EclecticIQ Platform v2

Details

ID	`EclecticIQ Platform v2`
Provider	EclecticIQ
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.10.13.72123`
Supported Modules	Agentix XSIAM

README

EclecticIQ Platform v2

Threat Intelligence Platform that connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships.
This integration was integrated and tested with version of EclecticIQ Platform v2

Configure EclecticIQ Platform v2 in Cortex

Parameter	Required
Server URL (e.g. https://ic-playground.eclecticiq.com/api/v1)	True
API Key	True
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

EclecticIQ_lookup_observables

Lookup observables from EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_lookup_observables

Input

Argument Name	Description	Required
type	Type of the value to lookup observables from . Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha256, hash-sha1, hash-sha512.	Required
value	Value to search the related observables from EclecticIQ Intelligence Center Platform.	Required

Context Output

Path	Type	Description
EclecticIQ.Observables.type	string	EclecticIQ Observables type
EclecticIQ.Entity.confidence	string	EclecticIQ Entity confidence
EclecticIQ.Entity.observables	string	EclecticIQ Entity related observables
EclecticIQ.Entity.threat_start_time	date	EclecticIQ Threat start time
EclecticIQ.Entity.title	string	EclecticIQ Entity Title

Command Example

!EclecticIQ_lookup_observables type="ipv4" value="001.001.001.001"

Context Example

{
    "EclecticIQ":{
       "DBotScore":{
          "Created":"2022-12-20T12:47:24.531410+00:00",
          "ID":"9382489",
          "LastUpdated":"2022-12-20T12:47:24.398456+00:00",
          "Type":"ipv4",
          "indicator":"ipv4",
          "score":3
       },
       "Entity":{
          "confidence":"unknown",
          "threat_start_time":"2022-12-20T12:47:24.474221+00:00",
          "title":"sighting",
          "observables":{
             "classification":"high",
             "type":"ipv4",
             "value":"000.001.001.001",
             "Malicious":{
                "Description":"EclectiqIQ maliciousness confidence level: high",
                "Vendor":"EclectiqIQ"
             },
             "data":[
                {
                   "created_at":"2022-08-24T10:02:04.609448+00:00",
                   "entities":[
                      "https://ic-playground.eclecticiq.com/api/v1/entities/183fa404-ba48-471b-980d-02600fe89a2b"
                   ],
                   "id":7938475,
                   "last_updated_at":"2022-11-23T06:25:55.945630+00:00",
                   "meta":{
                      "maliciousness":"medium"
                   },
                   "sources":[
                      "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"],
                   "type":"ipv4",
                   "value":"000.001.001.001"
                }
             ]
          }
       }
    }
 }

Human Readable Output

EclecticIQ observable reputation - 001.001.001.001

confidence	description	observables	source_name	tags	threat_start_time	title
`low`	creationofsighting	{‘type’: ‘ipv4’, ‘value’: ‘001.001.001.001, ‘classification’: ‘low’}			2022-08-25T04:50:56+00:00	sighting

EclecticIQ_create_sighting

create sighting in the EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_create_sighting

Input

Argument Name	Description	Required
value	value for the sighting.	Required
description	description about the sighting.	Required
title	Title for the sighting.	Required
tags	Tag for the sighting.	Required
type	type for the sighting. Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha256, hash-sha1, hash-sha512.	Required
confidence_level	severity level of the sighting. Possible values are: low, medium, high, unknown.	Required

Context Output

Path	Type	Description
Sighting.Data.data.type	string	Sighting Type
Sighting.Data.data.tags	string	Sighting Tags
Sighting.Data.data.title	string	Sighting Title
Sighting.Data.data.description	string	Sighting Description
Sighting.Data.data.timestamp	string	Sighting timestamp

Command Example

!EclecticIQ_create_sighting type="ipv4" value="001.001.001.001" description="sighting creation" title="sighting" tags="Alert" confidence_level="high"

Context Example

{
   "Sighting":{
      "Data":{
         "data":{
            "last_updated_at":"2022-12-28T12:45:05.465825+00:00",
            "outgoing_feeds":[],
            "meta":{
               "estimated_observed_time":"2022-12-28T12:45:05.508090+00:00",
               "half_life":182,
               "attacks":[],
               "estimated_threat_start_time":"2022-12-28T12:45:04+00:00",
               "taxonomies":[],
               "estimated_threat_end_time":"null",
               "source_reliability":"A",
               "tags":["Alert"],
               "tlp_color":null
            },
            "created_at":"2022-12-28T12:45:05.508090+00:00",
            "data":{
               "confidence":"high",
               "description":"sighting creation",
               "id":"{https://ic-playground.eclecticiq.com}eclecticiq-sighting-742ad072-86ad-11ed-ad71-067b5e23fb5e",
               "timestamp":"2022-12-28T12:45:04+00:00",
               "title":"sighting",
               "relevancy":1
            },
            "observables":[
               "https://ic-playground.eclecticiq.com/api/v1/observables/9391529"
            ],
            "attachments":[],
            "incoming_feed":null,
            "sources":[
               "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"
            ],
            "type":"eclecticiq-sighting",
            "id":"453d1fb2-d654-4a7a-9654-40556a893640",
            "datasets":[]
         }
      }
   }
}

Human Readable Output

!sighting created for- 001.001.001.001

confidence	description
`Type`	ipv4
`confidence_level`	low
`description`	sighting creation
`tags`	Alert
`title`	sighting
`value`	001.001.001.001

EclecticIQ_create_observable

create observable in the EclecticIQ Intelligence Center Platform

Base Command

EclecticIQ_create_observable

Input

Argument Name	Description	Required
type	Type of the observable. Possible values are: ipv4, ipv6, domain, uri, email, hash-md5, hash-sha1, hash-sha256, hash-sha512.	Required
value	value of the type of observable.	Required
maliciousness	severity level of the type. Possible values are: unknown, safe, low, medium, high.	Required

Context Output

Path	Type	Description
Observables.Data.data.type	string	Observable Type
Observables.Data.data.value	string	Observable Value
Observables.Data.data.maliciousness	string	Observable maliciousness

Command Example

!EclecticIQ_create_observable type="ipv4" value="001.001.001.001" maliciousness="high"

Context Example

{
   "Observables":{
      "Data":{
         "data":[
            {
               "created_at":"2022-12-26T13:16:06.757271+00:00",
               "entities":[
                  "https://ic-playground.eclecticiq.com/api/v1/entities/3a1cc90b-9cbd-437a-ab0b-7153b1bb275b"
               ],
               "id":9389500,
               "last_updated_at":"2022-12-26T13:16:06.677236+00:00",
               "meta":{
                  "maliciousness":"low"
               },
               "sources":[
                  "https://ic-playground.eclecticiq.com/api/v1/sources/9a479225-37d1-4dae-9554-172eeccea193"
               ],
               "type":"ipv4",
               "value":"001.001.001.001"
            }
         ]
      }
   }
}

Human Readable Output

Observables created successfully…

confidence	description
`maliciousness`	low
`type`	ipv4
`value`	001.001.001.001

Configuration parameters

url — Server URL (e.g. https://ic-playground.eclecticiq.com/api/v1) (required)
apikey — API Key (required)
proxy — Use system proxy settings

Commands (3)

EclecticIQ_create_observable
create observable in the EclecticIQ Intelligence Center Platform
EclecticIQ_create_sighting
create sighting in the EclecticIQ Intelligence Center Platform
EclecticIQ_lookup_observables
Lookup observables from EclecticIQ Intelligence Center Platform

Source

EclecticIQv2.py EclecticIQv2_test.py EclecticIQv2.yml EclecticIQv2_description.md command_examples.txt

Download History Raw

!EclecticIQ_create_observable type="ipv4" value="001.001.001.001" maliciousness="high"
!EclecticIQ_create_sighting type="ipv4" value="001.001.001.001" description="sighting creation" title="sighting" tags="Alert" confidence_level="high"
!EclecticIQ_lookup_observables type="ipv4" value="001.001.001.001"
!EclecticIQ_create_observable type="email" value="example@example.com" maliciousness="medium"
!EclecticIQ_create_sighting type="ipv6" value="2001:0db8:85a3:0000:0000:8a2e:0370:7334" description="sighting creation" title="sighting" tags="Alert" confidence_level="low"
!EclecticIQ_lookup_observables type="ipv6" value="2001:0db8:85a3:0000:0000:8a2e:0370:7334"
!EclecticIQ_create_observable type="uri" value="https://examples.com" maliciousness="safe"
!EclecticIQ_create_sighting type="uri" value="https://examples.com" description="sighting creation" title="sighting" tags="Alert" confidence_level="high"

EclecticIQ Platform v2 Deprecated

Details

README