Cyberint Premium Feed

Details

ID	`Cyberint Premium Feed`
Provider	Check Point Software Technologies
Category	Data Enrichment & Threat Intelligence
From Version	6.9.0
Docker Image	`demisto/fastapi:0.125.0.10158186`
Supported Modules	Agentix XSIAM

README

Use the Check Point EM ThreatCloud Intelligence Feed integration to ingest high-fidelity Indicators-of-Compromise from the Cyberint Infinity External Risk Management IOC APIs into your Cortex Threat Intelligence Module (Cortex XSOAR or Cortex XSIAM), and to enrich a single IOC on demand from the war room or a playbook task.

Configure Check Point EM ThreatCloud Intelligence Feed in Cortex

Parameter	Description	Required
Cyberint API URL	Cyberint API URL on which the services run (i.e https://your-company.cyberint.io)	True
Company Name	Company (client) name associated with Cyberint instance.	True
API access token		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Indicator Type	Which indicator types to fetch	True
Activity	Filter by activity classification	False
Confidence Min	Minimum confidence score (0-100) to fetch indicators from.	False
Confidence Max	Maximum confidence score (0-100) to fetch indicators from.	False
Severity Min	Minimum severity level (1-5) to fetch indicators from.	False
Severity Max	Maximum severity level (1-5) to fetch indicators from.	False
Malicious	Filter by malicious classification.	False
First Fetch Time	How far back to fetch indicators on the first run. Subsequent runs fetch only new indicators since the last successful fetch. Supports relative expressions like “3 days”, “7 days”, “24 hours”.	False
		False
		False
Feed Fetch Interval		False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberint-premium-get-indicators

Gets indicators from the Infinity External Risk Management feed.

Base Command

cyberint-premium-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of results to return. The default value is 50. Default is 50.	Optional
offset	Specifies the starting position from which data retrieval should begin. Default is 0.	Optional
indicator_type	Filter by indicator type. Supports comma-separated values. Possible values are: ipv4, domain, url, sha256, sha1, md5.	Optional
activity	Filter by activity classification. Supports comma-separated values.	Optional
confidence_min	Minimum confidence score (0-100).	Optional
severity_min	Minimum severity level (1-5).	Optional
malicious	Filter by malicious classification. Possible values are: yes, no, inconclusive.	Optional
added_to_feed_after	Filter indicators added to the feed after this date-time (ISO 8601).	Optional
added_to_feed_before	Filter indicators added to the feed before this date-time (ISO 8601).	Optional
sort_field	Field to sort by. Possible values are: confidence, severity, first_seen, last_seen, added_to_feed. Default is last_seen.	Optional
sort_direction	Sort direction. Possible values are: asc, desc. Default is desc.	Optional

Context Output

Path	Type	Description
CyberintPremium.Indicator.indicator_type	String	The indicator type.
CyberintPremium.Indicator.indicator_value	String	The indicator value.
CyberintPremium.Indicator.activity	String	Activity classification.
CyberintPremium.Indicator.confidence	Number	Confidence score (0-100).
CyberintPremium.Indicator.severity	Number	Severity level (1-5).
CyberintPremium.Indicator.malicious	String	Malicious classification (yes/no/inconclusive).
CyberintPremium.Indicator.kill_chain_stage	String	Kill chain stage.
CyberintPremium.Indicator.first_seen	Date	First seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Indicator.last_seen	Date	Last seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Indicator.added_to_feed	Date	Date-time when added to the feed. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Indicator.valid_until	Date	Valid until date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Indicator.is_blocking	Boolean	Whether the indicator is blocking.
CyberintPremium.Indicator.is_unique	Boolean	Whether the indicator is unique.
CyberintPremium.Indicator.malware_types	Unknown	List of malware types.
CyberintPremium.Indicator.has_cve	Boolean	Whether the indicator has associated CVEs.
CyberintPremium.Indicator.has_campaign	Boolean	Whether the indicator has an associated campaign.

cyberint-premium-enrich

Enriches a single IOC indicator with reputation, threat intelligence, and type-specific enrichment data.

Base Command

cyberint-premium-enrich

Input

Argument Name	Description	Required
type	The IOC type. Possible values are: ipv4, domain, url, sha256, sha1, md5.	Required
value	The indicator value (e.g. IP address, domain name, URL, or file hash).	Required

Context Output

Path	Type	Description
CyberintPremium.Enrichment.indicator_type	String	The indicator type.
CyberintPremium.Enrichment.indicator_value	String	The indicator value.
CyberintPremium.Enrichment.activity	String	Activity classification.
CyberintPremium.Enrichment.confidence	Number	Confidence score (0-100).
CyberintPremium.Enrichment.severity	Number	Severity level (0-5).
CyberintPremium.Enrichment.malicious	String	Malicious classification (yes/no/inconclusive).
CyberintPremium.Enrichment.kill_chain_stage	String	Kill chain stage.
CyberintPremium.Enrichment.first_seen	Date	First seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Enrichment.last_seen	Date	Last seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Enrichment.valid_until	Date	Valid until date-time. ISO8601 format: 2020-01-01T00:11:22Z.
CyberintPremium.Enrichment.malware_types	Unknown	List of malware types.
CyberintPremium.Enrichment.malware_family	String	Malware family name.
CyberintPremium.Enrichment.origin_countries	Unknown	Origin countries.
CyberintPremium.Enrichment.targeted_countries	Unknown	Targeted countries.
CyberintPremium.Enrichment.targeted_sectors	Unknown	Targeted sectors.
CyberintPremium.Enrichment.targeted_brands	Unknown	Targeted brands.
CyberintPremium.Enrichment.threat_actors	Unknown	Associated threat actors.
CyberintPremium.Enrichment.campaigns	Unknown	Associated campaigns.
CyberintPremium.Enrichment.cves	Unknown	Associated CVEs.
CyberintPremium.Enrichment.ttps	Unknown	Associated TTPs with MITRE IDs.
CyberintPremium.Enrichment.tags	Unknown	Tags.
CyberintPremium.Enrichment.enrichment	Unknown	Type-specific enrichment data (geo, whois, file info, etc.).

Configuration parameters

url — Cyberint API URL (required)
client_name — Company Name (required)
access_token — API Key (Leave empty. Fill in the API Key in the password field.) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
indicator_type — Indicator Type (required)
activity — Activity
confidence_min — Confidence Min
confidence_max — Confidence Max
severity_min — Severity Min
severity_max — Severity Max
malicious — Malicious
first_fetch — First Fetch Time
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list

Commands (2)

cyberint-premium-enrich
Enriches a single IOC indicator with reputation, threat intelligence, and type-specific enrichment data.
cyberint-premium-get-indicators
Gets indicators from the Infinity External Risk Management feed.

Source

FeedCyberintPremium.py FeedCyberintPremium_test.py FeedCyberintPremium.yml FeedCyberintPremium_description.md command_examples.txt

Download History Raw

name: Cyberint Premium Feed
display: Check Point EM ThreatCloud Intelligence Feed
provider: Check Point Software Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: Cyberint Premium Feed
  version: -1
fromversion: 6.9.0
category: Data Enrichment & Threat Intelligence
description: Use the Check Point EM ThreatCloud Intelligence Feed integration to ingest high-fidelity IOC indicators from the Cyberint Infinity External Risk Management IOC APIs and to enrich a single indicator on demand.
configuration:
- display: Cyberint API URL
  additionalinfo: Cyberint API URL on which the services run (i.e https://your-company.cyberint.io)
  name: url
  required: true
  type: 0
  section: Connect
- display: Company Name
  additionalinfo: Company (client) name associated with Cyberint instance.
  name: client_name
  required: true
  type: 0
  section: Connect
- display: API Key (Leave empty. Fill in the API Key in the password field.)
  displaypassword: API access token
  name: access_token
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch indicators
  name: feed
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  name: feedReputation
  defaultvalue: Good
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  required: false
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: F - Reliability cannot be judged
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- additionalinfo: Which indicator types to fetch
  defaultvalue: All
  display: Indicator Type
  name: indicator_type
  options:
  - All
  - IP
  - Domain
  - URL
  - File
  required: true
  type: 16
  section: Collect
- additionalinfo: Filter by activity classification
  defaultvalue: All
  display: Activity
  name: activity
  options:
  - All
  - Unknown
  - Unclassified
  - N/A
  - Benign
  - Adware
  - Volatile Website
  - CnC Server
  - Compromised Website
  - Phishing
  - Infecting Website
  - Infecting URL
  - Web Hosting
  - File Hosting
  - Parked
  - Spam
  - Cryptominer
  - Web Service
  - Malicious
  - Riskware
  - Malware
  - Volatile
  - Compromised Server
  - Infection Source
  - Scanner
  - Anonymiser
  - Anonymizer
  - Compromised Host
  - Spyware
  - Botnet
  required: false
  type: 16
  section: Collect
- additionalinfo: Minimum confidence score (0-100) to fetch indicators from.
  display: Confidence Min
  name: confidence_min
  defaultvalue: "0"
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum confidence score (0-100) to fetch indicators from.
  display: Confidence Max
  name: confidence_max
  type: 0
  required: false
  section: Collect
- additionalinfo: Minimum severity level (1-5) to fetch indicators from.
  display: Severity Min
  name: severity_min
  defaultvalue: "1"
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum severity level (1-5) to fetch indicators from.
  display: Severity Max
  name: severity_max
  type: 0
  required: false
  section: Collect
- additionalinfo: Filter by malicious classification.
  display: Malicious
  name: malicious
  options:
  - yes
  - no
  - inconclusive
  type: 15
  required: false
  section: Collect
- additionalinfo: How far back to fetch indicators on the first run. Subsequent runs fetch only new indicators since the last successful fetch. Supports relative expressions like "3 days", "7 days", "24 hours".
  display: First Fetch Time
  name: first_fetch
  defaultvalue: "3 days"
  type: 0
  required: false
  section: Collect
- display: ""
  name: feedExpirationPolicy
  defaultvalue: suddenDeath
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  section: Collect
- display: ""
  name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: "240"
  type: 19
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: cyberint-premium-get-indicators
    arguments:
    - name: limit
      description: The maximum number of results to return. The default value is 50.
      defaultValue: "50"
    - name: offset
      description: Specifies the starting position from which data retrieval should begin.
      defaultValue: "0"
    - name: indicator_type
      description: Filter by indicator type. Supports comma-separated values.
      auto: PREDEFINED
      predefined:
      - ipv4
      - domain
      - url
      - sha256
      - sha1
      - md5
      isArray: true
    - name: activity
      description: Filter by activity classification. Supports comma-separated values.
      isArray: true
    - name: confidence_min
      description: Minimum confidence score (0-100).
    - name: severity_min
      description: Minimum severity level (1-5).
    - name: malicious
      description: Filter by malicious classification.
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      - inconclusive
    - name: added_to_feed_after
      description: Filter indicators added to the feed after this date-time (ISO 8601).
    - name: added_to_feed_before
      description: Filter indicators added to the feed before this date-time (ISO 8601).
    - name: sort_field
      description: Field to sort by.
      defaultValue: last_seen
      auto: PREDEFINED
      predefined:
      - confidence
      - severity
      - first_seen
      - last_seen
      - added_to_feed
    - name: sort_direction
      description: Sort direction.
      defaultValue: desc
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    outputs:
    - contextPath: CyberintPremium.Indicator.indicator_type
      description: The indicator type.
      type: String
    - contextPath: CyberintPremium.Indicator.indicator_value
      description: The indicator value.
      type: String
    - contextPath: CyberintPremium.Indicator.activity
      description: Activity classification.
      type: String
    - contextPath: CyberintPremium.Indicator.confidence
      description: Confidence score (0-100).
      type: Number
    - contextPath: CyberintPremium.Indicator.severity
      description: Severity level (1-5).
      type: Number
    - contextPath: CyberintPremium.Indicator.malicious
      description: Malicious classification (yes/no/inconclusive).
      type: String
    - contextPath: CyberintPremium.Indicator.kill_chain_stage
      description: Kill chain stage.
      type: String
    - contextPath: CyberintPremium.Indicator.first_seen
      description: 'First seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Indicator.last_seen
      description: 'Last seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Indicator.added_to_feed
      description: 'Date-time when added to the feed. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Indicator.valid_until
      description: 'Valid until date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Indicator.is_blocking
      description: Whether the indicator is blocking.
      type: Boolean
    - contextPath: CyberintPremium.Indicator.is_unique
      description: Whether the indicator is unique.
      type: Boolean
    - contextPath: CyberintPremium.Indicator.malware_types
      description: List of malware types.
      type: Unknown
    - contextPath: CyberintPremium.Indicator.has_cve
      description: Whether the indicator has associated CVEs.
      type: Boolean
    - contextPath: CyberintPremium.Indicator.has_campaign
      description: Whether the indicator has an associated campaign.
      type: Boolean
    description: Gets indicators from the Infinity External Risk Management feed.
  - name: cyberint-premium-enrich
    arguments:
    - name: type
      description: The IOC type.
      required: true
      auto: PREDEFINED
      predefined:
      - ipv4
      - domain
      - url
      - sha256
      - sha1
      - md5
    - name: value
      description: The indicator value (e.g. IP address, domain name, URL, or file hash).
      required: true
    outputs:
    - contextPath: CyberintPremium.Enrichment.indicator_type
      description: The indicator type.
      type: String
    - contextPath: CyberintPremium.Enrichment.indicator_value
      description: The indicator value.
      type: String
    - contextPath: CyberintPremium.Enrichment.activity
      description: Activity classification.
      type: String
    - contextPath: CyberintPremium.Enrichment.confidence
      description: Confidence score (0-100).
      type: Number
    - contextPath: CyberintPremium.Enrichment.severity
      description: Severity level (0-5).
      type: Number
    - contextPath: CyberintPremium.Enrichment.malicious
      description: Malicious classification (yes/no/inconclusive).
      type: String
    - contextPath: CyberintPremium.Enrichment.kill_chain_stage
      description: Kill chain stage.
      type: String
    - contextPath: CyberintPremium.Enrichment.first_seen
      description: 'First seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Enrichment.last_seen
      description: 'Last seen date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Enrichment.valid_until
      description: 'Valid until date-time. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: CyberintPremium.Enrichment.malware_types
      description: List of malware types.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.malware_family
      description: Malware family name.
      type: String
    - contextPath: CyberintPremium.Enrichment.origin_countries
      description: Origin countries.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.targeted_countries
      description: Targeted countries.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.targeted_sectors
      description: Targeted sectors.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.targeted_brands
      description: Targeted brands.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.threat_actors
      description: Associated threat actors.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.campaigns
      description: Associated campaigns.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.cves
      description: Associated CVEs.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.ttps
      description: Associated TTPs with MITRE IDs.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.tags
      description: Tags.
      type: Unknown
    - contextPath: CyberintPremium.Enrichment.enrichment
      description: Type-specific enrichment data (geo, whois, file info, etc.).
      type: Unknown
    description: Enriches a single IOC indicator with reputation, threat intelligence, and type-specific enrichment data.
  dockerimage: demisto/fastapi:0.125.0.10158186
  feed: true
  subtype: python3
tests:
- No tests