DHS Feed v2

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) free Automated Indicator Sharing (AIS) capability enables the exchange of cyber threat indicators, at machine speed, to the Federal Government community.
Use this version if your certificate supports TAXII 2 protocol.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure DHS Feed v2 in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dhs-get-indicators

Allows you to test your feed and to make sure you can fetch indicators successfully.
Due to API limitations, running this command may take longer than the default 5 minutes.
To overcome this issue increase the execution-timeout from 300 seconds to a higher value, the recommended value is 1800 seconds.

Base Command

dhs-get-indicators

Input

Context Output

Command Example

!dhs-get-indicators limit=3 execution-timeout=1800

Context Example

{
  "DHS.Indicators": [
    {
      "fields": {
        "tags": [
          "cisa-proprietary-false"
        ]
      },
      "rawJSON": {
        "created": "2021-08-09T00:42:54.000Z",
        "created_by_ref": "identity--e8",
        "id": "indicator--e0",
        "indicator_types": [
          "anomalous-activity",
          "attribution"
        ],
        "labels": [
          "cisa-proprietary-false"
        ],
        "modified": "2021-09-26T04:16:13.000Z",
        "name": "sometimes",
        "object_marking_refs": [
          "marking-definition--633",
          "marking-definition--f51"
        ],
        "pattern": "[domain-name:value = 'coronashop.jp']",
        "pattern_type": "stix",
        "pattern_version": "2.1",
        "spec_version": "2.1",
        "type": "Domain",
        "valid_from": "2021-09-26T00:09:38Z",
        "value": "coronashop.jp"
      },
      "type": "Domain",
      "value": "coronashop.jp"
    },
    {
      "fields": {
        "description": "A totally famous IP Address",
        "tags": [
          "elevated"
        ]
      },
      "rawJSON": {
        "created": "2022-03-01T14:17:59.000Z",
        "created_by_ref": "identity--a9",
        "description": "A totally famous IP Address",
        "id": "indicator--2f5",
        "labels": [
          "elevated"
        ],
        "modified": "2022-03-01T14:17:59.000Z",
        "object_marking_refs": [
          "marking-definition--633"
        ],
        "pattern": "[ipv4-addr:value = '1.1.1.1']",
        "pattern_type": "stix",
        "spec_version": "2.1",
        "type": "IP",
        "valid_from": "2022-03-01T14:17:59.000000Z",
        "value": "1.1.1.1"
      },
      "type": "IP",
      "value": "1.1.1.1"
    },
    {
      "fields": {
        "tags": [
          "elevated"
        ]
      },
      "rawJSON": {
        "created": "2022-02-28T13:18:49.000Z",
        "created_by_ref": "identity--8c4",
        "id": "indicator--9a6",
        "indicator_types": [
          "file-hash-watchlist"
        ],
        "labels": [
          "elevated"
        ],
        "modified": "2022-02-28T13:18:49.000Z",
        "object_marking_refs": [
          "marking-definition--633"
        ],
        "pattern": "[file:hashes.MD5 = 'e6ecb146f469d243945ad8a5451ba1129c5b190f7d50c64580dbad4b8246f88e']",
        "pattern_type": "stix",
        "spec_version": "2.1",
        "type": "File",
        "valid_from": "2022-02-28T13:18:49.000000Z",
        "value": "e6ecb146f469d243945ad8a5451ba1129c5b190f7d50c64580dbad4b8246f88e"
      },
      "type": "File",
      "value": "e6ecb146f469d243945ad8a5451ba1129c5b190f7d50c64580dbad4b8246f88e"
    }
  ]
}

Human Readable Output

Found 3 results added after 2022-12-07T10:29:13.079493Z UTC:

DHS Indicators

value	type
coronashop.jp	Domain
1.1.1.1	IP
e6ecb146f469d243945ad8a5451ba1129c5b190f7d50c64580dbad4b8246f88e	File

dhs-get-collections

Gets the list of collections from the discovery service.

Base Command

dhs-get-collections

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
  "DHS.Collections": [
    {
      "ID": "3",
      "Name": "Public Collection"
    }
  ]
}

Human Readable Output

DHS Server Collections

Name	ID
Public Collection	3

Breaking Changes

The following are the breaking changes from the previous version of this integration.

Arguments

The following argument was removed in this version

In the dhs-get-indicators command, tlp_colorwas removed.

The behavior of the following arguments was changed

In the dhs-get-indicators command, the default value of the limit argument was changed to ‘10’.

Outputs

The following outputs were removed in this version

In the dhs-get-indicators command:

• DHS.type - this output was replaced by DHS.Indicators.type.
• DHS.value - this output was replaced by DHS.Indicators.value.
• DHS.tlp - this output was removed.

Additional Considerations for this version

Use this version if your certificate supports TAXII 2 protocol.

Known Limitations

“First Fetch Time” parameter can be configured for a maximum of 48 hours, due to limitations in DHS TAXII2 API.
Therefore, it is not possible to fetch indicators that last appeared in the feed more than 48 hours ago.