Dragos Worldview

Details

ID	`Dragos Worldview`
Provider	Dragos
Category	Data Enrichment & Threat Intelligence
From Version	6.2.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Custom integration designed to pull in reports from the Dragos Worldview API as incidents
This integration was integrated and tested with version 1.0 of Dragos Worldview

Configure Dragos Worldview in Cortex

Parameter	Description	Required
Server URL (e.g. https://portal.dragos.com)	The Dragos server URL	True
API Token	The API token	True
API Key	The key for the API Token	True
First fetch time	The first time to run a fetch request	False
Trust any certificate (not secure)	If true trust any certicicate	False
Use system proxy settings	If true use system proxy settings	False
Incidents Fetch Interval	How often to fetch incidents	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators	False
Fetch incidents	If true fetch incidents in a feed	False
Incident type	The incident type	False
Fetch Limit	The fetch limit	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dragos-get-indicators

Get Indicators from the Dragos WorldView API

Base Command

dragos-get-indicators

Input

Argument Name	Description	Required
exclude_suspect_domain	Exclude indicators that are only associated with Suspect Domain Reports (API default false).	Optional	FContext
page	Page number to start at (API default 1).	Optional
page_size	Page size (API default 500) (must be less than 1001).	Optional
serial	Report serial number to get indicators from, if no serial number provided command will retrieve all indicators from the last 48 hours.	Optional
tags	List of tags to search for indicators.	Optional
type	Search for indicators of a specific type.	Optional
updated_after	UTC timestamp in YYYY-mm-dd (optionally with HH:mm:ss) to filter to recent indicators (default is within the last 48 hours).	Optional
value	Search for indicators that match a specific value.	Optional

Context Output

Path	Type	Description
Dragos.Indicators.activity_groups	Unknown	A list of activity groups.
Dragos.Indicators.attack_techniques	Unknown	A list of attack techniques.
Dragos.Indicators.category	String	The Dragos Indicator’s category.
Dragos.Indicators.comment	String	The Dragos Indicator’s comment.
Dragos.Indicators.confidence	String	The Dragos Indicator’s confidence.
Dragos.Indicators.first_seen	String	The first time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
Dragos.Indicators.ics_attack_techniques	Unknown	A list of ics attack techniques.
Dragos.Indicators.indicator_id	Number	The Dragos Indicator’s id.
Dragos.Indicators.indicator_type	String	The Dragos Indicator’s type.
Dragos.Indicators.kill_chain	String	The Dragos Indicator’s kill chain.
Dragos.Indicators.kill_chains	Unknown	A list of kill chains.
Dragos.Indicators.last_seen	String	The last time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
Dragos.Indicators.pre_attack_techniques	Unknown	A list of pre-attack techniques.
Dragos.Indicators.products	Unknown	A list of dictionaries, usually containing the serial numbers of related Dragos reports.
Dragos.Indicators.products.serial	Unknown	The serial numbers of related Dragos reports.
Dragos.Indicators.severity	String	The Dragos Indicator’s severity.
Dragos.Indicators.status	String	The Dragos Indicator’s status.
Dragos.Indicators.threat_groups	Unknown	A list of threat groups.
Dragos.Indicators.updated_at	String	The last time the Indicator was updated in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
Dragos.Indicators.uuid	String	The Dragos Indicator’s uuid.
Dragos.Indicators.value	String	The Dragos Indicator’s value.

Command Example

!dragos-get-indicators exclude_suspect_domain=false page=1 page_size=500 serial=DOM-2023-37 tags=test type=domain updated_after=2023-12-31 value=example.com

Human Readable Output

Dragos Indicators

activity_groups	attack_techniques	category	comment	confidence	first_seen	ics_attack_techniques	id	indicator_type	kill_chain	kill_chains	last_seen	pre_attack_techniques	products	severity	status	threat_groups	updated_at	uuid	value
				moderate	2018-04-06T00:00:00.000Z		0000	domain			2023-09-12T19:37:31.000Z		{‘serial’: ‘DOM-2023-37’}		released		2024-09-12T21:31:51.000Z		example.com

dragos-get-full-report

Get the report file from the given serial number

Base Command

dragos-get-full-report

Input

Argument Name	Description	Required
serial	Serial number for the report to retrieve.	Required

Context Output

There is no context output for this command.

Command Example

!dragos-get-full-report serial=DOM-2023-37

Human Readable Output

dragos-get-ioc-csv

Get csv file with indicators from a given report

Base Command

dragos-get-ioc-csv

Input

Argument Name	Description	Required
serial	Serial number of the report from which to get the file.	Required

Context Output

There is no context output for this command.

Command Example

!dragos-get-ioc-csv serial=DOM-2023-37

Human Readable Output

dragos-get-stix2

Get the stix2 json bundle of indicators from a given report

Base Command

dragos-get-stix2

Input

Argument Name	Description	Required
serial	Serial number of the report from which to retrieve the file.	Required

Context Output

There is no context output for this command.

Command Example

!dragos-get-stix2 serial=DOM-2023-37

Human Readable Output

Configuration parameters

url — Server URL (e.g. https://portal.dragos.com) (required)
credential_token — API Token
credential_key — API Key
apitoken — API Token
apikey — API Key
first_fetch — First fetch time
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval
tlp_color — Traffic Light Protocol Color
isFetch — Fetch incidents
incidentType — Incident type
max_fetch — Fetch Limit

Commands (4)

dragos-get-full-report
Get the report file from the given serial number.
dragos-get-indicators
Get Indicators from the Dragos WorldView API, if no arguments are provided the command will retrieve all indicators from the last 48 hours.
dragos-get-ioc-csv
Get csv file with indicators from a given report.
dragos-get-stix2
Get the stix2 json bundle of indicators from a given report.

Source

DragosWorldview.py DragosWorldview.yml DragosWorldview_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Dragos
commonfields:
  id: Dragos Worldview
  version: -1
configuration:
- defaultvalue: https://portal.dragos.com
  display: Server URL (e.g. https://portal.dragos.com)
  name: url
  required: true
  type: 0
- display: API Token
  name: credential_token
  required: false
  type: 9
  displaypassword: API Token
  hiddenusername: true
- display: API Key
  name: credential_key
  required: false
  type: 9
  displaypassword: API Key
  hiddenusername: true
- display: API Token
  name: apitoken
  required: false
  type: 4
  hidden: true
- display: API Key
  name: apikey
  required: false
  type: 4
  hidden: true
- display: First fetch time
  name: first_fetch
  required: false
  type: 0
  defaultvalue: 3 days
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  defaultvalue: '1'
- display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  required: false
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Fetch Limit
  name: max_fetch
  type: 0
  required: false
  defaultvalue: '50'
description: 'Custom integration designed to pull in reports from the Dragos Worldview API as incidents.'
display: Dragos Worldview
name: Dragos Worldview
script:
  commands:
  - arguments:
    - description: Exclude indicators that are only associated with Suspect Domain Reports (API default false).
      name: exclude_suspect_domain
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Page number to start at (API default 1).
      name: page
    - description: Page size (API default 500) (must be less than 1001).
      name: page_size
    - description: UTC timestamp in YYYY-mm-dd (optionally with HH:mm:ss) to filter to recent indicators (default is within the last 48 hours).
      name: updated_after
    - description: Search for indicators that match a specific value.
      name: value
    - auto: PREDEFINED
      description: Search for indicators of a specific type.
      name: type
      predefined:
      - domain
      - filename
      - hostname
      - ip
      - md5
      - sha1
      - sha256
    - description: List of Dragos report serial number to get indicators from.
      isArray: true
      name: serial
    - description: List of tags to search for indicators.
      isArray: true
      name: tags
    description: Get Indicators from the Dragos WorldView API, if no arguments are provided the command will retrieve all indicators from the last 48 hours.
    name: dragos-get-indicators
    outputs:
    - contextPath: Dragos.Indicators.activity_groups
      description: A list of activity groups.
    - contextPath: Dragos.Indicators.attack_techniques
      description: A list of attack techniques.
    - contextPath: Dragos.Indicators.category
      description: The Dragos Indicator's category.
      type: string
    - contextPath: Dragos.Indicators.comment
      description: The Dragos Indicator's comment.
      type: string
    - contextPath: Dragos.Indicators.confidence
      description: The Dragos Indicator's confidence.
      type: string
    - contextPath: Dragos.Indicators.first_seen
      description: The first time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.ics_attack_techniques
      description: A list of ics attack techniques.
    - contextPath: Dragos.Indicators.indicator_id
      description: The Dragos Indicator's id.
      type: number
    - contextPath: Dragos.Indicators.indicator_type
      description: The Dragos Indicator's type.
      type: string
    - contextPath: Dragos.Indicators.kill_chain
      description: The Dragos Indicator's kill chain.
      type: string
    - contextPath: Dragos.Indicators.kill_chains
      description: A list of kill chains.
    - contextPath: Dragos.Indicators.last_seen
      description: The last time the Indicator was seen in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.pre_attack_techniques
      description: A list of pre-attack techniques.
    - contextPath: Dragos.Indicators.products
      description: A list of dictionaries, usually containing the serial numbers of related Dragos reports.
    - contextPath: Dragos.Indicators.products.serial
      description: The serial numbers of related Dragos reports.
    - contextPath: Dragos.Indicators.severity
      description: The Dragos Indicator's severity.
      type: string
    - contextPath: Dragos.Indicators.status
      description: The Dragos Indicator's status.
      type: string
    - contextPath: Dragos.Indicators.threat_groups
      description: A list of threat groups.
    - contextPath: Dragos.Indicators.updated_at
      description: The last time the Indicator was updated in Dragos (yyyy-mm-ddThh:mm:ss.sssZ).
      type: string
    - contextPath: Dragos.Indicators.uuid
      description: The Dragos Indicator's uuid.
      type: string
    - contextPath: Dragos.Indicators.value
      description: The Dragos Indicator's value.
      type: string
  - arguments:
    - description: Serial number for the report to retrieve.
      name: serial
      required: true
    description: Get the report file from the given serial number.
    name: dragos-get-full-report
  - arguments:
    - description: Serial number of the report from which to get the file.
      name: serial
      required: true
    description: Get csv file with indicators from a given report.
    name: dragos-get-ioc-csv
  - arguments:
    - description: Serial number of the report from which to retrieve the file.
      name: serial
      required: true
    description: Get the stix2 json bundle of indicators from a given report.
    name: dragos-get-stix2
  dockerimage: demisto/python3:3.12.8.3296088
  isFetchSamples: true
  isfetch: true
  script: ''
  subtype: python3
  type: python
  runonce: false
fromversion: 6.2.0
tests:
- No tests (auto formatted)