EclecticIQ Intelligence Center v3

Threat Intelligence Platform that connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships .
This integration was integrated and tested with version 2.14 and 3.0 of EclecticIQ Intelligence Center v3.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure EclecticIQ Intelligence Center v3 in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Get reputation of IP address observable.

Base Command

ip

Input

Context Output

Command example

!ip ip="8.8.8.8"

Context Example

{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 0,
        "Type": "ip",
        "Vendor": "EclecticIQ Intelligence Center v3"
    },
    "EclecticIQ": {
        "IP": {
            "Created": "2023-10-09T18:00",
            "LastUpdated": "2023-11-13T15:35",
            "Maliciousness": "unknown",
            "Observable": "8.8.8.8",
            "SourceName": "enricher_task: VirusTotal APIv3 File Hash (Contacted Infrastructure) Enricher; enricher_task: Recorded Future Enricher; group: Testing Group; "
        }
    },
    "IP": {
        "Address": "8.8.8.8"
    }
}

Human Readable Output

EclecticIQ IP reputation - 8.8.8.8

created	id	last_updated	maliciousness	platform_link	source_name	type	value
2023-10-09T18:00	466127	2023-11-13T15:35	unknown	https://ic-playground.eclecticiq.com/main/intel/all/browse/observable?tab=overview&id=466127	enricher_task: VirusTotal APIv3 File Hash (Contacted Infrastructure) Enricher; enricher_task: Recorded Future Enricher; group: Testing Group;	ipv4	8.8.8.8

url

Gets the reputation of a URL observable.

Base Command

url

Input

Context Output

Command example

!url url="https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/"

Context Example

{
    "DBotScore": {
        "Indicator": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/",
        "Score": 0,
        "Type": "url",
        "Vendor": "EclecticIQ Intelligence Center v3"
    },
    "EclecticIQ": {
        "URL": {
            "Created": "2023-06-02T08:14",
            "LastUpdated": "2023-06-02T08:14",
            "Maliciousness": "unknown",
            "Observable": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/",
            "SourceName": "incoming_feed: Elemendar; "
        }
    },
    "URL": {
        "Data": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/"
    }
}

Human Readable Output

EclecticIQ URL reputation - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

created	id	last_updated	maliciousness	platform_link	source_name	type	value
2023-06-02T08:14	119519	2023-06-02T08:14	unknown	https://ic-playground.eclecticiq.com/main/intel/all/browse/observable?tab=overview&id=119519	incoming_feed: Elemendar;	uri	https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

file

Gets the reputation of a file hash observable.

Base Command

file

Input

Context Output

Command example

!file file=ae5f156a6f5052494a295c597389dbee

Context Example

{
    "DBotScore": {
        "Indicator": "ae5f156a6f5052494a295c597389dbee",
        "Score": 0,
        "Type": "file",
        "Vendor": "EclecticIQ Intelligence Center v3"
    },
    "EclecticIQ": {
        "File": {
            "Created": "2023-05-26T09:20",
            "LastUpdated": "2023-05-26T09:20",
            "Maliciousness": "unknown",
            "Observable": "ae5f156a6f5052494a295c597389dbee",
            "SourceName": "enricher_task: Threatcrowd API V2; "
        }
    },
    "File": {
        "Hashes": [
            {
                "type": "MD5",
                "value": "ae5f156a6f5052494a295c597389dbee"
            }
        ],
        "MD5": "ae5f156a6f5052494a295c597389dbee"
    }
}

Human Readable Output

EclecticIQ File reputation - ae5f156a6f5052494a295c597389dbee

created	id	last_updated	maliciousness	platform_link	source_name	type	value
2023-05-26T09:20	13	2023-05-26T09:20	unknown	https://ic-playground.eclecticiq.com/main/intel/all/browse/observable?tab=overview&id=13	enricher_task: Threatcrowd API V2;	hash-md5	ae5f156a6f5052494a295c597389dbee

eclecticiq-get-entity

Query EIC for entity.

Base Command

eclecticiq-get-entity

Input

Context Output

email

Gets the reputation of an email address observable.

Base Command

email

Input

Context Output

Command example

!email email=domains@twitter.com

Context Example

{
    "DBotScore": {
        "Indicator": "domains@twitter.com",
        "Score": 0,
        "Type": "email",
        "Vendor": "EclecticIQ Intelligence Center v3"
    },
    "EclecticIQ": {
        "Email": {
            "Created": "2023-05-26T09:22",
            "LastUpdated": "2023-05-26T09:22",
            "Maliciousness": "unknown",
            "Observable": "domains@twitter.com",
            "SourceName": "enricher_task: Threatcrowd API V2; "
        }
    },
    "Email": {
        "Address": "domains@twitter.com"
    }
}

Human Readable Output

EclecticIQ Email reputation - domains@twitter.com

created	id	last_updated	maliciousness	platform_link	source_name	type	value
2023-05-26T09:22	1028	2023-05-26T09:22	unknown	https://ic-playground.eclecticiq.com/main/intel/all/browse/observable?tab=overview&id=1028	enricher_task: Threatcrowd API V2;	email	domains@twitter.com

domain

Gets the reputation of a domain observable.

Base Command

domain

Input

Context Output

Command example

!domain domain=urlz.fr

Context Example

{
    "DBotScore": {
        "Indicator": "urlz.fr",
        "Score": 3,
        "Type": "domain",
        "Vendor": "EclecticIQ Intelligence Center v3"
    },
    "Domain": {
        "Malicious": {
            "Description": "EclecticIQ maliciousness confidence level: low",
            "Vendor": "EclecticIQ Intelligence Center v3"
        },
        "Name": "urlz.fr"
    },
    "EclecticIQ": {
        "Domain": {
            "Created": "2023-05-26T09:20",
            "LastUpdated": "2023-05-26T09:20",
            "Maliciousness": "low",
            "Observable": "urlz.fr",
            "SourceName": ""
        }
    }
}

Human Readable Output

EclecticIQ Domain reputation - urlz.fr

created	id	last_updated	maliciousness	platform_link	source_name	type	value
2023-05-26T09:20	43	2023-05-26T09:20	low	https://ic-playground.eclecticiq.com/main/intel/all/browse/observable?tab=overview&id=43		domain	urlz.fr

eclecticiq-create-sighting

Create a sighting entity on EIC.
Must contain at least one observable.

Base Command

eclecticiq-create-sighting

Input

Context Output

eclecticiq-create-indicator

Create an indicator entity on EIC.
Must contain at least one observable.

Base Command

eclecticiq-create-indicator

Input

Context Output

eclecticiq-get-entity-by-id

Query EclecticIQ Intelligence Center for entity by its ID.

Base Command

eclecticiq-get-entity-by-id

Input

Context Output

eclecticiq-request-get

Make HTTP GET request to EclecticIQ Intelligence Center.

Base Command

eclecticiq-request-get

Input

Context Output

Command example

!eclecticiq-request-get uri=/api/v2/datasets

Context Example

{
    "EclecticIQ": {
        "GET": {
            "ReplyBody": {
                "count": 100,
                "data": [...],
                "limit": 100,
                "offset": 0,
                "total_count": 113
            },
            "ReplyStatus": "200",
            "URI": "/api/v2/datasets"
        }
    }
}

Human Readable Output

EclecticIQ GET action to endpoint /api/v2/datasets exectued. Reply status: 200

eclecticiq-request-post

Make HTTP POST request to EclecticIQ Intelligence Center.

Base Command

eclecticiq-request-post

Input

Context Output

Command example

!eclecticiq-request-post uri=/api/v2/datasets body=`{"data": {"workspaces": "1", "name": "test11112"}}

Context Example

{
    "EclecticIQ": {
        "POST": {
            "ReplyBody": {
                "data": {...}
            },
            "ReplyStatus": "201",
            "URI": "/api/v2/datasets"
        }
    }
}

Human Readable Output

EclecticIQ POST action to endpoint /api/v2/datasets exectued. Reply status: 201

eclecticiq-request-put

Make HTTP PUT request to EclecticIQ Intelligence Center.

Base Command

eclecticiq-request-put

Input

Context Output

Command example

!eclecticiq-request-put uri=/api/v2/datasets body=`{"data": {"workspaces": "1", "name": "test11112"}}

Context Example

{
    "EclecticIQ": {
        "PUT": {
            "ReplyBody": {
                "data": {...}
            },
            "ReplyStatus": "200",
            "URI": "/api/v2/datasets"
        }
    }
}

Human Readable Output

EclecticIQ PUT action to endpoint /api/v2/datasets exectued. Reply status: 200

eclecticiq-request-patch

Make HTTP PATCH request to EclecticIQ Intelligence Center.

Base Command

eclecticiq-request-patch

Input

Context Output

Command example

!eclecticiq-request-patch uri=/api/v2/datasets/1 body=`{"data": {"workspaces": "1", "name": "test11112"}}

Context Example

{
    "EclecticIQ": {
        "PATCH": {
            "ReplyBody": {
                "data": {...}
            },
            "ReplyStatus": "200",
            "URI": "/api/v2/datasets/1"
        }
    }
}

Human Readable Output

EclecticIQ PATCH action to endpoint /api/v2/datasets/1 exectued. Reply status: 200

eclecticiq-request-delete

Make HTTP DELETE request to EclecticIQ Intelligence Center.

Base Command

eclecticiq-request-delete

Input

Context Output

eclecticiq-get-indicators

Get last block of Indicators from configured to fetch Outgoing feed.

Base Command

eclecticiq-get-indicators

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command example

!eclecticiq-get-indicators

Human Readable Output

Indicators collected from first block of feed:[{‘id’: ‘11’, ‘created_at’: ‘2023-06-26T15:23:19.737166+00:00’, ‘update_strategy’: ‘REPLACE’, ‘packaging_status’: ‘SUCCESS’, ‘name’: ‘splunk-test’}]

No entries.

Breaking changes from the previous version of this integration - EclecticIQ Intelligence Center v3

Integration rebuild with added functionality to fetch indicators from outgoing feeds and with many new commands. Integration is not compatible with EclecticIQ integration v2.