FeedCyCognito

category: Data Enrichment & Threat Intelligence
provider: CyCognito
sectionorder:
- Connect
- Collect
commonfields:
  id: FeedCyCognito
  version: -1
configuration:
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental Feed
  hidden: true
  name: feedIncremental
  type: 8
  required: false
  section: Collect
- additionalinfo: The API Key required to authenticate to the service.
  display: API Key
  name: api_key
  required: true
  type: 4
  section: Connect
- additionalinfo: Select the region based on the location of the CyCognito instance. If the region is not listed in the dropdown, choose the "Other" option and specify the region in the "Other Region" text field.
  defaultvalue: General
  display: Region
  name: region
  options:
  - General
  - US
  - Other
  type: 15
  required: false
  section: Connect
- additionalinfo: Specify the region based on the location of the CyCognito instance. Only applicable if the "Other" option is selected in the Region dropdown.
  display: Other Region
  hidden: false
  name: other_region
  required: false
  type: 0
  section: Connect
- additionalinfo: The type of assets to be retrieved.
  display: Asset Type
  name: asset_type
  options:
  - ip
  - domain
  - cert
  - webapp
  - iprange
  required: true
  type: 15
  section: Collect
- additionalinfo: |-
    The date or relative timestamp from where to start fetching assets.

    Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

    For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
  defaultvalue: 2 weeks
  display: First Fetch Time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: The maximum number of assets to fetch every time. The maximum value is '1000'.
  defaultvalue: "50"
  display: Max Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Retrieves the assets attributed to a specific organization, subsidiary, or assignee. Supports comma-separated values.
  display: Organizations
  name: organizations
  type: 0
  required: false
  section: Collect
- additionalinfo: |-
    Filters the assets according to security grade.

    Supported values:
    A: Very strong,
    B: Strong,
    C: Less vulnerable,
    D: Vulnerable,
    F: Highly vulnerable
  display: Security Grade
  name: security_grade
  options:
  - "A: Very strong"
  - "B: Strong"
  - "C: Less vulnerable"
  - "D: Vulnerable"
  - "F: Highly vulnerable"
  type: 16
  required: false
  section: Collect
- additionalinfo: |-
    Filters the assets based on their hosting type.

    Supported values: 'owned', 'cloud', 'undetermined'
  display: Hosting Type
  name: hosting_type
  options:
  - cloud
  - owned
  - undetermined
  type: 16
  required: false
  section: Collect
- additionalinfo: |-
    Filters the assets based on the geographic locations to which they belong. Multiple selection is supported.

    Locations are available only for IP, Domain, and Certificate asset types.
  display: Locations
  name: locations
  options: ["Afghanistan", "Aland Islands", "Albania", "Algeria", "American Samoa", "Andorra", "Angola", "Anguilla", "Antarctica", "Antigua and Barbuda", "Argentina", "Armenia", "Aruba", "Australia", "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", "Bermuda", "Bhutan", "Bolivia, Plurinational State of", "Bonaire, Sint Eustatius and Saba", "Bosnia and Herzegovina", "Botswana", "Bouvet Island", "Brazil", "British Indian Ocean Territory", "Brunei Darussalam", "Bulgaria", "Burkina Faso", "Burundi", "Cabo Verde", "Cambodia", "Cameroon", "Canada", "Cayman Islands", "Central African Republic", "Chad", "Chile", "China", "Christmas Island", "Cocos (Keeling) Islands", "Colombia", "Comoros", "Congo", "Congo, The Democratic Republic of the", "Cook Islands", "Costa Rica", "Cote d'Ivoire", "Croatia", "Cuba", "Curacao", "Cyprus", "Czechia", "Denmark", "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", "Estonia", "Eswatini", "Ethiopia", "Falkland Islands (Malvinas)", "Faroe Islands", "Fiji", "Finland", "France", "French Guiana", "French Polynesia", "French Southern Territories", "Gabon", "Gambia", "Georgia", "Germany", "Ghana", "Gibraltar", "Greece", "Greenland", "Grenada", "Guadeloupe", "Guam", "Guatemala", "Guernsey", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Heard Island and McDonald Islands", "Holy See", "Honduras", "Hong Kong", "Hungary", "Iceland", "India", "Indonesia", "Iran, Islamic Republic of", "Iraq", "Ireland", "Isle of Man", "Israel", "Italy", "Jamaica", "Japan", "Jersey", "Jordan", "Kazakhstan", "Kenya", "Kiribati", "Korea, Democratic People's Republic of", "Korea, Republic of", "Kuwait", "Kyrgyzstan", "Lao People's Democratic Republic", "Latvia", "Lebanon", "Lesotho", "Liberia", "Libya", "Liechtenstein", "Lithuania", "Luxembourg", "Macao", "Madagascar", "Malawi", "Malaysia", "Maldives", "Mali", "Malta", "Marshall Islands", "Martinique", "Mauritania", "Mauritius", "Mayotte", "Mexico", "Micronesia, Federated States of", "Moldova, Republic of", "Monaco", "Mongolia", "Montenegro", "Montserrat", "Morocco", "Mozambique", "Myanmar", "Namibia", "Nauru", "Nepal", "Netherlands", "New Caledonia", "New Zealand", "Nicaragua", "Niger", "Nigeria", "Niue", "Norfolk Island", "North Macedonia", "Northern Mariana Islands", "Norway", "Oman", "Pakistan", "Palau", "Palestine, State of", "Panama", "Papua New Guinea", "Paraguay", "Peru", "Philippines", "Pitcairn", "Poland", "Portugal", "Puerto Rico", "Qatar", "Reunion", "Romania", "Russian Federation", "Rwanda", "Saint Barthelemy", "Saint Helena, Ascension and Tristan da Cunha", "Saint Kitts and Nevis", "Saint Lucia", "Saint Martin (French part)", "Saint Pierre and Miquelon", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Sint Maarten (Dutch part)", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", "South Georgia and the South Sandwich Islands", "South Sudan", "Spain", "Sri Lanka", "Sudan", "Suriname", "Svalbard and Jan Mayen", "Sweden", "Switzerland", "Syrian Arab Republic", "Taiwan, Province of China", "Tajikistan", "Tanzania, United Republic of", "Thailand", "Timor-Leste", "Togo", "Tokelau", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", "Turks and Caicos Islands", "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "United Kingdom of Great Britain and Northern Ireland", "United States of America", "United States Minor Outlying Islands", "Uruguay", "Uzbekistan", "Vanuatu", "Venezuela, Bolivarian Republic of", "Vietnam", "Virgin Islands, British", "Virgin Islands, U.S.", "Wallis and Futuna", "Western Sahara", "Yemen", "Zambia", "Zimbabwe"]
  type: 16
  required: false
  section: Collect
- defaultvalue: "true"
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Good
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- defaultvalue: "1440"
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- name: feedExpirationPolicy
  display: ""
  options:
  - never
  - interval
  - indicatorType
  type: 17
  required: false
  section: Collect
- name: feedExpirationInterval
  defaultvalue: "20160"
  display: ""
  type: 1
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: "false"
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- additionalinfo: When selected, all the incoming indicators will map to a CyCognito Asset indicator type.
  display: Default Indicator Mapping
  name: default_mapping
  type: 8
  required: false
  section: Collect
- additionalinfo: |-
    When selected, Fetches only live assets. 

    Note: This filter supports only IP and IP Range type of assets.
  display: Fetch only Live Assets
  name: only_alive
  type: 8
  defaultvalue: "true"
  required: false
  section: Collect
- additionalinfo: Indicates whether to allow connections without verifying the SSL certificate's validity.
  defaultvalue: "false"
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API.
  defaultvalue: "false"
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
description: The CyCognito Feed integration retrieves the discovered assets from the CyCognito platform based on user-specified filters. A comprehensive dashboard and layout are also included.
display: CyCognito Feed
name: FeedCyCognito
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: |-
        The type of asset to be retrieved.

        Supported values: 'ip', 'domain', 'cert', 'webapp', 'iprange'.
      name: asset_type
      predefined:
      - ip
      - domain
      - cert
      - webapp
      - iprange
      required: true
    - defaultValue: '50'
      description: |-
        The number of results to retrieve.

        Maximum value is '1000'.
      name: count
    - defaultValue: '0'
      description: Sets the starting index for the returned results. By specifying offset, you retrieve a subset of records starting with the offset value.
      name: offset
    - description: |-
        An Advanced Search parameter to query the response.

        Note: Retrieves all the occurrences that are included in the string.
      name: search
    - description: 'The name of the field by which to sort the results. The response fields available for sorting the data are found in the following documentation: https://docs.cycognito.com/reference/reference-getting-started'
      name: sort_by
    - auto: PREDEFINED
      defaultValue: desc
      description: |-
        Specifies whether to sort the results in either ascending or descending order.

        Supported values: 'asc', 'desc'.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: |-
        The date and time at which CyCognito first discovered and attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: first_seen
    - description: |-
        The date and time at which CyCognito most recently attributed the asset to the organization.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

        For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z.
      name: last_seen
    - description: Retrieves the assets attributed to a specific organization, subsidiary, or assignee. Supports comma-separated values.
      name: organizations
    - description: |-
        Filters the assets according to their hosting type. Supports comma-separated values.

        Supported values: 'owned', 'cloud', 'undetermined'.
      name: hosting_type
    - description: |-
        Filters the assets according to security rating. Supports comma-separated values.

        Supported values: 'A', 'B', 'C', 'D', 'F'

        Where:
        A = Very strong
        B = Strong
        C = Less vulnerable
        D = Vulnerable
        F = Highly vulnerable.
      name: security_grade
    - description: |-
        Filters the assets according to their status. Supports comma-separated values.

        Supported values: 'changed', 'new', 'normal'.
      name: status
    - description: |-
        The geographical locations in which the asset is found. Supported values contain the three-letter ISO country code for the respective countries--e.g., IND, USA.

        Locations are available only for IP, Domain, and Certificate asset types.
      name: locations
    - description: A keyword or phrase that can be added to an asset or issue metadata. Supports comma-separated values.
      name: tags
    description: Fetches a given limit of indicators from the CyCognito platform and displays them in human-readable format in the war room.
    name: cycognito-get-indicators
  dockerimage: demisto/pycountry:1.0.0.10120494
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- FeedCyCognito-Test
marketplaces:
- xsoar
- marketplacev2
- platform
fromversion: 6.2.0