Cisco Secure Malware Analytics

Details

ID	`Cisco Secure Malware Analytics`
Provider	Cisco Systems
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Secure Malware Analytics (formerly Threat Grid) combines advanced sandboxing with threat intelligence into one unified solution to protect organizations from malware.

Configure Cisco Secure Malware Analytics in Cortex

Parameter	Description	Required
API Key	The Cisco Secure Malware Analytics API key.	True
Feed Name	The feed name to fetch.	True
First fetch	The date or number of days from when to start fetching indicators.	False
Fetch indicators	Whether to fetch indicators.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Feed Fetch Interval	The feed fetch interval.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings	Whether to use the system proxy settings.	False
Trust any certificate	Whether to trust any certificate (not secure).	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cisco-sma-get-indicators

Retrieves indicators.

Base Command

cisco-sma-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of indicators to retrieve.	Optional

Context Output

Path	Type	Description
CiscoSMA.value	String	The indicator value.
CiscoSMA.type	Unknown	The indicator type.
CiscoSMA.Tags	String	Tags that are associated with the indicator.
CiscoSMA.Description	String	The feed description.
CiscoSMA.FeedRelatedIndicators.type	String	The type of the indicators that are associated with the domain.
CiscoSMA.FeedRelatedIndicators.value	String	Indicators that are associated with the domain.

Command Example

!cisco-sma-get-indicators limit=1

Context Example

{
    "CiscoSMA": {
        "fields": {
            "Description": "DNS response information from requests made by document samples performing network communications.",
            "FirstSeenBySource": "2021-04-13T12:47:34Z",
            "Tags": [
                "doc-net-com-dns"
            ],
            "reportedby": "CiscoSMA",
            "trafficlightprotocol": "GREEN"
        },
        "rawJSON": {
            "description": "DNS response information from requests made by document samples performing network communications.",
            "domain": "example.com",
            "info": "example.com/feeds/doc-net-com-dns/domain",
            "ips": [
                "0.0.0.0"
            ],
            "sample": "example",
            "sample_md5": "1234556",
            "sample_sha1": "1234556",
            "sample_sha256": "1234556",
            "timestamp": "2021-04-13T12:47:34Z"
        },
        "type": "IP",
        "value": "0.0.0.0"
    }
}

Human Readable Output

CiscoSMA Indicators

value type

o.o.o.o IP

value	type
o.o.o.o	IP

cisco-sma-reset-fetch-indicators

WARNING: This command will reset your fetch history.

Base Command

cisco-sma-reset-fetch-indicators

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!cisco-sma-reset-fetch-indicators

Human Readable Output

Fetch history deleted successfully

Configuration parameters

base_url — URL
api_key — API Key (Leave empty. Fill in the API Key in the password field.)
feed_name — Feed Name (required)
first_fetch — First fetch
feed — Fetch indicators
feedReputation — Indicator Reputation
tlp_color — Traffic Light Protocol Color
feedTags — Tags
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
create_relationships — Create Relationships

Commands (2)

cisco-sma-get-indicators
Retrieves indicators.
cisco-sma-reset-fetch-indicators
WARNING: This command will reset your fetch history.

Source

FeedCiscoSecureMalwareAnalytics.py FeedCiscoSecureMalwareAnalytics_test.py FeedCiscoSecureMalwareAnalytics.yml FeedCiscoSecureMalwareAnalytics_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Cisco Systems
commonfields:
  id: Cisco Secure Malware Analytics
  version: -1
configuration:
- display: URL
  name: base_url
  defaultvalue: https://panacea.threatgrid.com/api/v3/feeds/
  type: 0
- display: API Key (Leave empty. Fill in the API Key in the password field.)
  displaypassword: API Key
  name: api_key
  hiddenusername: true
  type: 9
  required: false
- display: Feed Name
  name: feed_name
  options:
  - all
  - autorun-registry
  - banking-dns
  - dga-dns
  - dll-hijacking-dns
  - doc-net-com-dns
  - downloaded-pe-dns
  - dynamic-dns
  - irc-dns
  - modified-hosts-dns
  - parked-dns
  - public-ip-check-dns
  - ransomware-dns
  - rat-dns
  - scheduled-tasks
  - sinkholed-ip-dns
  - stolen-cert-dns
  required: true
  type: 16
- additionalinfo: The date or number of days from when to start fetching indicators.
  display: First fetch
  name: first_fetch
  type: 0
  required: false
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Good
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  defaultvalue: GREEN
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: 'false'
  type: 8
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: 'true'
  display: Create Relationships
  name: create_relationships
  type: 8
  required: false
description: Secure Malware Analytics (formerly Threat Grid) combines advanced sandboxing with threat intelligence into one unified solution to protect organizations from malware.
display: Cisco Secure Malware Analytics Feed
name: Cisco Secure Malware Analytics
script:
  commands:
  - arguments:
    - description: The maximum number of indicators to retrieve.
      name: limit
    description: Retrieves indicators.
    name: cisco-sma-get-indicators
    outputs:
    - contextPath: CiscoSMA.value
      description: The indicator value.
      type: String
    - contextPath: CiscoSMA.type
      description: The indicator type.
      type: Unknown
    - contextPath: CiscoSMA.Tags
      description: Tags that are associated with the indicator.
      type: String
    - contextPath: CiscoSMA.Description
      description: The feed description.
      type: String
    - contextPath: CiscoSMA.FeedRelatedIndicators.type
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: CiscoSMA.FeedRelatedIndicators.value
      description: Indicators that are associated with the domain.
      type: String
  - description: 'WARNING: This command will reset your fetch history.'
    name: cisco-sma-reset-fetch-indicators
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.5.0