EclecticIQ Platform v2

Details

ID	`EclecticIQ Platform v2`
Provider	EclecticIQ
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.10.13.72123`
Supported Modules	Agentix XSIAM

README

EclecticIQ Platform v2

Threat Intelligence Platform that connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships.
This integration was integrated and tested with version of EclecticIQ Platform v2

Configure EclecticIQ Platform v2 in Cortex

Parameter	Required
Server URL (e.g. https://ic-playground.eclecticiq.com/api/v1)	True
API Key	True
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

EclecticIQ_lookup_observables

Lookup observables from EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_lookup_observables

Input

Argument Name	Description	Required
type	Type of the value to lookup observables from . Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha256, hash-sha1, hash-sha512.	Required
value	Value to search the related observables from EclecticIQ Intelligence Center Platform.	Required

Context Output

Path	Type	Description
EclecticIQ.Observables.type	string	EclecticIQ Observables type
EclecticIQ.Entity.confidence	string	EclecticIQ Entity confidence
EclecticIQ.Entity.observables	string	EclecticIQ Entity related observables
EclecticIQ.Entity.threat_start_time	date	EclecticIQ Threat start time
EclecticIQ.Entity.title	string	EclecticIQ Entity Title

Command Example

!EclecticIQ_lookup_observables type="ipv4" value="001.001.001.001"

Context Example

{
    "EclecticIQ":{
       "DBotScore":{
          "Created":"2022-12-20T12:47:24.531410+00:00",
          "ID":"9382489",
          "LastUpdated":"2022-12-20T12:47:24.398456+00:00",
          "Type":"ipv4",
          "indicator":"ipv4",
          "score":3
       },
       "Entity":{
          "confidence":"unknown",
          "threat_start_time":"2022-12-20T12:47:24.474221+00:00",
          "title":"sighting",
          "observables":{
             "classification":"high",
             "type":"ipv4",
             "value":"000.001.001.001",
             "Malicious":{
                "Description":"EclectiqIQ maliciousness confidence level: high",
                "Vendor":"EclectiqIQ"
             },
             "data":[
                {
                   "created_at":"2022-08-24T10:02:04.609448+00:00",
                   "entities":[
                      "https://ic-playground.eclecticiq.com/api/v1/entities/183fa404-ba48-471b-980d-02600fe89a2b"
                   ],
                   "id":7938475,
                   "last_updated_at":"2022-11-23T06:25:55.945630+00:00",
                   "meta":{
                      "maliciousness":"medium"
                   },
                   "sources":[
                      "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"],
                   "type":"ipv4",
                   "value":"000.001.001.001"
                }
             ]
          }
       }
    }
 }

Human Readable Output

EclecticIQ observable reputation - 001.001.001.001

confidence	description	observables	source_name	tags	threat_start_time	title
`low`	creationofsighting	{‘type’: ‘ipv4’, ‘value’: ‘001.001.001.001, ‘classification’: ‘low’}			2022-08-25T04:50:56+00:00	sighting

EclecticIQ_create_sighting

create sighting in the EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_create_sighting

Input

Argument Name	Description	Required
value	value for the sighting.	Required
description	description about the sighting.	Required
title	Title for the sighting.	Required
tags	Tag for the sighting.	Required
type	type for the sighting. Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha256, hash-sha1, hash-sha512.	Required
confidence_level	severity level of the sighting. Possible values are: low, medium, high, unknown.	Required

Context Output

Path	Type	Description
Sighting.Data.data.type	string	Sighting Type
Sighting.Data.data.tags	string	Sighting Tags
Sighting.Data.data.title	string	Sighting Title
Sighting.Data.data.description	string	Sighting Description
Sighting.Data.data.timestamp	string	Sighting timestamp

Command Example

!EclecticIQ_create_sighting type="ipv4" value="001.001.001.001" description="sighting creation" title="sighting" tags="Alert" confidence_level="high"

Context Example

{
   "Sighting":{
      "Data":{
         "data":{
            "last_updated_at":"2022-12-28T12:45:05.465825+00:00",
            "outgoing_feeds":[],
            "meta":{
               "estimated_observed_time":"2022-12-28T12:45:05.508090+00:00",
               "half_life":182,
               "attacks":[],
               "estimated_threat_start_time":"2022-12-28T12:45:04+00:00",
               "taxonomies":[],
               "estimated_threat_end_time":"null",
               "source_reliability":"A",
               "tags":["Alert"],
               "tlp_color":null
            },
            "created_at":"2022-12-28T12:45:05.508090+00:00",
            "data":{
               "confidence":"high",
               "description":"sighting creation",
               "id":"{https://ic-playground.eclecticiq.com}eclecticiq-sighting-742ad072-86ad-11ed-ad71-067b5e23fb5e",
               "timestamp":"2022-12-28T12:45:04+00:00",
               "title":"sighting",
               "relevancy":1
            },
            "observables":[
               "https://ic-playground.eclecticiq.com/api/v1/observables/9391529"
            ],
            "attachments":[],
            "incoming_feed":null,
            "sources":[
               "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"
            ],
            "type":"eclecticiq-sighting",
            "id":"453d1fb2-d654-4a7a-9654-40556a893640",
            "datasets":[]
         }
      }
   }
}

Human Readable Output

!sighting created for- 001.001.001.001

confidence	description
`Type`	ipv4
`confidence_level`	low
`description`	sighting creation
`tags`	Alert
`title`	sighting
`value`	001.001.001.001

EclecticIQ_create_observable

create observable in the EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_create_observable

Input

Argument Name	Description	Required
type	Type of the observable. Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha1, hash-sha256, hash-sha512.	Required
value	value of the type of observable.	Required
maliciousness	severity level of the type. Possible values are: unknown, safe, low, medium, high.	Required

Context Output

Path	Type	Description
Observables.Data.data.type	string	Observable Type
Observables.Data.data.value	string	Observable Value
Observables.Data.data.maliciousness	string	Observable maliciousness

Command Example

!EclecticIQ_create_observable type="ipv4" value="001.001.001.001" maliciousness="high"

Context Example

{
   "Observables":{
      "Data":{
         "data":[
            {
               "created_at":"2022-12-26T13:16:06.757271+00:00",
               "entities":[
                  "https://ic-playground.eclecticiq.com/api/v1/entities/3a1cc90b-9cbd-437a-ab0b-7153b1bb275b"
               ],
               "id":9389500,
               "last_updated_at":"2022-12-26T13:16:06.677236+00:00",
               "meta":{
                  "maliciousness":"low"
               },
               "sources":[
                  "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"
               ],
               "type":"ipv4",
               "value":"001.001.001.001"
            }
         ]
      }
   }
}

Human Readable Output

Observables created successfully…

confidence	description
`maliciousness`	low
`type`	ipv4
`value`	001.001.001.001

Configuration parameters

url — Server URL (e.g. https://ic-playground.eclecticiq.com/api/v1) (required)
apikey — API Key (required)
proxy — Use system proxy settings

Commands (3)

EclecticIQ_create_observable
create observable in the EclecticIQ Intelligence Center Platform
EclecticIQ_create_sighting
create sighting in the EclecticIQ Intelligence Center Platform
EclecticIQ_lookup_observables
Lookup observables from EclecticIQ Intelligence Center Platform

Source

EclecticIQv2.py EclecticIQv2_test.py EclecticIQv2.yml EclecticIQv2_description.md command_examples.txt

Download History Raw

commonfields:
  id: EclecticIQ Platform v2
  version: -1
name: EclecticIQ Platform v2
display: EclecticIQ Platform v2 (Deprecated)
deprecated: true
category: Data Enrichment & Threat Intelligence
provider: EclecticIQ
description: Deprecated. Use EclecticIQ Intelligence Center v3 instead.
configuration:
- display: Server URL (e.g. https://ic-playground.eclecticiq.com/api/v1)
  name: url
  defaultvalue: "https://ic-playground.eclecticiq.com/api/v1"
  type: 0
  required: true
- display: API Key
  displaypassword: API Key
  name: apikey
  type: 9
  required: true
  hiddenusername: true
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: "false"
  required: false
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: EclecticIQ_lookup_observables
    arguments:
    - name: type
      required: true
      description: 'Type of the value to lookup observables from '
      auto: PREDEFINED
      predefined:
      - ipv4
      - ipv6
      - domain
      - uri
      - email
      - hash-md5
      - hash-sha256
      - hash-sha1
      - hash-sha512
      type: textArea
    - name: value
      required: true
      default: true
      description: Value to search the related observables from EclecticIQ Intelligence Center Platform
      type: textArea
    outputs:
    - contextPath: EclecticIQ.Observables.type
      description: EclecticIQ  Observables type
      type: string
    - contextPath: EclecticIQ.Entity.confidence
      description: EclecticIQ Entity confidence
      type: string
    - contextPath: EclecticIQ.Entity.observables
      description: EclecticIQ Entity related observables
      type: string
    - contextPath: EclecticIQ.Entity.threat_start_time
      description: EclecticIQ Threat start time
      type: date
    - contextPath: EclecticIQ.Entity.title
      description: EclecticIQ Entity Title
      type: string
    description: Lookup observables from EclecticIQ Intelligence Center Platform
  - name: EclecticIQ_create_sighting
    arguments:
    - name: value
      required: true
      description: ' value for the sighting'
      type: textArea
    - name: description
      required: true
      description: description about the sighting
      type: textArea
    - name: title
      required: true
      description: ' Title for the sighting'
      type: textArea
    - name: tags
      required: true
      default: true
      description: ' Tag for the sighting'
      type: textArea
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - ipv4
      - ipv6
      - domain
      - uri
      - email
      - hash-md5
      - hash-sha256
      - hash-sha1
      - hash-sha512
      description: type for the sighting
      type: textArea
    - name: confidence_level
      required: true
      auto: PREDEFINED
      predefined:
      - low
      - medium
      - high
      - unknown
      description: severity level of the sighting
      type: textArea
    outputs:
    - contextPath: Sighting.Data.data.type
      description: Sighting type
      type: string
    - contextPath: Sighting.Data.data.tags
      description: Sighting Tags
      type: string
    - contextPath: Sighting.Data.data.title
      description: Sighting Title
      type: string
    - contextPath: Sighting.Data.data.description
      description: Sighting Description
      type: string
    - contextPath: Sighting.Data.data.timestamp
      description: Sighting timestamp
      type: string
    description: 'create sighting in the EclecticIQ Intelligence Center Platform '
  - name: EclecticIQ_create_observable
    arguments:
    - name: type
      required: true
      description: Type of the observable
      auto: PREDEFINED
      predefined:
      - ipv4
      - ipv6
      - domain
      - uri
      - email
      - hash-md5
      - hash-sha1
      - hash-sha256
      - hash-sha512
      type: textArea
    - name: value
      required: true
      default: true
      description: value of the type of observable
    - name: maliciousness
      required: true
      auto: PREDEFINED
      predefined:
      - unknown
      - safe
      - low
      - medium
      - high
      description: severity level of the type
    outputs:
    - contextPath: Observables.Data.data.type
      description: Observable Type
      type: string
    - contextPath: Observables.Data.data.value
      description: Observable Value
      type: string
    - contextPath: Observables.Data.data.maliciousness
      description: Observable maliciousness
      type: string
    description: 'create observable in the EclecticIQ Intelligence Center Platform '
  runonce: true
  dockerimage: demisto/python3:3.10.13.72123
tests:
- No test - instance issues
fromversion: 6.5.0

EclecticIQ Platform v2 Deprecated

Details

README