ExportIndicators Deprecated

Deprecated. Use the Generic Export Indicators Service integration instead. Use the Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Data Enrichment & Threat Intelligence · Export Indicators (Deprecated)

Details

IDExportIndicators
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/flask-nginx:1.0.0.23674

README

Use the Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Use Cases


  1. Export a list of malicious IPs to block via a firewall.
  2. Export a list of indicators to a service such as Splunk, using a supported output format.

Configure ExportIndicators on Cortex XSOAR


  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for ExportIndicators.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Indicator Query: The query to run to update its list. To view expected results, you can run the following command from the Cortex XSOAR CLI
      !findIndicators query=<your query>
    • Outbound Format: The default format of the entries in the service. Supported formats: text, json, json-seq, csv, XSOAR json, XSOAR json-seq, XSOAR csv, PAN-OS URL, Symantec ProxySG and McAfee Web Gateway.
    • List Size: Max amount of entries in the service instance.
    • Update On Demand Only: When set to true, will only update the service indicators via eis-update command.
    • Refresh Rate: How often to refresh the export indicators list (<number> <time unit>, e.g., 12 hours, 7 days, 3
      months, 1 year)
    • Collapse IPs: Whether to collapse IPs and if so - to ranges or CIDRs.
    • Show CSV Formats as Text: If checked, csv and XSOAR-csv formats will create a textual web page instead of downloading a csv file.
    • Listen Port: Will run the Export Indicators Service on this port from within Cortex XSOAR. If you have multiple Export Indicators Service integration instances, make sure to use different listening ports to separate the outbound feeds.
    • Certificate (Required for HTTPS): HTTPS Certificate provided by pasting its values into this field.
    • Private Key (Required for HTTPS): HTTPS private key provided by pasting its values into this field.
    • HTTP Server: Ignores certificate and private key, and will run the export indicators service
      in HTTP. (Not recommended.)
    • Username: The username with which to authenticate when fetching the indicators.
    • Password: The password with which to authenticate when fetching the indicators.
    • Mcafee Gateway Indicator List Type: For use with McAfee Web Gateway format to indicate the list type.
    • PAN-OS URL Format Port Strip: For use with PAN-OS URL format - if checked will strip the port off
      urls. If not checked - url with ports will be ignored.
    • PAN-OS URL Format Drop Invalid Entries: For use with PAN-OS URL format - if checked any URL entry which is
      not compliant with PAN-OS EDL URL format the entry is dropped instead of being
      rewritten.
    • Symantec ProxySG Default Category: For use with Symantec ProxySG format - set the default category
      for the output.
    • Symantec ProxySG Listed Categories: For use with Symantec ProxySG format - set the categories that should
      be listed in the output. If not set will list all existing categories.
  4. Click Test to validate the URLs, token, and connection.

Access the Export Indicators Service by Instance Name (HTTPS)

Note: By default, the route will be open without security hardening and might expose you to network risks. Cortex XSOAR recommends that you use credentials to connect to connect to the integration.

To access the Export Indicators service by instance name, make sure Instance execute external is enabled.

  1. In Cortex XSOAR, go to Settings > About > Troubleshooting.
  2. In the Server Configuration section, verify that the instance.execute.external key is set to true. If this key does not exist, click + Add Server Configuration and add the instance.execute.external and set the value to true. See this documentation for further information.
  3. In a web browser, go to https://*<demisto_address>*/instance/execute/*<instance_name>* .

Update values in the export indicators service


Updates values stored in the export indicators service (only avaialable On-Demand).

URL Inline Arguments


Use the following arguments in the URL to change the request:

Argument Name Description Example
n The maximum number of entries in the output. If no value is provided, will use the value specified in the List Size parameter configured in the instance configuration. https://{server_host}/instance/execute/{instance_name}?n=50
s The starting entry index from which to export the indicators. https://{server_host}/instance/execute/{instance_name}?s=10&n=50
v The output format. Supports text, csv, json, json-seq,xsoar-json, xsoar-seq, xsoar-csv, mwg, panosurl and proxysg (alias: bluecoat). https://{server_host}/instance/execute/{instance_name}?v=json
q The query used to retrieve indicators from the system. https://{server_host}/instance/execute/{instance_name}?q="type:ip and sourceBrand:my_source"
t Only with mwg format. The type indicated on the top of the exported list. Supports: string, applcontrol, dimension, category, ip, mediatype, number and regex. https://{server_host}/instance/execute/{instance_name}?v=mwg&t=ip
sp Only with panosurl format. If set will strip ports off URLs, otherwise will ignore URLs with ports. https://{server_host}/instance/execute/{instance_name}?v=panosurl&sp
di Only with panosurl format. If set will ignore urls which are not compliant with PAN-OS URL format instead of being re-written. https://{server_host}/instance/execute/{instance_name}?v=panosurl&di
cd Only with proxysg format. The default category for the exported indicators. https://{server_host}/instance/execute/{instance_name}?v=proxysg&cd=default_category
ca Only with proxysg format. The categories which will be exported. Indicators not falling to these categories will be classified as the default category. https://{server_host}/instance/execute/{instance_name}?v=proxysg&ca=category1,category2
tr Whether to collapse IPs. 0 - to not collapse, 1 - collapse to ranges or 2 - collapse to CIDRs https://{server_host}/instance/execute/{instance_name}?q="type:ip and sourceBrand:my_source"&tr=1
tx Whether to output csv or xsoar-csv formats as textual web pages. https://{server_host}/instance/execute/{instance_name}?v=xsoar-csv&tx
sf The field by which to sort the indicators by. Only applicable with the so argument. lastSeen
so The direction by which to order the indicators. The options are asc or desc. Only applicable with the sf argument. asc
Base Command

eis-update

Input
Argument Name Description Required
query The query used to retrieve indicators from the system. Leave empty to use the query from the integration parameters. Optional
format The output format. Optional
list_size The maximum number of entries in the output. If no value is provided, will use the value specified in the List Size parameter configured in the instance configuration. Optional
offset The starting entry index from which to export the indicators. Optional
print_indicators If set to true will print the indicators the that were saved to the export indicators service Required
mwg_type For use with McAfee Web Gateway format to indicate the list type. Optional
strip_port For use with PAN-OS URL format - if True will strip the port off urls. If not checked - url with ports will be ignored. Optional
drop_invalids For use with PAN-OS URL format - if checked any URL entry which is not compliant with PAN-OS EDL URL format the entry is dropped instead of being rewritten. Optional
category_attribute For use with Symantec ProxySG format - set the categories that should be listed in the output. If not set will list all existing categories. Optional
category_default For use with Symantec ProxySG format - set the default category for the output. Optional
collapse_ips Whether to collapse IPs, and if so - to ranges or CIDRs Optional
csv_text If True, will output csv and XSOAR-csv formats as textual web pages Optional
sort_field The field by which to sort the indicators by. Only applicable with the sort_order argument. Optional
sort_order The direction by which to order the indicators. The options are asc or desc. Only applicable with the sort_field argument. Optional
Context Output

There is no context output for this command.

Command Example

!eis-update print_indicators=true query=type:IP format=text list_size=4

Human Readable Output
Indicators
1.1.1.1
2.2.2.2
3.3.3.3
4.4.4.4

Configuration parameters

  • indicators_query — Indicator Query
  • format — Outbound Format
  • collapse_ips — Should Collapse IPs
  • csv_text — Show CSV Formats as Text
  • list_size — List Size (required)
  • on_demand — Update On-Demand Only
  • cache_refresh_rate — Refresh Rate
  • longRunning — Long Running Instance
  • longRunningPort — Listen Port (required)
  • certificate — Certificate (Required for HTTPS)
  • append_string — Append String To EDL
  • prepend_string — Prepend String To EDL
  • key — Private Key (Required for HTTPS)
  • credentials — Username
  • mwg_type — Mcafee Gateway Indicator List Type
  • hsts_header — Add HSTS header
  • strip_port — PAN-OS URL Format Port Strip
  • drop_invalids — PAN-OS URL Format Drop Invalid Entries
  • category_default — Symantec ProxySG Default Category
  • category_attribute — Symantec ProxySG Listed Categories
  • nginx_global_directives — NGINX Global Directives
  • nginx_server_conf — NGINX Server Conf

Commands (1)

  • eis-update

    Updates values stored in the Export Indicators Service (only avaialable On-Demand).

## How to Access the Export Indicators Service
There are two ways that you can access the Export Indicators Service.
Use these to make sure your indicators are exported properly.

In case of several Export Indicators Service integration instances - make sure to use **different listening ports** to separate the outbound feeds.

### Access the Export Indicators Service by URL and Port (HTTP)
In a web browser, go to **http://*cortex-xsoar-server-address*:*listen_port***.

**Note**: For security purposes, Cortex XSOAR recommends that you use HTTPS when accessing the indicator service through the URL and port. To do so, you must provide a certificate and private key, in the respective fields. In addition, make sure to provide credentials that must be used to connect to the integration instance.

### Access the Export Indicators Service by Instance Name (HTTPS)

**Note**: By default, the route will be open without security hardening and might expose you to network risks. Cortex XSOAR recommends that you use the service with a username and password. Click **Switch to username and password** and provide the credentials that must be used to access the service.

To access the Export Indicators service by instance name, make sure ***Instance execute external*** is enabled. 

1. In Cortex XSOAR, go to **Settings > About > Troubleshooting**.
2. In the **Server Configuration** section, verify that the `instance.execute.external.<instance_name>` key is set to `true`. If this key does not exist, click **+ Add Server Configuration** and add the `instance.execute.external.<instance_name>` and set the value to `true`. See [this documentation](https://xsoar.pan.dev/docs/reference/articles/long-running-invoke) for further information.
3. In a web browser, go to `https://<cortex-xsoar_address>/instance/execute/<instance_name>/`.

### Modify Request Parameters Through the URL
Use the following arguments in the URL to change the request:

1. **n** - The maximum number of entries in the output. If no value is provided, will use the value specified in the *List Size* parameter configured in the instance configuration.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?n=50
2. **s** - The starting entry index from which to export the indicators.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?s=10&n=50
3. **v** - The output format. Supports `text`, `csv`, `json`, `json-seq`,`xsoar-json`, `xsoar-seq`, `xsoar-csv`, `mwg`, `panosurl` and `proxysg` (alias: `bluecoat`).
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=json
4. **q** - The query used to retrieve indicators from the system.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?q="type:ip and sourceBrand:my_source"
5. **t** - Only with `mwg` format. The type indicated on the top of the exported list. Supports: string, applcontrol, dimension, category, ip, mediatype, number and regex.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=mwg&t=ip
6. **sp** - Only with `panosurl` format. If set will strip ports off URLs, otherwise will ignore URLs with ports.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=panosurl&sp 
7. **di** - Only with `panosurl` format. If set will ignore URLs which are not compliant with PAN-OS URL format instead of being re-written.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=panosurl&di
8. **cd** - Only with `proxysg` format. The default category for the exported indicators.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=proxysg&cd=default_category
9. **ca** - Only with `proxysg` format. The categories which will be exported. Indicators not in these categories will be classified as the default category.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=proxysg&ca=category1,category2
10. **tr** - Whether to collapse IPs. 
    * 0 - Do not collapse. 
    * 1 - Collapse to ranges.
    * 2 - Collapse to CIDRs.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?q="type:ip and sourceBrand:my_source"&tr=1
11. **tx** - Whether to output `csv` or `xsoar-csv` formats as textual web pages.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=xsoar-csv&tx
12. **sf** - The field by which to sort the indicators by. Only applicable with the `sort_order` argument.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=xsoar-csv&sf=last_seen&so=asc
13. **so** - The direction by which to order the indicators. The options are `asc` or `desc`. Only applicable with the `sort_field` argument.
 * Example: https://{cortex-xsoar_instance}/instance/execute/{ExportIndicators_instance_name}?v=xsoar-csv&sf=last_seen&so=desc

### When running in On-Demand mode
Please make sure to to run !eis-update for the first time to initialize the export process.