Cyberint Feed

Details

ID	`Cyberint Feed`
Provider	Check Point Software Technologies
Category	Data Enrichment & Threat Intelligence
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Use the Cyberint Feed integration to get indicators from the feed.

Configure Cyberint Feed on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Cyberint Feed.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Cyberint API URL	Example: `https://yourcompany.cyberint.io`	True
API access token		True
Fetch indicators	Should be checked (true)	False
Indicator Type	Which indicator types to fetch	True
Confidence	Confidence about the indicator details. The value of confidence to fetch indicators from. The value between 0-100.	False
Severity	Severity about the indicator details. The value of severity to fetch indicators from. The value between 0-100.	False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberint-get-indicators

Gets indicators from the feed.

Base Command

cyberint-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of results to return. The default value is 10. Default is 10.	Optional

Context Output

Path	Type	Description
Cyberint.indicator.ioc_value	String	The indicator value.
Cyberint.indicator.ioc_type	String	The indicator type.
Cyberint.indicator.description	String	The feed description.
Cyberint.indicator.detected_activity	String	The feed detected activity.
Cyberint.indicator.observation_date	String	The feed observation date.
Cyberint.indicator.severity_score	String	The feed severity score.
Cyberint.indicator.confidence	String	The feed confidence.

Command example

!cyberint-get-indicators limit=10 execution-timeout=700

Context Example

{
    "Cyberint": [
        {
            "fields": {
                "Description": "Recognized as Malicious.",
                "FirstSeenBySource": "2024-01-23T22:53:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as Malicious.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc1",
                "observation_date": "2024-01-23T22:53:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc1"
        },
        {
            "fields": {
                "Description": "Recognized as zzz.",
                "FirstSeenBySource": "2024-01-23T22:55:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as zzz.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc2",
                "observation_date": "2024-01-23T22:55:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc2"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:53:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc3",
                "observation_date": "2024-01-23T22:53:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc3"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:31+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc4",
                "observation_date": "2024-01-23T22:55:31+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc4"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc5",
                "observation_date": "2024-01-23T22:55:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc5"
        },
        {
            "fields": {
                "Description": "Recognized as Trojan.xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:39+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as Trojan.xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc6",
                "observation_date": "2024-01-23T22:55:39+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc6"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-12T01:39:06+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc7",
                "observation_date": "2024-01-12T01:39:06+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc7"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc8",
                "observation_date": "2024-01-23T22:55:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc8"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2023-12-16T21:28:01+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 70,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc9",
                "observation_date": "2023-12-16T21:28:01+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc9"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc10",
                "observation_date": "2024-01-23T22:55:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc10"
        }
    ]
}

Human Readable Output

Indicators from Cyberint Feed

Name	Type	Description
Detected activity	String	Type of detected activity.
IoC type	String	The indicator type.
IoC value	String	The indicator value.
Observation date	String	Observation date of detected activity.
Severity score	Number	Severity score of detected activity.
Confidence	Number	Confidence of detected activity.
Description	String	Description of detected activity.

cyberint-get-file-sha256

Gets File SHA256 from the feed.

Base Command

cyberint-get-file-sha256

Input

Argument Name	Description	Required
value	File SHA256 hash	Required

Context Output

Path	Type	Description
Cyberint.file_sha256.entity.type	String	The indicator type.
Cyberint.file_sha256.entity.value	String	The indicator value.
Cyberint.file_sha256.enrichment.first_seen	String	First seen.
Cyberint.file_sha256.enrichment.download_urls	String	Download URLs.
Cyberint.file_sha256.enrichment.filenames	String	Filenames.
Cyberint.file_sha256.benign	String	Benign.
Cyberint.file_sha256.risk.malicious_score	String	Malicious score.
Cyberint.file_sha256.risk.occurrences_count	String	Occurrences count.

Command example

!cyberint-get-file-sha256 value=6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789

Context Example

{
    "data": {
        "entity": {
            "type": "file/sha256",
            "value": "6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789"
        },
        "risk": {
            "malicious_score": 100,
            "detected_activities": [
                {
                    "type": "malware",
                    "observation_date": "2025-03-05T14:47:43.994848+00:00",
                    "description": "",
                    "confidence": 100,
                    "occurrences_count": 1
                },
                {
                    "type": "malware_payload",
                    "observation_date": "2025-02-12T21:08:13+00:00",
                    "description": "Detected in 1 source(s). Recognized as Trojan.Agent.CYZT.",
                    "confidence": 80,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 2
        },
        "enrichment": {
            "related_entities": null,
            "filenames": [
                "rifaien2-TwxvxoHtj44icOI0.exe"
            ],
            "first_seen": "2025-02-12T21:08:13+00:00",
            "download_urls": []
        },
        "benign": false
    }
}

Human Readable Output

File SHA256 Entity

Name	Type	Description
Type	String	The indicator type.
Value	String	The indicator value.
Malicious score	Number	Malicious score.
Benign	Boolean	Benign.

File SHA256 Enrichment

Name	Type	Description
Filenames	String	List of filenames.
First seen	String	First seen.
Download URLs	String	List of download URLs.

File SHA256 Detected activities

Name	Type	Description
Type	String	Type of detected activity.
Observation date	String	Observation date of detected activity.
Description	String	Description of detected activity.
Confidence	Number	Confidence of detected activity.
Occurrences count	Number	Occurrences count of detected activity.

cyberint-get-domain

Gets Domain from the feed.

Base Command

cyberint-get-domain

Input

Argument Name	Description	Required
value	Domain	Required

Context Output

Path	Type	Description
Cyberint.domain.entity.type	String	The indicator type.
Cyberint.domain.entity.value	String	The indicator value.
Cyberint.domain.risk.malicious_score	String	Malicious score.
Cyberint.domain.risk.occurrences_count	String	Occurrences count.
Cyberint.domain.enrichment.ips	String	IPs.
Cyberint.domain.enrichment.whois.created_date	String	Created date.
Cyberint.domain.enrichment.whois.updated_date	String	Updated date.
Cyberint.domain.enrichment.whois.expiration_date	String	Expiration date.
Cyberint.domain.enrichment.whois.registrant_name	String	Registrant name.
Cyberint.domain.enrichment.whois.registrant_email	String	Registrant email.
Cyberint.domain.enrichment.whois.registrant_organization	String	Registrant organization.
Cyberint.domain.enrichment.whois.registrant_country	String	Registrant country.
Cyberint.domain.enrichment.whois.registrant_telephone	String	Registrant telephone.
Cyberint.domain.enrichment.whois.technical_contact_email	String	Technical contact email.
Cyberint.domain.enrichment.whois.technical_contact_name	String	Technical contact name.
Cyberint.domain.enrichment.whois.technical_contact_organization	String	Technical contact organization.
Cyberint.domain.enrichment.whois.registrar_name	String	Registrar name.
Cyberint.domain.enrichment.whois.admin_contact_name	String	Admin contact name.
Cyberint.domain.enrichment.whois.admin_contact_organization	String	Admin contact organization.
Cyberint.domain.enrichment.whois.admin_contact_email	String	Admin contact email.
Cyberint.domain.benign	String	Benign.

Command example

!cyberint-get-domain value=dummy.com

Context Example

{
    "data": {
        "entity": {
            "type": "domain",
            "value": "domain.com"
        },
        "risk": {
            "malicious_score": 80,
            "detected_activities": [
                {
                    "type": "infecting_url",
                    "observation_date": "2025-03-05T14:47:23.534044+00:00",
                    "description": "URL that may infect it’s visitors with malware.",
                    "confidence": 100,
                    "occurrences_count": 1
                },
                {
                    "type": "phishing_website",
                    "observation_date": "2024-09-16T06:26:16+00:00",
                    "description": "Detected phishing website targeting Dummy.",
                    "confidence": 20,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 2
        },
        "enrichment": {
            "related_entities": null,
            "ips": [
                "11.197.130.221"
            ],
            "whois": {
                "registrant_name": null,
                "registrant_email": null,
                "registrant_organization": null,
                "registrant_country": "USA",
                "registrant_telephone": null,
                "technical_contact_email": null,
                "technical_contact_name": null,
                "technical_contact_organization": null,
                "registrar_name": "Registrar.com",
                "admin_contact_name": null,
                "admin_contact_organization": null,
                "admin_contact_email": null,
                "created_date": "2024-09-10T09:29:58",
                "updated_date": "2024-10-18T05:44:51",
                "expiration_date": "2025-09-10T23:59:59"
            }
        },
        "benign": false
    }
}

Human Readable Output

Domain Entity

Name	Type	Description
Type	String	The indicator type.
Value	String	The indicator value.
Malicious score	Number	Malicious score.
Occurrences count	Number	Occurrences count.
Benign	Boolean	Benign.

Domain Enrichment

Name	Type	Description
IPs	String	List of IP addresses.
Whois registrant name	String	Whois registrant name.
Whois registrant email	String	Whois registrant email.
Whois registrant organization	String	Whois registrant organization.
Whois registrant country	String	Whois registrant country.
Whois registrant telephone	String	Whois registrant telephone.
Whois technical contact email	String	Whois technical contact email.
Whois technical contact name	String	Whois technical contact name.
Whois technical contact organization	String	Whois technical contact organization.
Whois registrar name	String	Whois registrar name.
Whois admin contact name	String	Whois admin contact name.
Whois admin contact organization	String	Whois admin contact organization.
Whois admin contact email	String	Whois admin contact email.
Whois admin contact email	String	Whois admin contact email.
Created date	String	Created date.
Updated date	String	Updated date.
Expiration date	String	Expiration date.

Domain Detected activities

Name	Type	Description
Type	String	Type of detected activity.
Observation date	String	Observation date of detected activity.
Description	String	Description of detected activity.
Confidence	Number	Confidence of detected activity.
Occurrences count	Number	Occurrences count of detected activity.

cyberint-get-ipv4

Gets Domain from the feed.

Base Command

cyberint-get-ipv4

Input

Argument Name	Description	Required
value	IPv4	Required

Context Output

Path	Type	Description
Cyberint.ipv4.entity.type	String	The indicator type.
Cyberint.ipv4.entity.value	String	The indicator value.
Cyberint.ipv4.risk.malicious_score	String	Malicious score.
Cyberint.ipv4.risk.occurrences_count	String	Occurrences count.
Cyberint.ipv4.enrichment.geo.country	String	Country.
Cyberint.ipv4.enrichment.geo.city	String	City.
Cyberint.ipv4.enrichment.asn.number	String	ASN number.
Cyberint.ipv4.enrichment.asn.organization	String	ASN organization.
Cyberint.ipv4.enrichment.suspicious_urls	String	Suspicious URLs.
Cyberint.ipv4.enrichment.suspicious_domains	String	Suspicious domains.
Cyberint.ipv4.benign	String	Benign.

Command example

!cyberint-get-ipv4 value=1.1.1.1

Context Example

{
    "data": {
        "entity": {
            "type": "ipv4",
            "value": "11.197.130.221"
        },
        "risk": {
            "malicious_score": 100,
            "detected_activities": [
                {
                    "type": "payload_delivery",
                    "observation_date": "2025-02-13T08:38:50+00:00",
                    "description": "Detected hosting malware.",
                    "confidence": 20,
                    "occurrences_count": 836
                },
                {
                    "type": "phishing_website",
                    "observation_date": "2025-03-05T10:17:32+00:00",
                    "description": "Detected phishing website targeting Dummy, ING Direct, genericcloudflare.",
                    "confidence": 20,
                    "occurrences_count": 143
                },
                {
                    "type": "cnc_server",
                    "observation_date": "2025-02-14T22:21:12.084000+00:00",
                    "description": "Detected in 21 source(s). Recognized as Quasar RAT. Detected activity linked to: Bumblebee (Malware), Cotton Sandstorm (Threat-Actor-Group), DadSec (Malware), GHOSTSPIDER (Malware), Quasar RAT (Malware), Salt Typhoon (Threat-Actor-Group), Sneaky 2FA (Malware), Vidar (Malware)",
                    "confidence": 90,
                    "occurrences_count": 21
                }
            ],
            "occurrences_count": 1000
        },
        "enrichment": {
            "related_entities": [
                {
                    "entity_id": "c654837d-444e-4f5c-a444-09fd8250696c",
                    "entity_type": "Malware",
                    "entity_name": "GHOSTSPIDER"
                },
                {
                    "entity_id": "70b54325-05ea-46c6-b4e9-b25bc3617104",
                    "entity_type": "Threat-Actor-Group",
                    "entity_name": "Salt Typhoon"
                },
                {
                    "entity_id": "baffd4c4-4483-4b84-96eb-0d19af94d2e8",
                    "entity_type": "Malware",
                    "entity_name": "DadSec"
                },
                {
                    "entity_id": "862341a5-1951-4e09-b3c1-baac41dc7bcb",
                    "entity_type": "Malware",
                    "entity_name": "Vidar"
                },
                {
                    "entity_id": "7b0a986f-733e-4497-8867-6aed00b802b8",
                    "entity_type": "Threat-Actor-Group",
                    "entity_name": "Cotton Sandstorm"
                },
                {
                    "entity_id": "58cbb47d-176d-4937-9ebc-5121ceb36cf9",
                    "entity_type": "Malware",
                    "entity_name": "Sneaky 2FA"
                },
                {
                    "entity_id": "2728ad3e-d870-4654-afd3-9a839f97dd72",
                    "entity_type": "Malware",
                    "entity_name": "Bumblebee"
                },
                {
                    "entity_id": "fc26b8a7-a7cc-47b8-be1e-92b7a969543b",
                    "entity_type": "Malware",
                    "entity_name": "Quasar RAT"
                }
            ],
            "geo": {
                "country": "United States",
                "city": null
            },
            "asn": {
                "number": 16509,
                "organization": "AMAZON-02"
            },
            "suspicious_urls": [],
            "suspicious_domains": []
        },
        "benign": false
    }
}

Human Readable Output

IPv4 Entity

Name	Type	Description
Type	String	The indicator type.
Value	String	The indicator value.
Malicious score	Number	Malicious score.
Occurrences count	Number	Occurrences count.
IPs	String	List of IP addresses.
Hostname	String	Hostname.
Domain	String	Domain.
Benign	Boolean	Benign.

IPv4 Enrichment

Name	Type	Description
Suspicious Urls	String	List of Suspicious Urls.
Suspicious Domains	String	List of Suspicious domains.

IPv4 Detected activities

Name	Type	Description
Type	String	Type of detected activity.
Observation date	String	Observation date of detected activity.
Description	String	Description of detected activity.
Confidence	Number	Confidence of detected activity.
Occurrences count	Number	Occurrences count of detected activity.

cyberint-get-url

Gets Domain from the feed.

Base Command

cyberint-get-url

Input

Argument Name	Description	Required
value	URL	Required

Context Output

Path	Type	Description
Cyberint.url.entity.type	String	The indicator type.
Cyberint.url.entity.value	String	The indicator value.
Cyberint.url.risk.malicious_score	String	Malicious score.
Cyberint.url.risk.occurrences_count	String	Occurrences count.
Cyberint.url.enrichment.ips	String	IPs.
Cyberint.url.enrichment.hostname	String	Hostname.
Cyberint.url.enrichment.domain	String	Domain.
Cyberint.url.benign	String	Benign.

Command example

!cyberint-get-url value=http://dummy.com

Context Example

{
    "data": {
        "entity": {
            "type": "url",
            "value": "http://dummy.com"
        },
        "risk": {
            "malicious_score": 80,
            "detected_activities": [
                {
                    "type": "infecting_url",
                    "observation_date": "2025-03-05T11:18:01.941280+00:00",
                    "description": "URL that may infect it’s visitors with malware.",
                    "confidence": 100,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 1
        },
        "enrichment": {
            "related_entities": null,
            "ips": [],
            "hostname": null,
            "domain": null
        },
        "benign": false
    }
}

Human Readable Output

URL Entity

Name	Type	Description
Type	String	The indicator type.
Value	String	The indicator value.
Malicious score	Number	Malicious score.
Occurrences count	Number	Occurrences count.
IPs	String	List of IP addresses.
Hostname	String	Hostname.
Domain	String	Domain.
Benign	Boolean	Benign.

URL Detected activities

Name	Type	Description
Type	String	Type of detected activity.
Observation date	String	Observation date of detected activity.
Description	String	Description of detected activity.
Confidence	Number	Confidence of detected activity.
Occurrences count	Number	Occurrences count of detected activity.

cyberint-cve-enrich

Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence.

Base Command

cyberint-cve-enrich

Input

Argument Name	Description	Required
cve_id	CVE identifier to enrich (e.g., CVE-2024-1234). Supports a comma-separated list of identifiers.	Required

Context Output

Path	Type	Description
Cyberint.CVE.cve_id	String	The CVE identifier.
Cyberint.CVE.cyberint_score	Number	Cyberint proprietary risk score for the CVE.
Cyberint.CVE.epss	Number	EPSS (Exploit Prediction Scoring System) probability score.
Cyberint.CVE.description	String	The CVE description.
Cyberint.CVE.published	Date	The date the CVE was published.
Cyberint.CVE.last_updated	Date	The date the CVE was last updated.
Cyberint.CVE.cvss.cvss_v3.base_score	Number	CVSS v3 base score.
Cyberint.CVE.cvss.cvss_v3.base_severity	String	CVSS v3 base severity.
Cyberint.CVE.cvss.cvss_v4.base_score	Number	CVSS v4 base score.
Cyberint.CVE.cwes.cwe_id	String	Associated CWE identifier.
Cyberint.CVE.cwes.name	String	Associated CWE name.
Cyberint.CVE.risk_factors	Unknown	Risk factors associated with the CVE.
Cyberint.CVE.exploited_by	Unknown	Threat actors observed exploiting the CVE.
Cyberint.CVE.products	Unknown	Products affected by the CVE.
Cyberint.CVE.recommendation	String	Cyberint remediation recommendation for the CVE.
Cyberint.CVE.references	Unknown	External references for the CVE.
CVE.ID	String	The CVE identifier.
CVE.CVSS	String	The CVSS score of the CVE.
CVE.Published	Date	The date the CVE was published.
CVE.Description	String	The CVE description.

Command Example

!cyberint-cve-enrich cve_id="CVE-2024-1234"

cyberint-credential-leak-lookup

Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API.

Base Command

cyberint-credential-leak-lookup

Input

Argument Name	Description	Required
domain	The company domain to search leaked credentials for (e.g., example.com).	Required
last_seen_from	Only return credentials last seen on or after this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ).	Optional
last_seen_to	Only return credentials last seen on or before this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ).	Optional
limit	Maximum number of leaked credential records to return per credential type (employee/customer).	Optional

Context Output

Path	Type	Description
Cyberint.LeakedCredential.domain	String	The company domain that was searched.
Cyberint.LeakedCredential.total	Number	Total number of leaked credential records returned.
Cyberint.LeakedCredential.employee_total	Number	Number of leaked employee credential records returned.
Cyberint.LeakedCredential.customer_total	Number	Number of leaked customer credential records returned.
Cyberint.LeakedCredential.employee_credentials.username	String	The leaked employee account username.
Cyberint.LeakedCredential.employee_credentials.first_seen	Date	The date the employee credential was first observed.
Cyberint.LeakedCredential.employee_credentials.last_seen	Date	The date the employee credential was last observed.
Cyberint.LeakedCredential.employee_credentials.entries	Unknown	The leaked credential entries (password, source, URL) for the employee account.
Cyberint.LeakedCredential.customer_credentials.username	String	The leaked customer account username.
Cyberint.LeakedCredential.customer_credentials.first_seen	Date	The date the customer credential was first observed.
Cyberint.LeakedCredential.customer_credentials.last_seen	Date	The date the customer credential was last observed.
Cyberint.LeakedCredential.customer_credentials.entries	Unknown	The leaked credential entries (password, source, URL) for the customer account.

Command Example

!cyberint-credential-leak-lookup domain="example.com"

Configuration parameters

url — Cyberint API URL (required)
client_name — Company Name (required)
access_token — API Key (Leave empty. Fill in the API Key in the password field.) (required)
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
indicator_type — Indicator Type (required)
feed_name — Feed Name (required)
confidence_from — Confidence
severity_from — Severity
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (7)

cyberint-credential-leak-lookup
Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API.
cyberint-cve-enrich
Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence.
cyberint-get-domain
Gets Domain enrichment from the feed.
cyberint-get-file-sha256
Gets File SHA256 enrichment from the feed.
cyberint-get-indicators
Gets indicators from the feed.
cyberint-get-ipv4
Gets IPv4 enrichment from the feed.
cyberint-get-url
Gets URL enrichment from the feed.

Source

FeedCyberint.py FeedCyberint_test.py FeedCyberint.yml FeedCyberint_description.md command_examples.txt

Download History Raw

sectionorder:
- Connect
- Collect
commonfields:
  id: Cyberint Feed
  version: -1
fromversion: 6.9.0
name: Cyberint Feed
display: Check Point EM Feed
provider: Check Point Software Technologies
category: Data Enrichment & Threat Intelligence
description: Use the Cyberint Feed integration to get indicators from the feed.
configuration:
- display: Cyberint API URL
  additionalinfo: Cyberint API URL on which the services run (i.e https://your-company.cyberint.io)
  name: url
  required: true
  type: 0
  section: Connect
- display: Company Name
  additionalinfo: Company (client) name associated with Cyberint instance.
  name: client_name
  required: true
  type: 0
  section: Connect
- display: API Key (Leave empty. Fill in the API Key in the password field.)
  displaypassword: API access token
  name: access_token
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Fetch indicators
  name: feed
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  name: feedReputation
  defaultvalue: Good
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  required: false
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: F - Reliability cannot be judged
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- additionalinfo: Which indicator types to fetch
  defaultvalue: All
  display: Indicator Type
  name: indicator_type
  options:
  - All
  - IP
  - Domain
  - URL
  - File
  required: true
  type: 16
  section: Collect
- display: Feed Name
  name: feed_name
  defaultvalue: All
  options:
  - All
  - malware_payload
  - cnc_server
  - infected_machine
  - phishing_website
  - payload_delivery
  - cc_skimming
  - botnet
  - anonymization
  required: true
  type: 16
  section: Collect
- additionalinfo: Confidence about the indicator details. The value of confidence to fetch indicators from. The value between 0-100.
  display: Confidence
  name: confidence_from
  defaultvalue: "0"
  type: 0
  required: false
  section: Collect
- additionalinfo: Severity about the indicator details. The value of severity to fetch indicators from. The value between 0-100.
  display: Severity
  name: severity_from
  defaultvalue: "0"
  type: 0
  required: false
  section: Collect
- display: ""
  name: feedExpirationPolicy
  defaultvalue: suddenDeath
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  section: Collect
- display: ""
  name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: "240"
  type: 19
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: python
  commands:
  - name: cyberint-get-indicators
    arguments:
    - name: date
      description: Date of data feed for retrieval (e.g. 2024-12-31). The default value is today.
    - name: limit
      description: The maximum number of results to return. The default value is 50.
      defaultValue: "50"
    - name: offset
      description: Specifies the starting point or position from which data retrieval or processing should begin.
      defaultValue: "0"
    outputs:
    - contextPath: Cyberint.indicator.detected_activity
      description: Detected activity.
      type: String
    - contextPath: Cyberint.indicator.ioc_type
      description: The indicator type.
      type: String
    - contextPath: Cyberint.indicator.ioc_value
      description: The indicator value.
      type: String
    - contextPath: Cyberint.indicator.observation_date
      description: Observation date.
      type: String
    - contextPath: Cyberint.indicator.severity_score
      description: Severity score.
      type: String
    - contextPath: Cyberint.indicator.confidence
      description: Confidence.
      type: String
    - contextPath: Cyberint.indicator.description
      description: Description.
      type: String
    description: Gets indicators from the feed.
  - name: cyberint-get-file-sha256
    arguments:
    - name: value
      description: SHA256 string.
    outputs:
    - contextPath: Cyberint.file_sha256.entity.type
      description: The indicator type.
      type: String
    - contextPath: Cyberint.file_sha256.entity.value
      description: The indicator value.
      type: String
    - contextPath: Cyberint.file_sha256.risk.malicious_score
      description: Malicious score.
      type: String
    - contextPath: Cyberint.file_sha256.risk.occurrences_count
      description: Occurences count.
      type: String
    - contextPath: Cyberint.file_sha256.enrichment.filenames
      description: Filenames.
      type: String
    - contextPath: Cyberint.file_sha256.enrichment.first_seen
      description: First seen.
      type: String
    - contextPath: Cyberint.file_sha256.enrichment.download_urls
      description: Download URLs.
      type: String
    - contextPath: Cyberint.file_sha256.benign
      description: Benign.
      type: String
    description: Gets File SHA256 enrichment from the feed.
  - name: cyberint-get-domain
    arguments:
    - name: value
      description: Domain string.
    outputs:
    - contextPath: Cyberint.domain.entity.type
      description: The indicator type.
      type: String
    - contextPath: Cyberint.domain.entity.value
      description: The indicator value.
      type: String
    - contextPath: Cyberint.domain.risk.malicious_score
      description: Malicious score.
      type: String
    - contextPath: Cyberint.domain.risk.occurrences_count
      description: Occurences count.
      type: String
    - contextPath: Cyberint.domain.enrichment.ips
      description: IPs.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.created_date
      description: Created date.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.updated_date
      description: Updated date.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.expiration_date
      description: Expiration date.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrant_name
      description: Registrant name.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrant_email
      description: Registrant email.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrant_organization
      description: Registrant organization.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrant_country
      description: Registrant country.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrant_telephone
      description: Registrant telephone.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.technical_contact_email
      description: Technical contact email.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.technical_contact_name
      description: Technical contact name.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.technical_contact_organization
      description: Technical contact organization.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.registrar_name
      description: Registrar name.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.admin_contact_name
      description: Admin contact name.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.admin_contact_organization
      description: Admin contact organization.
      type: String
    - contextPath: Cyberint.domain.enrichment.whois.admin_contact_email
      description: Admin contact email.
      type: String
    - contextPath: Cyberint.domain.benign
      description: Benign.
      type: String
    description: Gets Domain enrichment from the feed.
  - name: cyberint-get-ipv4
    arguments:
    - name: value
      description: IPv4 string.
    outputs:
    - contextPath: Cyberint.ipv4.entity.type
      description: The indicator type.
      type: String
    - contextPath: Cyberint.ipv4.entity.value
      description: The indicator value.
      type: String
    - contextPath: Cyberint.ipv4.risk.malicious_score
      description: Malicious score.
      type: String
    - contextPath: Cyberint.ipv4.risk.occurrences_count
      description: Occurences count.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.geo.country
      description: Country.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.geo.city
      description: City.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.asn.number
      description: ASN number.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.asn.organization
      description: ASN organization.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.suspicious_urls
      description: Suspicious URLs.
      type: String
    - contextPath: Cyberint.ipv4.enrichment.suspicious_domains
      description: Suspicious domains.
      type: String
    - contextPath: Cyberint.ipv4.benign
      description: Benign.
      type: String
    description: Gets IPv4 enrichment from the feed.
  - name: cyberint-get-url
    arguments:
    - name: value
      description: URL string (starts with schema, e.g. https://).
    outputs:
    - contextPath: Cyberint.url.entity.type
      description: The indicator type.
      type: String
    - contextPath: Cyberint.url.entity.value
      description: The indicator value.
      type: String
    - contextPath: Cyberint.url.risk.malicious_score
      description: Malicious score.
      type: String
    - contextPath: Cyberint.url.risk.occurrences_count
      description: Occurences count.
      type: String
    - contextPath: Cyberint.url.enrichment.ips
      description: IPs.
      type: String
    - contextPath: Cyberint.url.enrichment.hostname
      description: Hostname.
      type: String
    - contextPath: Cyberint.url.enrichment.domain
      description: Domain.
      type: String
    - contextPath: Cyberint.url.benign
      description: Benign.
      type: String
    description: Gets URL enrichment from the feed.
  - name: cyberint-cve-enrich
    arguments:
    - name: cve_id
      description: CVE identifier to enrich (e.g., CVE-2024-1234). Supports a comma-separated list of identifiers.
      required: true
      isArray: true
    outputs:
    - contextPath: Cyberint.CVE.cve_id
      description: The CVE identifier.
      type: String
    - contextPath: Cyberint.CVE.cyberint_score
      description: Cyberint proprietary risk score for the CVE.
      type: Number
    - contextPath: Cyberint.CVE.epss
      description: EPSS (Exploit Prediction Scoring System) probability score.
      type: Number
    - contextPath: Cyberint.CVE.description
      description: The CVE description.
      type: String
    - contextPath: Cyberint.CVE.published
      description: The date the CVE was published.
      type: Date
    - contextPath: Cyberint.CVE.last_updated
      description: The date the CVE was last updated.
      type: Date
    - contextPath: Cyberint.CVE.cvss.cvss_v3.base_score
      description: CVSS v3 base score.
      type: Number
    - contextPath: Cyberint.CVE.cvss.cvss_v3.base_severity
      description: CVSS v3 base severity.
      type: String
    - contextPath: Cyberint.CVE.cvss.cvss_v4.base_score
      description: CVSS v4 base score.
      type: Number
    - contextPath: Cyberint.CVE.cwes.cwe_id
      description: Associated CWE identifier.
      type: String
    - contextPath: Cyberint.CVE.cwes.name
      description: Associated CWE name.
      type: String
    - contextPath: Cyberint.CVE.risk_factors
      description: Risk factors associated with the CVE.
      type: Unknown
    - contextPath: Cyberint.CVE.exploited_by
      description: Threat actors observed exploiting the CVE.
      type: Unknown
    - contextPath: Cyberint.CVE.products
      description: Products affected by the CVE.
      type: Unknown
    - contextPath: Cyberint.CVE.recommendation
      description: Cyberint remediation recommendation for the CVE.
      type: String
    - contextPath: Cyberint.CVE.references
      description: External references for the CVE.
      type: Unknown
    - contextPath: CVE.ID
      description: The CVE identifier.
      type: String
    - contextPath: CVE.CVSS
      description: The CVSS score of the CVE.
      type: String
    - contextPath: CVE.Published
      description: The date the CVE was published.
      type: Date
    - contextPath: CVE.Description
      description: The CVE description.
      type: String
    description: Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence.
  - name: cyberint-credential-leak-lookup
    arguments:
    - name: domain
      description: The company domain to search leaked credentials for (e.g., example.com).
      required: true
    - name: last_seen_from
      description: Only return credentials last seen on or after this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ).
    - name: last_seen_to
      description: Only return credentials last seen on or before this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ).
    - name: limit
      description: Maximum number of leaked credential records to return per credential type (employee/customer).
    outputs:
    - contextPath: Cyberint.LeakedCredential.domain
      description: The company domain that was searched.
      type: String
    - contextPath: Cyberint.LeakedCredential.total
      description: Total number of leaked credential records returned.
      type: Number
    - contextPath: Cyberint.LeakedCredential.employee_total
      description: Number of leaked employee credential records returned.
      type: Number
    - contextPath: Cyberint.LeakedCredential.customer_total
      description: Number of leaked customer credential records returned.
      type: Number
    - contextPath: Cyberint.LeakedCredential.employee_credentials.username
      description: The leaked employee account username.
      type: String
    - contextPath: Cyberint.LeakedCredential.employee_credentials.first_seen
      description: The date the employee credential was first observed.
      type: Date
    - contextPath: Cyberint.LeakedCredential.employee_credentials.last_seen
      description: The date the employee credential was last observed.
      type: Date
    - contextPath: Cyberint.LeakedCredential.employee_credentials.entries
      description: The leaked credential entries (password, source, URL) for the employee account.
      type: Unknown
    - contextPath: Cyberint.LeakedCredential.customer_credentials.username
      description: The leaked customer account username.
      type: String
    - contextPath: Cyberint.LeakedCredential.customer_credentials.first_seen
      description: The date the customer credential was first observed.
      type: Date
    - contextPath: Cyberint.LeakedCredential.customer_credentials.last_seen
      description: The date the customer credential was last observed.
      type: Date
    - contextPath: Cyberint.LeakedCredential.customer_credentials.entries
      description: The leaked credential entries (password, source, URL) for the customer account.
      type: Unknown
    description: Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API.
    compliantpolicies:
    - User Soft Remediation
  dockerimage: demisto/python3:3.12.13.10404775
  feed: true
  subtype: python3
tests:
- No tests