Cyberint Feed

Use the Cyberint Feed integration to get indicators from the feed.

Data Enrichment & Threat Intelligence · Cyberint · Feed

Details

IDCyberint Feed
ProviderCheck Point Software Technologies
CategoryData Enrichment & Threat Intelligence
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10404775
Supported ModulesAgentix XSIAM

README

Use the Cyberint Feed integration to get indicators from the feed.

Configure Cyberint Feed on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Cyberint Feed.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Cyberint API URL Example: https://yourcompany.cyberint.io True
    API access token   True
    Fetch indicators Should be checked (true) False
    Indicator Type Which indicator types to fetch True
    Confidence Confidence about the indicator details. The value of confidence to fetch indicators from. The value between 0-100. False
    Severity Severity about the indicator details. The value of severity to fetch indicators from. The value between 0-100. False
    Tags Supports CSV values. False
    Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberint-get-indicators

Gets indicators from the feed.

Base Command

cyberint-get-indicators

Input

Argument Name Description Required
limit The maximum number of results to return. The default value is 10. Default is 10. Optional

Context Output

Path Type Description
Cyberint.indicator.ioc_value String The indicator value.
Cyberint.indicator.ioc_type String The indicator type.
Cyberint.indicator.description String The feed description.
Cyberint.indicator.detected_activity String The feed detected activity.
Cyberint.indicator.observation_date String The feed observation date.
Cyberint.indicator.severity_score String The feed severity score.
Cyberint.indicator.confidence String The feed confidence.

Command example

!cyberint-get-indicators limit=10 execution-timeout=700

Context Example

{
    "Cyberint": [
        {
            "fields": {
                "Description": "Recognized as Malicious.",
                "FirstSeenBySource": "2024-01-23T22:53:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as Malicious.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc1",
                "observation_date": "2024-01-23T22:53:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc1"
        },
        {
            "fields": {
                "Description": "Recognized as zzz.",
                "FirstSeenBySource": "2024-01-23T22:55:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as zzz.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc2",
                "observation_date": "2024-01-23T22:55:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc2"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:53:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc3",
                "observation_date": "2024-01-23T22:53:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc3"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:31+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc4",
                "observation_date": "2024-01-23T22:55:31+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc4"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc5",
                "observation_date": "2024-01-23T22:55:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc5"
        },
        {
            "fields": {
                "Description": "Recognized as Trojan.xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:39+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as Trojan.xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc6",
                "observation_date": "2024-01-23T22:55:39+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc6"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-12T01:39:06+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc7",
                "observation_date": "2024-01-12T01:39:06+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc7"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:36+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc8",
                "observation_date": "2024-01-23T22:55:36+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc8"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2023-12-16T21:28:01+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 70,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc9",
                "observation_date": "2023-12-16T21:28:01+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc9"
        },
        {
            "fields": {
                "Description": "Recognized as xxx.",
                "FirstSeenBySource": "2024-01-23T22:55:35+00:00",
                "reportedby": "Cyberint",
                "trafficlightprotocol": "GREEN"
            },
            "rawJSON": {
                "confidence": 80,
                "description": "Recognized as xxx.",
                "detected_activity": "malware_payload",
                "ioc_type": "file/sha256",
                "ioc_value": "ioc10",
                "observation_date": "2024-01-23T22:55:35+00:00",
                "severity_score": 100
            },
            "service": "Cyberint",
            "type": "File",
            "value": "ioc10"
        }
    ]
}

Human Readable Output

Indicators from Cyberint Feed
Name Type Description
Detected activity String Type of detected activity.
IoC type String The indicator type.
IoC value String The indicator value.
Observation date String Observation date of detected activity.
Severity score Number Severity score of detected activity.
Confidence Number Confidence of detected activity.
Description String Description of detected activity.

cyberint-get-file-sha256

Gets File SHA256 from the feed.

Base Command

cyberint-get-file-sha256

Input

Argument Name Description Required
value File SHA256 hash Required

Context Output

Path Type Description
Cyberint.file_sha256.entity.type String The indicator type.
Cyberint.file_sha256.entity.value String The indicator value.
Cyberint.file_sha256.enrichment.first_seen String First seen.
Cyberint.file_sha256.enrichment.download_urls String Download URLs.
Cyberint.file_sha256.enrichment.filenames String Filenames.
Cyberint.file_sha256.benign String Benign.
Cyberint.file_sha256.risk.malicious_score String Malicious score.
Cyberint.file_sha256.risk.occurrences_count String Occurrences count.

Command example

!cyberint-get-file-sha256 value=6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789

Context Example

{
    "data": {
        "entity": {
            "type": "file/sha256",
            "value": "6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789"
        },
        "risk": {
            "malicious_score": 100,
            "detected_activities": [
                {
                    "type": "malware",
                    "observation_date": "2025-03-05T14:47:43.994848+00:00",
                    "description": "",
                    "confidence": 100,
                    "occurrences_count": 1
                },
                {
                    "type": "malware_payload",
                    "observation_date": "2025-02-12T21:08:13+00:00",
                    "description": "Detected in 1 source(s). Recognized as Trojan.Agent.CYZT.",
                    "confidence": 80,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 2
        },
        "enrichment": {
            "related_entities": null,
            "filenames": [
                "rifaien2-TwxvxoHtj44icOI0.exe"
            ],
            "first_seen": "2025-02-12T21:08:13+00:00",
            "download_urls": []
        },
        "benign": false
    }
}

Human Readable Output

File SHA256 Entity
Name Type Description
Type String The indicator type.
Value String The indicator value.
Malicious score Number Malicious score.
Benign Boolean Benign.
File SHA256 Enrichment
Name Type Description
Filenames String List of filenames.
First seen String First seen.
Download URLs String List of download URLs.
File SHA256 Detected activities
Name Type Description
Type String Type of detected activity.
Observation date String Observation date of detected activity.
Description String Description of detected activity.
Confidence Number Confidence of detected activity.
Occurrences count Number Occurrences count of detected activity.

cyberint-get-domain

Gets Domain from the feed.

Base Command

cyberint-get-domain

Input

Argument Name Description Required
value Domain Required

Context Output

Path Type Description
Cyberint.domain.entity.type String The indicator type.
Cyberint.domain.entity.value String The indicator value.
Cyberint.domain.risk.malicious_score String Malicious score.
Cyberint.domain.risk.occurrences_count String Occurrences count.
Cyberint.domain.enrichment.ips String IPs.
Cyberint.domain.enrichment.whois.created_date String Created date.
Cyberint.domain.enrichment.whois.updated_date String Updated date.
Cyberint.domain.enrichment.whois.expiration_date String Expiration date.
Cyberint.domain.enrichment.whois.registrant_name String Registrant name.
Cyberint.domain.enrichment.whois.registrant_email String Registrant email.
Cyberint.domain.enrichment.whois.registrant_organization String Registrant organization.
Cyberint.domain.enrichment.whois.registrant_country String Registrant country.
Cyberint.domain.enrichment.whois.registrant_telephone String Registrant telephone.
Cyberint.domain.enrichment.whois.technical_contact_email String Technical contact email.
Cyberint.domain.enrichment.whois.technical_contact_name String Technical contact name.
Cyberint.domain.enrichment.whois.technical_contact_organization String Technical contact organization.
Cyberint.domain.enrichment.whois.registrar_name String Registrar name.
Cyberint.domain.enrichment.whois.admin_contact_name String Admin contact name.
Cyberint.domain.enrichment.whois.admin_contact_organization String Admin contact organization.
Cyberint.domain.enrichment.whois.admin_contact_email String Admin contact email.
Cyberint.domain.benign String Benign.

Command example

!cyberint-get-domain value=dummy.com

Context Example

{
    "data": {
        "entity": {
            "type": "domain",
            "value": "domain.com"
        },
        "risk": {
            "malicious_score": 80,
            "detected_activities": [
                {
                    "type": "infecting_url",
                    "observation_date": "2025-03-05T14:47:23.534044+00:00",
                    "description": "URL that may infect it’s visitors with malware.",
                    "confidence": 100,
                    "occurrences_count": 1
                },
                {
                    "type": "phishing_website",
                    "observation_date": "2024-09-16T06:26:16+00:00",
                    "description": "Detected phishing website targeting Dummy.",
                    "confidence": 20,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 2
        },
        "enrichment": {
            "related_entities": null,
            "ips": [
                "11.197.130.221"
            ],
            "whois": {
                "registrant_name": null,
                "registrant_email": null,
                "registrant_organization": null,
                "registrant_country": "USA",
                "registrant_telephone": null,
                "technical_contact_email": null,
                "technical_contact_name": null,
                "technical_contact_organization": null,
                "registrar_name": "Registrar.com",
                "admin_contact_name": null,
                "admin_contact_organization": null,
                "admin_contact_email": null,
                "created_date": "2024-09-10T09:29:58",
                "updated_date": "2024-10-18T05:44:51",
                "expiration_date": "2025-09-10T23:59:59"
            }
        },
        "benign": false
    }
}

Human Readable Output

Domain Entity
Name Type Description
Type String The indicator type.
Value String The indicator value.
Malicious score Number Malicious score.
Occurrences count Number Occurrences count.
Benign Boolean Benign.
Domain Enrichment
Name Type Description
IPs String List of IP addresses.
Whois registrant name String Whois registrant name.
Whois registrant email String Whois registrant email.
Whois registrant organization String Whois registrant organization.
Whois registrant country String Whois registrant country.
Whois registrant telephone String Whois registrant telephone.
Whois technical contact email String Whois technical contact email.
Whois technical contact name String Whois technical contact name.
Whois technical contact organization String Whois technical contact organization.
Whois registrar name String Whois registrar name.
Whois admin contact name String Whois admin contact name.
Whois admin contact organization String Whois admin contact organization.
Whois admin contact email String Whois admin contact email.
Whois admin contact email String Whois admin contact email.
Created date String Created date.
Updated date String Updated date.
Expiration date String Expiration date.
Domain Detected activities
Name Type Description
Type String Type of detected activity.
Observation date String Observation date of detected activity.
Description String Description of detected activity.
Confidence Number Confidence of detected activity.
Occurrences count Number Occurrences count of detected activity.

cyberint-get-ipv4

Gets Domain from the feed.

Base Command

cyberint-get-ipv4

Input

Argument Name Description Required
value IPv4 Required

Context Output

Path Type Description
Cyberint.ipv4.entity.type String The indicator type.
Cyberint.ipv4.entity.value String The indicator value.
Cyberint.ipv4.risk.malicious_score String Malicious score.
Cyberint.ipv4.risk.occurrences_count String Occurrences count.
Cyberint.ipv4.enrichment.geo.country String Country.
Cyberint.ipv4.enrichment.geo.city String City.
Cyberint.ipv4.enrichment.asn.number String ASN number.
Cyberint.ipv4.enrichment.asn.organization String ASN organization.
Cyberint.ipv4.enrichment.suspicious_urls String Suspicious URLs.
Cyberint.ipv4.enrichment.suspicious_domains String Suspicious domains.
Cyberint.ipv4.benign String Benign.

Command example

!cyberint-get-ipv4 value=1.1.1.1

Context Example

{
    "data": {
        "entity": {
            "type": "ipv4",
            "value": "11.197.130.221"
        },
        "risk": {
            "malicious_score": 100,
            "detected_activities": [
                {
                    "type": "payload_delivery",
                    "observation_date": "2025-02-13T08:38:50+00:00",
                    "description": "Detected hosting malware.",
                    "confidence": 20,
                    "occurrences_count": 836
                },
                {
                    "type": "phishing_website",
                    "observation_date": "2025-03-05T10:17:32+00:00",
                    "description": "Detected phishing website targeting Dummy, ING Direct, genericcloudflare.",
                    "confidence": 20,
                    "occurrences_count": 143
                },
                {
                    "type": "cnc_server",
                    "observation_date": "2025-02-14T22:21:12.084000+00:00",
                    "description": "Detected in 21 source(s). Recognized as Quasar RAT. Detected activity linked to: Bumblebee (Malware), Cotton Sandstorm (Threat-Actor-Group), DadSec (Malware), GHOSTSPIDER (Malware), Quasar RAT (Malware), Salt Typhoon (Threat-Actor-Group), Sneaky 2FA (Malware), Vidar (Malware)",
                    "confidence": 90,
                    "occurrences_count": 21
                }
            ],
            "occurrences_count": 1000
        },
        "enrichment": {
            "related_entities": [
                {
                    "entity_id": "c654837d-444e-4f5c-a444-09fd8250696c",
                    "entity_type": "Malware",
                    "entity_name": "GHOSTSPIDER"
                },
                {
                    "entity_id": "70b54325-05ea-46c6-b4e9-b25bc3617104",
                    "entity_type": "Threat-Actor-Group",
                    "entity_name": "Salt Typhoon"
                },
                {
                    "entity_id": "baffd4c4-4483-4b84-96eb-0d19af94d2e8",
                    "entity_type": "Malware",
                    "entity_name": "DadSec"
                },
                {
                    "entity_id": "862341a5-1951-4e09-b3c1-baac41dc7bcb",
                    "entity_type": "Malware",
                    "entity_name": "Vidar"
                },
                {
                    "entity_id": "7b0a986f-733e-4497-8867-6aed00b802b8",
                    "entity_type": "Threat-Actor-Group",
                    "entity_name": "Cotton Sandstorm"
                },
                {
                    "entity_id": "58cbb47d-176d-4937-9ebc-5121ceb36cf9",
                    "entity_type": "Malware",
                    "entity_name": "Sneaky 2FA"
                },
                {
                    "entity_id": "2728ad3e-d870-4654-afd3-9a839f97dd72",
                    "entity_type": "Malware",
                    "entity_name": "Bumblebee"
                },
                {
                    "entity_id": "fc26b8a7-a7cc-47b8-be1e-92b7a969543b",
                    "entity_type": "Malware",
                    "entity_name": "Quasar RAT"
                }
            ],
            "geo": {
                "country": "United States",
                "city": null
            },
            "asn": {
                "number": 16509,
                "organization": "AMAZON-02"
            },
            "suspicious_urls": [],
            "suspicious_domains": []
        },
        "benign": false
    }
}

Human Readable Output

IPv4 Entity
Name Type Description
Type String The indicator type.
Value String The indicator value.
Malicious score Number Malicious score.
Occurrences count Number Occurrences count.
IPs String List of IP addresses.
Hostname String Hostname.
Domain String Domain.
Benign Boolean Benign.
IPv4 Enrichment
Name Type Description
Suspicious Urls String List of Suspicious Urls.
Suspicious Domains String List of Suspicious domains.
IPv4 Detected activities
Name Type Description
Type String Type of detected activity.
Observation date String Observation date of detected activity.
Description String Description of detected activity.
Confidence Number Confidence of detected activity.
Occurrences count Number Occurrences count of detected activity.

cyberint-get-url

Gets Domain from the feed.

Base Command

cyberint-get-url

Input

Argument Name Description Required
value URL Required

Context Output

Path Type Description
Cyberint.url.entity.type String The indicator type.
Cyberint.url.entity.value String The indicator value.
Cyberint.url.risk.malicious_score String Malicious score.
Cyberint.url.risk.occurrences_count String Occurrences count.
Cyberint.url.enrichment.ips String IPs.
Cyberint.url.enrichment.hostname String Hostname.
Cyberint.url.enrichment.domain String Domain.
Cyberint.url.benign String Benign.

Command example

!cyberint-get-url value=http://dummy.com

Context Example

{
    "data": {
        "entity": {
            "type": "url",
            "value": "http://dummy.com"
        },
        "risk": {
            "malicious_score": 80,
            "detected_activities": [
                {
                    "type": "infecting_url",
                    "observation_date": "2025-03-05T11:18:01.941280+00:00",
                    "description": "URL that may infect it’s visitors with malware.",
                    "confidence": 100,
                    "occurrences_count": 1
                }
            ],
            "occurrences_count": 1
        },
        "enrichment": {
            "related_entities": null,
            "ips": [],
            "hostname": null,
            "domain": null
        },
        "benign": false
    }
}

Human Readable Output

URL Entity
Name Type Description
Type String The indicator type.
Value String The indicator value.
Malicious score Number Malicious score.
Occurrences count Number Occurrences count.
IPs String List of IP addresses.
Hostname String Hostname.
Domain String Domain.
Benign Boolean Benign.
URL Detected activities
Name Type Description
Type String Type of detected activity.
Observation date String Observation date of detected activity.
Description String Description of detected activity.
Confidence Number Confidence of detected activity.
Occurrences count Number Occurrences count of detected activity.

cyberint-cve-enrich

Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence.

Base Command

cyberint-cve-enrich

Input

Argument Name Description Required
cve_id CVE identifier to enrich (e.g., CVE-2024-1234). Supports a comma-separated list of identifiers. Required

Context Output

Path Type Description
Cyberint.CVE.cve_id String The CVE identifier.
Cyberint.CVE.cyberint_score Number Cyberint proprietary risk score for the CVE.
Cyberint.CVE.epss Number EPSS (Exploit Prediction Scoring System) probability score.
Cyberint.CVE.description String The CVE description.
Cyberint.CVE.published Date The date the CVE was published.
Cyberint.CVE.last_updated Date The date the CVE was last updated.
Cyberint.CVE.cvss.cvss_v3.base_score Number CVSS v3 base score.
Cyberint.CVE.cvss.cvss_v3.base_severity String CVSS v3 base severity.
Cyberint.CVE.cvss.cvss_v4.base_score Number CVSS v4 base score.
Cyberint.CVE.cwes.cwe_id String Associated CWE identifier.
Cyberint.CVE.cwes.name String Associated CWE name.
Cyberint.CVE.risk_factors Unknown Risk factors associated with the CVE.
Cyberint.CVE.exploited_by Unknown Threat actors observed exploiting the CVE.
Cyberint.CVE.products Unknown Products affected by the CVE.
Cyberint.CVE.recommendation String Cyberint remediation recommendation for the CVE.
Cyberint.CVE.references Unknown External references for the CVE.
CVE.ID String The CVE identifier.
CVE.CVSS String The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Description String The CVE description.

Command Example

!cyberint-cve-enrich cve_id="CVE-2024-1234"

cyberint-credential-leak-lookup

Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API.

Base Command

cyberint-credential-leak-lookup

Input

Argument Name Description Required
domain The company domain to search leaked credentials for (e.g., example.com). Required
last_seen_from Only return credentials last seen on or after this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ). Optional
last_seen_to Only return credentials last seen on or before this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ). Optional
limit Maximum number of leaked credential records to return per credential type (employee/customer). Optional

Context Output

Path Type Description
Cyberint.LeakedCredential.domain String The company domain that was searched.
Cyberint.LeakedCredential.total Number Total number of leaked credential records returned.
Cyberint.LeakedCredential.employee_total Number Number of leaked employee credential records returned.
Cyberint.LeakedCredential.customer_total Number Number of leaked customer credential records returned.
Cyberint.LeakedCredential.employee_credentials.username String The leaked employee account username.
Cyberint.LeakedCredential.employee_credentials.first_seen Date The date the employee credential was first observed.
Cyberint.LeakedCredential.employee_credentials.last_seen Date The date the employee credential was last observed.
Cyberint.LeakedCredential.employee_credentials.entries Unknown The leaked credential entries (password, source, URL) for the employee account.
Cyberint.LeakedCredential.customer_credentials.username String The leaked customer account username.
Cyberint.LeakedCredential.customer_credentials.first_seen Date The date the customer credential was first observed.
Cyberint.LeakedCredential.customer_credentials.last_seen Date The date the customer credential was last observed.
Cyberint.LeakedCredential.customer_credentials.entries Unknown The leaked credential entries (password, source, URL) for the customer account.

Command Example

!cyberint-credential-leak-lookup domain="example.com"

Configuration parameters

  • url — Cyberint API URL (required)
  • client_name — Company Name (required)
  • access_token — API Key (Leave empty. Fill in the API Key in the password field.) (required)
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • indicator_type — Indicator Type (required)
  • feed_name — Feed Name (required)
  • confidence_from — Confidence
  • severity_from — Severity
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedTags — Tags
  • feedBypassExclusionList — Bypass exclusion list
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (7)

  • cyberint-credential-leak-lookup

    Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API.

  • cyberint-cve-enrich

    Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence.

  • cyberint-get-domain

    Gets Domain enrichment from the feed.

  • cyberint-get-file-sha256

    Gets File SHA256 enrichment from the feed.

  • cyberint-get-indicators

    Gets indicators from the feed.

  • cyberint-get-ipv4

    Gets IPv4 enrichment from the feed.

  • cyberint-get-url

    Gets URL enrichment from the feed.

Source

FeedCyberint.py FeedCyberint_test.py FeedCyberint.yml FeedCyberint_description.md command_examples.txt
Download History Raw 
!cyberint-get-indicators date=2024-12-31 limit=10 offset=0