Doppel

Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively. The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.

Data Enrichment & Threat Intelligence · Doppel

Details

IDDoppel
ProviderDoppel
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10404775

README

Overview

Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively. The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.

Configure Doppel on Cortex XSOAR

  1. Navigate to Settings & Info > Settings > Integrations > Instances.
  2. Search for Doppel.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Doppel Tenant URL The Doppel server URL that will be used for calling the APIs. True
API Key The API Key to use for connection with Doppel. True
User API Key The User API Key (Optional) to use for connection with Doppel. False
Organization Code Optional organization identifier used when your Doppel environment is organization-scoped. If required by the Doppel API, include the organization code provided by your Doppel administrator. False
Trust Any Certificate (not secure) When checked, SSL certificate verification is disabled. Use this only when the Doppel endpoint uses a self-signed or untrusted certificate. False
Use System Proxy Settings When checked, the integration uses the system proxy defined in the XSOAR engine configuration (d1.conf). This is required if the engine routes outbound traffic through a local or organizational proxy. False
Fetch incidents   False
Incidents Fetch Interval The interval specifies the cadence with which the Doppel alerts be fetched. True
Incident type   False
Mirror Direction Choose the direction to mirror the incident: None (No mirroring), Incoming (from Doppel to Cortex XSOAR), Outgoing (from Cortex XSOAR to Doppel), Incoming and Outgoing (from/to Cortex XSOAR and Doppel). Cortex XSOAR only parameter. False
First fetch First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). False
Fetch incidents timeout The time limit in seconds for fetch incidents to run. Leave this empty to cancel the timeout limit. False
Number of incidents for each fetch. Due to API limitations, the maximum is 100. False
Trust any certificate (not secure)   False
Use system proxy settings   False
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

doppel-get-alert

Retrieves the alert details by ID or entity. Must include either ID or entity.

Base Command

doppel-get-alert

Input

Argument Name Description Required
id The ID of the alert to retrieve details for. Optional
entity The alerted entity to retrieve details for. Optional

Context Output

Path Type Description
Doppel.Alert.id String The unique identifier of the alert (e.g., TET-1953421).
Doppel.Alert.entity String The URL or profile link related to the alert.
Doppel.Alert.brand String The brand associated with the alert.
Doppel.Alert.queue_state String The current state of the alert in the queue.
Doppel.Alert.entity_state String The current state of the alert entity (e.g., active, inactive).
Doppel.Alert.severity String The severity level of the alert (e.g., low, medium, high).
Doppel.Alert.product String The product category associated with the alert (e.g., social media).
Doppel.Alert.platform String The platform on which the alert was generated (e.g., Bluesky).
Doppel.Alert.source String The source from which the alert was generated (e.g., Analyst Upload).
Doppel.Alert.notes Unknown Additional notes related to the alert, if any.
Doppel.Alert.created_at Date The timestamp when the alert was created.
Doppel.Alert.doppel_link String The link to the alert on the Doppel platform.
Doppel.Alert.entity_content Unknown Additional content related to the alert entity.
Doppel.Alert.audit_logs.timestamp Date Timestamp when the audit log entry was created.
Doppel.Alert.audit_logs.type String The type of audit log entry (e.g., alert_create).
Doppel.Alert.audit_logs.value String The value of the audit log entry (e.g., needs_review).
Doppel.Alert.audit_logs.changed_by String The user who made the change, if available.
Doppel.Alert.audit_logs.metadata Unknown Additional metadata related to the audit log.
Doppel.Alert.tags Unknown Tags associated with the alert.
Doppel.Alert.uploaded_by String The user or source who uploaded the alert (e.g., Doppel).

Command example

!doppel-get-alert id="TST-31"

Context Example

{
  "Doppel": {
    "Alert": {
      "id": "TST-31",
      "entity": "http://dummyrul.com",
      "brand": "test_brand",
      "queue_state": "doppel_review",
      "entity_state": "active",
      "severity": "medium",
      "product": "domains",
      "platform": "domains",
      "source": "Analyst Upload",
      "notes": null,
      "created_at": "2024-11-27T06:51:50.357664",
      "doppel_link": "https://app.doppel.com/alerts/TST-31222",
      "entity_content": {
        "root_domain": {
          "domain": "dummyrul.com",
          "registrar": null,
          "ip_address": null,
          "country_code": null,
          "hosting_provider": null,
          "contact_email": null
        }
      },
      "audit_logs": [
        {
          "timestamp": "2024-11-27T06:51:50.357664",
          "type": "alert_create",
          "value": "needs_review",
          "changed_by": "currentuser@doppel.com",
          "metadata": {}
        }
      ],
      "tags": [],
      "uploaded_by": "currentuser@doppel.com"
    }
  }
}

Human Readable Output

Alert Details

ID Entity Brand Queue State Entity State Severity Product Platform Source Created At Doppel Link Uploaded By
TST-31 http://dummyrul.com test_brand doppel_review active medium domains domains Analyst Upload 2024-11-27T06:51:50.357664 Doppel Link currentuser@doppel.com

doppel-create-alert

Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.

Base Command

doppel-create-alert

Input

Argument Name Description Required
entity The entity for which the alert should be created. Required

Context Output

Path Type Description
Doppel.CreatedAlert.id String The unique ID of the alert.
Doppel.CreatedAlert.entity String The entity URL associated with the alert.
Doppel.CreatedAlert.doppel_link String The link to view the alert in the Doppel platform.

Command example

!doppel-create-alert entity="http://example.com"

Context Example

{
  "CreatedAlert": {
    "id": "TST-1001",
    "entity": "http://example.com",
    "doppel_link": "https://app.doppel.com/alerts/TST-1001"
  }
}

Human Readable Output

Created Alert

ID Entity Doppel Link
TST-1001 http://example.com Doppel Link

doppel-update-alert

Updates an alert in the Doppel platform. Either alert_id or entity must be specified.

Base Command

doppel-update-alert

Input

Argument Name Description Required
alert_id The ID of the alert to update. Either alert_id or entity should be specified, not both. Optional
entity The entity of the alert to update. Either alert_id or entity should be specified, not both. Optional
queue_state Status of which queue the alert is in. Possible values are: doppel_review, actioned, needs_confirmation, monitoring, taken_down, archived. Optional
entity_state State of the alert. Possible values are: active, down, parked. Optional
comment A comment to add while updating the alert. Optional

Context Output

Path Type Description
Doppel.UpdatedAlert.id String Unique identifier for the alert (e.g., TET-1953421).
Doppel.UpdatedAlert.entity String The URL or identifier associated with the alert.
Doppel.UpdatedAlert.brand String The brand associated with the alert.
Doppel.UpdatedAlert.queue_state String The current state of the alert in the queue.
Doppel.UpdatedAlert.entity_state String The current state of the alert entity.
Doppel.UpdatedAlert.severity String The severity of the alert (e.g., Low, Medium, High).
Doppel.UpdatedAlert.product String The product category related to the alert.
Doppel.UpdatedAlert.platform String The platform associated with the alert (e.g., Bluesky).
Doppel.UpdatedAlert.source String The source of the alert (e.g., Analyst Upload).
Doppel.UpdatedAlert.notes Unknown Additional notes regarding the alert.
Doppel.UpdatedAlert.created_at Date Timestamp when the alert was created.
Doppel.UpdatedAlert.doppel_link String URL link to the alert in Doppel Vision.
Doppel.UpdatedAlert.entity_content Unknown Content details of the alert entity.
Doppel.UpdatedAlert.audit_logs.timestamp Date Timestamp of the audit log entry.
Doppel.UpdatedAlert.audit_logs.type String The type of audit log entry.
Doppel.UpdatedAlert.audit_logs.value String The value associated with the audit log entry.
Doppel.UpdatedAlert.audit_logs.changed_by String The user who changed the alert, or null if system-generated.
Doppel.UpdatedAlert.audit_logs.metadata Unknown Additional metadata related to the audit log entry.
Doppel.UpdatedAlert.tags Unknown List of tags associated with the alert.
Doppel.UpdatedAlert.uploaded_by String The user or system that uploaded the alert (e.g., Doppel).

Command example

!doppel-update-alert alert_id="TST-31" queue_state="actioned" entity_state="down" comment="Updated due to new findings"

Context Example

{
  "Doppel": {
    "UpdatedAlert": {
      "id": "TST-31",
      "entity": "http://dummyrul.com",
      "brand": "test_brand",
      "queue_state": "actioned",
      "entity_state": "down",
      "severity": "medium",
      "product": "domains",
      "platform": "domains",
      "source": "Analyst Upload",
      "notes": null,
      "created_at": "2024-11-27T06:51:50.357664",
      "doppel_link": "https://app.doppel.com/alerts/TST-31222",
      "entity_content": {
        "root_domain": {
          "domain": "dummyrul.com",
          "registrar": null,
          "ip_address": null,
          "country_code": null,
          "hosting_provider": null,
          "contact_email": null
        }
      },
      "audit_logs": [
        {
          "timestamp": "2024-11-27T06:51:50.357664",
          "type": "alert_update",
          "value": "actioned",
          "changed_by": "currentuser@doppel.com",
          "metadata": {}
        }
      ],
      "tags": [],
      "uploaded_by": "currentuser@doppel.com"
    }
  }
}

Human Readable Output

Updated Alert Details

ID Entity Brand Queue State Entity State Severity Product Platform Source Created At Doppel Link Uploaded By
TST-31 http://dummyrul.com test_brand actioned down medium domains domains Analyst Upload 2024-11-27T06:51:50.357664 Doppel Link currentuser@doppel.com

doppel-create-abuse-alert

Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.

Base Command

doppel-create-abuse-alert

Input

Argument Name Description Required
entity The entity for which the abuse alert should be created. Required

Context Output

Path Type Description
Doppel.AbuseAlert.message String Message indicating the status of the submission process.

Command example

!doppel-create-abuse-alert entity="http://malicious.com"

Context Example

{
  "Doppel": {
    "AbuseAlert": {
      "message": "Abuse alert created successfully"
    }
  }
}

Human Readable Output

Abuse Alert Submission

Message
Abuse alert created successfully

doppel-get-alerts

Retrieves a list of alerts. The result can be filtered by provided parameters.

Base Command

doppel-get-alerts

Input

Argument Name Description Required
search_key Currently only supports search by URL. Optional
queue_state New queue status to update alert with (ID required). Possible values: actioned, needs_confirmation, doppel_review, monitoring, taken_down, archived. Optional
product Product category the report belongs to. Possible values: domains, social_media, mobile_apps, ecommerce, crypto, email, paid_ads, telco, darkweb. Optional
created_before Filter alerts created before a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like ‘12 hours’ or ‘7 days’. Optional
created_after Filter alerts created after a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like ‘12 hours’ or ‘7 days’. Optional
sort_type The field to sort the reports by. Defaults to date_sourced. Possible values: date_sourced, date_last_actioned. Optional
sort_order The order to sort the reports by. Defaults to desc. Possible values: asc, desc. Optional
page Page number for pagination; defaults to 0. Optional
tags List of tags to filter alerts. Optional

Context Output

Path Type Description
Doppel.GetAlerts.alerts.id String The unique ID of the alert.
Doppel.GetAlerts.alerts.entity String The entity associated with the alert.
Doppel.GetAlerts.alerts.brand String The brand related to the alert.
Doppel.GetAlerts.alerts.queue_state String The queue state of the alert.
Doppel.GetAlerts.alerts.entity_state String The current state of the entity (active/inactive).
Doppel.GetAlerts.alerts.severity String The severity of the alert.
Doppel.GetAlerts.alerts.product String The product related to the alert.
Doppel.GetAlerts.alerts.platform String The platform associated with the alert.
Doppel.GetAlerts.alerts.source String The source of the alert.
Doppel.GetAlerts.alerts.created_at Date The timestamp when the alert was created.
Doppel.GetAlerts.alerts.doppel_link String The link to the alert in the Doppel platform.
Doppel.GetAlerts.alerts.entity_content.root_domain.domain String The domain associated with the alert.
Doppel.GetAlerts.alerts.entity_content.root_domain.registrar String The registrar of the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.ip_address String The IP address of the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.country_code String The country code of the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.hosting_provider String The hosting provider for the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.contact_email String The contact email of the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.mx_records Unknown The MX records associated with the domain.
Doppel.GetAlerts.alerts.entity_content.root_domain.nameservers Unknown The nameservers associated with the domain.
Doppel.GetAlerts.alerts.audit_logs.timestamp Date The timestamp of the audit log.
Doppel.GetAlerts.alerts.audit_logs.type String The type of the audit log.
Doppel.GetAlerts.alerts.audit_logs.value String The value associated with the audit log.
Doppel.GetAlerts.alerts.audit_logs.changed_by String The user or system that changed the status.
Doppel.GetAlerts.alerts.audit_logs.metadata Unknown Additional metadata for the audit log.
Doppel.GetAlerts.alerts.tags Unknown The tags associated with the alert.
Doppel.GetAlerts.alerts.uploaded_by String The source or user who uploaded the alert.
Doppel.GetAlerts.metadata.count Integer The total count of alerts.
Doppel.GetAlerts.metadata.page Integer The current page number in the results.
Doppel.GetAlerts.metadata.total_pages Integer The total number of pages for the alerts.
Doppel.GetAlerts.metadata.page_size Integer The number of alerts per page.

Command example

!doppel-get-alerts search_key="http://example.com" sort_order="desc" page="1"

Context Example

{
  "Doppel": {
    "GetAlerts": {
      "alerts": [
        {
          "id": "ALERT-12345",
          "entity": "http://example.com",
          "brand": "Test Brand",
          "queue_state": "doppel_review",
          "entity_state": "active",
          "severity": "high",
          "product": "domains",
          "platform": "website",
          "source": "Analyst Upload",
          "created_at": "2024-11-27T10:20:30Z",
          "doppel_link": "https://app.doppel.com/alerts/ALERT-12345",
          "entity_content": {
            "root_domain": {
              "domain": "example.com",
              "registrar": "Example Registrar",
              "ip_address": "192.168.1.1",
              "country_code": "US",
              "hosting_provider": "Example Hosting",
              "contact_email": "contact@example.com"
            }
          },
          "audit_logs": [
            {
              "timestamp": "2024-11-27T10:21:00Z",
              "type": "alert_create",
              "value": "needs_review",
              "changed_by": "analyst@example.com",
              "metadata": {}
            }
          ],
          "tags": ["phishing", "malware"],
          "uploaded_by": "analyst@example.com"
        }
      ],
      "metadata": {
        "count": 1,
        "page": 1,
        "total_pages": 1,
        "page_size": 50
      }
    }
  }
}

Human Readable Output

Alert Details

ID Entity Brand Queue State Entity State Severity Product Platform Source Created At Doppel Link Uploaded By
ALERT-12345 http://example.com Test Brand doppel_review active high domains website Analyst Upload 2024-11-27T10:20:30Z Doppel Link analyst@example.com

get-mapping-fields

Returns the list of fields for an incident type.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

update-remote-system

Pushes local changes to the remote system. If an XSOAR Incident is closed, created via Doppel Integration, then on Doppel Portal the Alert status will be updated to archived status.

Base Command

update-remote-system

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

get-remote-data

Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Argument Name Description Required
id The ticket ID. Required
lastUpdate Retrieve entries that were created after lastUpdate. Required

Context Output

There is no context output for this command.

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
last_update Retrieve entries that were created after lastUpdate. Optional

Context Output

There is no context output for this command.

Incident Mirroring

Note: The fetch-incidents command creates Cortex XSOAR incidents only for newly detected Doppel alerts. Changes made to a Doppel alert after it was fetched (such as queue state, entity state, or severity updates) are not pulled in by fetch. To keep existing incidents up to date with Doppel, enable mirroring and set the Mirror Direction parameter to Incoming or Incoming And Outgoing.

Mirroring In (Doppel → XSOAR)

When incidents are mirrored into Cortex XSOAR from Doppel:

  1. Any changes in Doppel alerts (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.

Supported Fields

The following fields are mirrored:

  1. Doppel Queue State – Indicates the queue where the alert is currently assigned.
  2. Doppel Entity State – Represents the status of the alert.
  3. Audit Log History – A record of all changes made to the alert.

Mirroring Out (XSOAR → Doppel)

When incidents are mirrored out from Cortex XSOAR to Doppel. Currently, the Mirror-out feature updates the Doppel Alert queue to an archived state upon XSOAR incident closure. We intend to extend this capability in future releases to provide more comprehensive mirroring.

Supported Fields

The following fields are mirrored:

  1. Doppel Queue State – Indicates the queue where the alert is currently assigned.
  2. Close Notes – When an incident is closed with close notes, the notes are sent to Doppel and recorded as a comment on the alert.

Data sharing note: Closing an incident sends its analyst-authored close notes to the Doppel platform as an alert comment, where they are visible to anyone with access to the alert in Doppel. If your close notes may contain sensitive internal information, review them before closing, or remove the closeNotes mapping from the Doppel Outgoing_Mapper to disable this behavior.

Configuration Steps

To enable incident mirroring between Cortex XSOAR incidents and Doppel alerts:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Turns off incident mirroring.
    Incoming Any changes in Doppel alerts (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
    Outgoing Mirroring out will only update queue state in Doppel alerts (outgoing mirrored fields).
    Incoming And Outgoing Changes in Cortex XSOAR incidents and Doppel alerts will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Doppel.

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

  • Fetch incidents

</~PLATFORM>

Configuration parameters

  • url — Doppel Tenant URL (required)
  • credentials — (required)
  • user_credentials —
  • organization_code — Organization Code
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval (required)
  • incidentType — Incident type
  • mirror_direction — Mirror Direction
  • first_fetch — First fetch
  • fetch_timeout — Fetch incidents timeout
  • max_fetch — Number of incidents for each fetch.
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (9)

  • doppel-create-abuse-alert

    Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.

  • doppel-create-alert

    Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.

  • doppel-get-alert

    Retrieves the alert details by ID or entity. Must include either ID or entity.

  • doppel-get-alerts

    Retrieves a list of alerts. The result can be filtered by provided parameters.

  • doppel-update-alert

    Updates an alert in the Doppel platform. Either 'alert_id' or 'entity' must be specified.

  • get-mapping-fields

    Returns the list of fields for an incident type.

  • get-modified-remote-data

    Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • update-remote-system

    Pushes local changes to the remote system.

Source

Doppel.py Doppel_test.py Doppel.yml Doppel_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Doppel
sectionorder:
- Connect
- Collect
commonfields:
  id: Doppel
  version: -1
configuration:
- additionalinfo: The Doppel server URL that will be used for calling the APIs.
  defaultvalue: https://api.doppel.com/
  display: Doppel Tenant URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The API Key to use for connection with Doppel.
  display: ""
  displaypassword: API Key
  hiddenusername: true
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: The User API Key (Optional) to use for connection with Doppel.
  display: ""
  displaypassword: User API Key
  hiddenusername: true
  name: user_credentials
  required: false
  type: 9
  section: Connect
- display: Organization Code
  name: organization_code
  required: false
  type: 0
  section: Connect
  additionalinfo: The Organization Code to use for connection with Doppel.
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: true
  type: 19
  section: Connect
  additionalinfo: The interval specifies the cadence with which the Doppel alerts be fetched.
  defaultvalue: "1"
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  required: false
  type: 13
  section: Connect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'Choose the direction to mirror the incident: None (No mirroring), Incoming (from Doppel to Cortex XSOAR), Outgoing (from Cortex XSOAR to Doppel), Incoming and Outgoing (from/to Cortex XSOAR and Doppel). Cortex XSOAR only parameter.'
  display: Mirror Direction
  name: mirror_direction
  required: false
  type: 15
  section: Collect
  options:
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  - None
  hidden:
  - marketplacev2
  - platform
- additionalinfo: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  defaultvalue: "1 day"
  display: First fetch
  name: first_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: The time limit in seconds for fetch incidents to run. Leave this empty to cancel the timeout limit.
  defaultvalue: "30"
  display: Fetch incidents timeout
  name: fetch_timeout
  required: false
  type: 0
  section: Collect
- display: Number of incidents for each fetch.
  name: max_fetch
  type: 0
  required: false
  section: Collect
  additionalinfo: Due to API limitations, the maximum is 100.
  defaultvalue: "10"
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: |-
  Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively.
  The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.
display: Doppel
name: Doppel
script:
  commands:
  - arguments:
    - description: The ID of the alert to retrieve details for.
      name: id
    - description: The alerted entity to retrieve details for.
      name: entity
    description: Retrieves the alert details by ID or entity. Must include either ID or entity.
    name: doppel-get-alert
    outputs:
    - contextPath: Doppel.Alert.id
      description: 'The unique identifier of the alert (e.g., TET-1953421).'
      type: String
    - contextPath: Doppel.Alert.entity
      description: 'The URL or profile link related to the alert.'
      type: String
    - contextPath: Doppel.Alert.brand
      description: 'The brand associated with the alert.'
      type: String
    - contextPath: Doppel.Alert.queue_state
      description: 'The current state of the alert in the queue.'
      type: String
    - contextPath: Doppel.Alert.entity_state
      description: 'The current state of the alert entity (e.g., active, inactive).'
      type: String
    - contextPath: Doppel.Alert.severity
      description: 'The severity level of the alert (e.g., low, medium, high).'
      type: String
    - contextPath: Doppel.Alert.product
      description: 'The product category associated with the alert (e.g., social media).'
      type: String
    - contextPath: Doppel.Alert.platform
      description: 'The platform on which the alert was generated (e.g., Bluesky).'
      type: String
    - contextPath: Doppel.Alert.source
      description: 'The source from which the alert was generated (e.g., Analyst Upload).'
      type: String
    - contextPath: Doppel.Alert.notes
      description: 'Additional notes related to the alert, if any.'
      type: Unknown
    - contextPath: Doppel.Alert.created_at
      description: 'The timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.Alert.doppel_link
      description: 'The link to the alert on the Doppel platform.'
      type: String
    - contextPath: Doppel.Alert.entity_content
      description: 'Additional content related to the alert entity.'
      type: Unknown
    - contextPath: Doppel.Alert.audit_logs.timestamp
      description: 'Timestamp when the audit log entry was created.'
      type: Date
    - contextPath: Doppel.Alert.audit_logs.type
      description: 'The type of audit log entry (e.g., alert_create).'
      type: String
    - contextPath: Doppel.Alert.audit_logs.value
      description: 'The value of the audit log entry (e.g., needs_review).'
      type: String
    - contextPath: Doppel.Alert.audit_logs.changed_by
      description: 'The user who made the change, if available.'
      type: String
    - contextPath: Doppel.Alert.audit_logs.metadata
      description: 'Additional metadata related to the audit log.'
      type: Unknown
    - contextPath: Doppel.Alert.tags
      description: 'Tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.Alert.uploaded_by
      description: 'The user or source who uploaded the alert (e.g., Doppel).'
      type: String
  - arguments:
    - description: The entity for which the alert should be created.
      name: entity
      required: true
    description: Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.
    name: doppel-create-alert
    outputs:
    - contextPath: Doppel.CreatedAlert.id
      description: 'The unique ID of the alert.'
      type: String
    - contextPath: Doppel.CreatedAlert.entity
      description: 'The entity URL associated with the alert.'
      type: String
    - contextPath: Doppel.CreatedAlert.doppel_link
      description: 'The link to view the alert in the Doppel platform.'
      type: String
  - arguments:
    - description: The ID of the alert to update. Either 'alert_id' or 'entity' should be specified, not both.
      name: alert_id
    - description: A new comment to be added to the alert.
      name: comment
    - description: The entity of the alert to update. Either 'alert_id' or 'entity' should be specified, not both.
      name: entity
    - auto: PREDEFINED
      description: Status of which queue the alert is in.
      name: queue_state
      predefined:
      - doppel_review
      - actioned
      - needs_confirmation
      - monitoring
      - taken_down
      - archived
    - auto: PREDEFINED
      description: State of the alert.
      name: entity_state
      predefined:
      - active
      - down
      - parked
    description: Updates an alert in the Doppel platform. Either 'alert_id' or 'entity' must be specified.
    name: doppel-update-alert
    outputs:
    - contextPath: Doppel.UpdatedAlert.id
      description: 'Unique identifier for the alert (e.g., TET-1953421).'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity
      description: 'The URL or identifier associated with the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.brand
      description: 'The brand associated with the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.queue_state
      description: 'The current state of the alert in the queue.'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity_state
      description: 'The current state of the alert entity.'
      type: String
    - contextPath: Doppel.UpdatedAlert.severity
      description: 'The severity of the alert (e.g., Low, Medium, High).'
      type: String
    - contextPath: Doppel.UpdatedAlert.product
      description: 'The product category related to the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.platform
      description: 'The platform associated with the alert (e.g., Bluesky).'
      type: String
    - contextPath: Doppel.UpdatedAlert.source
      description: 'The source of the alert (e.g., Analyst Upload).'
      type: String
    - contextPath: Doppel.UpdatedAlert.notes
      description: 'Additional notes regarding the alert.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.created_at
      description: 'Timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.UpdatedAlert.doppel_link
      description: 'URL link to the alert in Doppel Vision.'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity_content
      description: 'Content details of the alert entity.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.audit_logs.timestamp
      description: 'Timestamp of the audit log entry.'
      type: Date
    - contextPath: Doppel.UpdatedAlert.audit_logs.type
      description: 'The type of audit log entry.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.value
      description: 'The value associated with the audit log entry.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.changed_by
      description: 'The user who changed the alert, or null if system-generated.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.metadata
      description: 'Additional metadata related to the audit log entry.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.tags
      description: 'List of tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.uploaded_by
      description: 'The user or system that uploaded the alert (e.g., Doppel).'
      type: String
  - arguments:
    - description: The entity for which the abuse alert should be created.
      name: entity
      required: true
    description: Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.
    name: doppel-create-abuse-alert
    outputs:
    - contextPath: Doppel.AbuseAlert.message
      description: 'Message indicating the status of the submission process.'
      type: String
  - arguments:
    - description: Currently only supports search by URL.
      name: search_key
    - auto: PREDEFINED
      description: New queue status to update alert with (ID required).
      name: queue_state
      predefined:
      - actioned
      - needs_confirmation
      - doppel_review
      - monitoring
      - taken_down
      - archived
    - auto: PREDEFINED
      description: Product category the report belongs to.
      name: product
      predefined:
      - domains
      - social_media
      - mobile_apps
      - ecommerce
      - crypto
      - email
      - paid_ads
      - telco
      - darkweb
    - description: Filter alerts created before a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like '12 hours' or '7 days'.
      name: created_before
    - description: Filter alerts created after a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like '12 hours' or '7 days'.
      name: created_after
    - auto: PREDEFINED
      description: The field to sort the reports by.
      defaultValue: date_sourced
      name: sort_type
      predefined:
      - date_sourced
      - date_last_actioned
    - auto: PREDEFINED
      description: The order to sort the reports by.
      defaultValue: desc
      name: sort_order
      predefined:
      - asc
      - desc
    - description: Page number for pagination.
      defaultValue: '0'
      name: page
    - description: List of tags to filter alerts.
      isArray: true
      name: tags
    description: Retrieves a list of alerts. The result can be filtered by provided parameters.
    name: doppel-get-alerts
    outputs:
    - contextPath: Doppel.GetAlerts.alerts.id
      description: 'The unique ID of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity
      description: 'The entity associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.brand
      description: 'The brand related to the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.queue_state
      description: 'The queue state of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_state
      description: 'The current state of the entity (active/inactive).'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.severity
      description: 'The severity of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.product
      description: 'The product related to the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.platform
      description: 'The platform associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.source
      description: 'The source of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.created_at
      description: 'The timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.GetAlerts.alerts.doppel_link
      description: 'The link to the alert in the Doppel platform.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.domain
      description: 'The domain associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.registrar
      description: 'The registrar of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.ip_address
      description: 'The IP address of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.country_code
      description: 'The country code of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.hosting_provider
      description: 'The hosting provider for the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.contact_email
      description: 'The contact email of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.mx_records
      description: 'The MX records associated with the domain.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.nameservers
      description: 'The nameservers associated with the domain.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.timestamp
      description: 'The timestamp of the audit log.'
      type: Date
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.type
      description: 'The type of the audit log.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.value
      description: 'The value associated with the audit log.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.changed_by
      description: 'The user or system that changed the status.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.metadata
      description: 'Additional metadata for the audit log.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.tags
      description: 'The tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.uploaded_by
      description: 'The source or user who uploaded the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.metadata.count
      description: 'The total count of alerts.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.page
      description: 'The current page number in the results.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.total_pages
      description: 'The total number of pages for the alerts.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.page_size
      description: 'The number of alerts per page.'
      type: Integer
  - arguments: []
    description: Returns the list of fields for an incident type.
    name: get-mapping-fields
  - arguments: []
    description: Pushes local changes to the remote system.
    name: update-remote-system
  - arguments:
    - default: false
      description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    description: Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
    name: get-modified-remote-data
  - arguments:
    - default: false
      description: The remote incident ID.
      isArray: false
      name: id
      required: true
      secret: false
    - default: false
      defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    name: get-remote-data
  dockerimage: demisto/python3:3.12.13.10404775
  script: '-'
  type: python
  subtype: python3
  isFetchSamples: true
  isfetch: true
  isremotesyncin: true
  isremotesyncout: true
  ismappable: true
  runonce: false
fromversion: 6.10.0
tests:
- No tests (auto formatted)