Overview

Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively. The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.

Configure Doppel on Cortex XSOAR

1. Navigate to Settings & Info > Settings > Integrations > Instances.
2. Search for Doppel.
3. Click Add instance to create and configure a new integration instance.

1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

doppel-get-alert

Retrieves the alert details by ID or entity. Must include either ID or entity.

Base Command

doppel-get-alert

Input

Context Output

Command example

!doppel-get-alert id="TST-31"

Context Example

{
  "Doppel": {
    "Alert": {
      "id": "TST-31",
      "entity": "http://dummyrul.com",
      "brand": "test_brand",
      "queue_state": "doppel_review",
      "entity_state": "active",
      "severity": "medium",
      "product": "domains",
      "platform": "domains",
      "source": "Analyst Upload",
      "notes": null,
      "created_at": "2024-11-27T06:51:50.357664",
      "doppel_link": "https://app.doppel.com/alerts/TST-31222",
      "entity_content": {
        "root_domain": {
          "domain": "dummyrul.com",
          "registrar": null,
          "ip_address": null,
          "country_code": null,
          "hosting_provider": null,
          "contact_email": null
        }
      },
      "audit_logs": [
        {
          "timestamp": "2024-11-27T06:51:50.357664",
          "type": "alert_create",
          "value": "needs_review",
          "changed_by": "currentuser@doppel.com",
          "metadata": {}
        }
      ],
      "tags": [],
      "uploaded_by": "currentuser@doppel.com"
    }
  }
}

Human Readable Output

Alert Details

ID	Entity	Brand	Queue State	Entity State	Severity	Product	Platform	Source	Created At	Doppel Link	Uploaded By
TST-31	http://dummyrul.com	test_brand	doppel_review	active	medium	domains	domains	Analyst Upload	2024-11-27T06:51:50.357664	Doppel Link	currentuser@doppel.com

doppel-create-alert

Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.

Base Command

doppel-create-alert

Input

Context Output

Command example

!doppel-create-alert entity="http://example.com"

Context Example

{
  "CreatedAlert": {
    "id": "TST-1001",
    "entity": "http://example.com",
    "doppel_link": "https://app.doppel.com/alerts/TST-1001"
  }
}

Human Readable Output

Created Alert

ID	Entity	Doppel Link
TST-1001	http://example.com	Doppel Link

doppel-update-alert

Updates an alert in the Doppel platform. Either alert_id or entity must be specified.

Base Command

doppel-update-alert

Input

Context Output

Command example

!doppel-update-alert alert_id="TST-31" queue_state="actioned" entity_state="down" comment="Updated due to new findings"

Context Example

{
  "Doppel": {
    "UpdatedAlert": {
      "id": "TST-31",
      "entity": "http://dummyrul.com",
      "brand": "test_brand",
      "queue_state": "actioned",
      "entity_state": "down",
      "severity": "medium",
      "product": "domains",
      "platform": "domains",
      "source": "Analyst Upload",
      "notes": null,
      "created_at": "2024-11-27T06:51:50.357664",
      "doppel_link": "https://app.doppel.com/alerts/TST-31222",
      "entity_content": {
        "root_domain": {
          "domain": "dummyrul.com",
          "registrar": null,
          "ip_address": null,
          "country_code": null,
          "hosting_provider": null,
          "contact_email": null
        }
      },
      "audit_logs": [
        {
          "timestamp": "2024-11-27T06:51:50.357664",
          "type": "alert_update",
          "value": "actioned",
          "changed_by": "currentuser@doppel.com",
          "metadata": {}
        }
      ],
      "tags": [],
      "uploaded_by": "currentuser@doppel.com"
    }
  }
}

Human Readable Output

Updated Alert Details

ID	Entity	Brand	Queue State	Entity State	Severity	Product	Platform	Source	Created At	Doppel Link	Uploaded By
TST-31	http://dummyrul.com	test_brand	actioned	down	medium	domains	domains	Analyst Upload	2024-11-27T06:51:50.357664	Doppel Link	currentuser@doppel.com

doppel-create-abuse-alert

Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.

Base Command

doppel-create-abuse-alert

Input

Context Output

Command example

!doppel-create-abuse-alert entity="http://malicious.com"

Context Example

{
  "Doppel": {
    "AbuseAlert": {
      "message": "Abuse alert created successfully"
    }
  }
}

Human Readable Output

Abuse Alert Submission

Message
Abuse alert created successfully

doppel-get-alerts

Retrieves a list of alerts. The result can be filtered by provided parameters.

Base Command

doppel-get-alerts

Input

Context Output

Command example

!doppel-get-alerts search_key="http://example.com" sort_order="desc" page="1"

Context Example

{
  "Doppel": {
    "GetAlerts": {
      "alerts": [
        {
          "id": "ALERT-12345",
          "entity": "http://example.com",
          "brand": "Test Brand",
          "queue_state": "doppel_review",
          "entity_state": "active",
          "severity": "high",
          "product": "domains",
          "platform": "website",
          "source": "Analyst Upload",
          "created_at": "2024-11-27T10:20:30Z",
          "doppel_link": "https://app.doppel.com/alerts/ALERT-12345",
          "entity_content": {
            "root_domain": {
              "domain": "example.com",
              "registrar": "Example Registrar",
              "ip_address": "192.168.1.1",
              "country_code": "US",
              "hosting_provider": "Example Hosting",
              "contact_email": "contact@example.com"
            }
          },
          "audit_logs": [
            {
              "timestamp": "2024-11-27T10:21:00Z",
              "type": "alert_create",
              "value": "needs_review",
              "changed_by": "analyst@example.com",
              "metadata": {}
            }
          ],
          "tags": ["phishing", "malware"],
          "uploaded_by": "analyst@example.com"
        }
      ],
      "metadata": {
        "count": 1,
        "page": 1,
        "total_pages": 1,
        "page_size": 50
      }
    }
  }
}

Human Readable Output

Alert Details

ID	Entity	Brand	Queue State	Entity State	Severity	Product	Platform	Source	Created At	Doppel Link	Uploaded By
ALERT-12345	http://example.com	Test Brand	doppel_review	active	high	domains	website	Analyst Upload	2024-11-27T10:20:30Z	Doppel Link	analyst@example.com

get-mapping-fields

Returns the list of fields for an incident type.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

update-remote-system

Pushes local changes to the remote system. If an XSOAR Incident is closed, created via Doppel Integration, then on Doppel Portal the Alert status will be updated to archived status.

Base Command

update-remote-system

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

get-remote-data

Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Context Output

There is no context output for this command.

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

Base Command

get-modified-remote-data

Input

Context Output

There is no context output for this command.

Incident Mirroring

Note: The fetch-incidents command creates Cortex XSOAR incidents only for newly detected Doppel alerts. Changes made to a Doppel alert after it was fetched (such as queue state, entity state, or severity updates) are not pulled in by fetch. To keep existing incidents up to date with Doppel, enable mirroring and set the Mirror Direction parameter to Incoming or Incoming And Outgoing.

Mirroring In (Doppel → XSOAR)

When incidents are mirrored into Cortex XSOAR from Doppel:

1. Any changes in Doppel alerts (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.

Supported Fields

The following fields are mirrored:

1. Doppel Queue State – Indicates the queue where the alert is currently assigned.
2. Doppel Entity State – Represents the status of the alert.
3. Audit Log History – A record of all changes made to the alert.

Mirroring Out (XSOAR → Doppel)

When incidents are mirrored out from Cortex XSOAR to Doppel. Currently, the Mirror-out feature updates the Doppel Alert queue to an archived state upon XSOAR incident closure. We intend to extend this capability in future releases to provide more comprehensive mirroring.

Supported Fields

The following fields are mirrored:

1. Doppel Queue State – Indicates the queue where the alert is currently assigned.
2. Close Notes – When an incident is closed with close notes, the notes are sent to Doppel and recorded as a comment on the alert.

Data sharing note: Closing an incident sends its analyst-authored close notes to the Doppel platform as an alert comment, where they are visible to anyone with access to the alert in Doppel. If your close notes may contain sensitive internal information, review them before closing, or remove the closeNotes mapping from the Doppel Outgoing_Mapper to disable this behavior.

Configuration Steps

To enable incident mirroring between Cortex XSOAR incidents and Doppel alerts:

1. Enable Fetching incidents in your instance configuration.

2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

   Option	Description
   None	Turns off incident mirroring.
   Incoming	Any changes in Doppel alerts (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
   Outgoing	Mirroring out will only update queue state in Doppel alerts (outgoing mirrored fields).
   Incoming And Outgoing	Changes in Cortex XSOAR incidents and Doppel alerts will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Doppel.

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

• Fetch incidents

</~PLATFORM>