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of indicators to return. Default is 10. If you are increasing this value, make sure the 'execution-timeout' argument is also increased.
      name: limit
    - defaultValue: '24 hours'
      description: Fetch only indicators that were added to the server after the given time. Provide a <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hours, 2 days. Limited to 48 hours.
      name: added_after
    description: Allows you to test your feed and to make sure you can fetch indicators successfully. Due to API limitations, this command may take a long time to run. Make sure the 'execution-timeout' argument is increased. See the integration readme for further information.
    name: dhs-get-indicators
    outputs:
    - contextPath: DHS.Indicators.value
      description: Indicator value.
      type: String
    - contextPath: DHS.Indicators.type
      description: Indicator type.
      type: String
    - contextPath: DHS.Indicators.rawJSON
      description: Indicator rawJSON.
      type: String
  - description: Gets the list of collections from the discovery service.
    name: dhs-get-collections
    outputs:
    - contextPath: DHS.Collections.ID
      description: Collection ID.
      type: String
    - contextPath: DHS.Collections.Name
      description: Collection name.
      type: String
  dockerimage: demisto/taxii2:1.0.0.9117276
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.5.0
tests:
- No tests