Cyjax Feed

category: Data Enrichment & Threat Intelligence
provider: CYJAX
display: Cyjax Feed
name: Cyjax Feed
description: 'The feed allows customers to pull indicators of compromise from cyber incidents (IP addresses, URLs, domains, CVE and file hashes).'
commonfields:
  id: Cyjax Feed
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.cymon.co/v2
  additionalinfo: Url to CYJAX API.
  display: Cyjax API URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  additionalinfo: CYJAX API key obtained from CYJAX portal.
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: 'false'
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch indicators
  defaultvalue: 'true'
  name: feed
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: Suspicious
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- display: Source Reliability
  additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: A - Completely reliable
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- name: tlp_color
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- name: use_cyjax_tlp
  display: Use Cyjax feed TLP
  additionalinfo: Whether to use TLP set by CYJAX. Will override TLP set above.
  defaultvalue: 'true'
  type: 8
  required: false
  section: Collect
- name: feedTags
  display: Tags
  additionalinfo: Supports CSV values.
  type: 0
  required: false
  section: Collect
- display: ""
  name: feedExpirationPolicy
  defaultvalue: never
  type: 17
  options:
  - never
  - interval
  - indicatorType
  required: false
  section: Collect
- name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  display: ""
  required: false
  section: Collect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  display: Incremental Feed
  name: feedIncremental
  defaultvalue: 'true'
  type: 8
  hidden: true
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  additionalinfo: |-
    When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
  section: Collect
- name: feedFetchInterval
  defaultvalue: '60'
  display: Feed Fetch Interval
  type: 19
  required: false
  section: Collect
- defaultvalue: 3 days
  display: First fetch time
  additionalinfo: The time interval for the first fetch (retroactive). For example 3 days, 1 hour
  name: first_fetch
  required: true
  type: 0
  section: Collect
script:
  commands:
  - arguments:
    - name: since
      description: The start date time in ISO 8601 format.
    - name: until
      description: The end date time in ISO 8601 format.
    - name: type
      description: 'The indicator type. If not specified all indicators are returned. Allowed values are IPv4, IPv6, Domain, Hostname, Email, FileHash-SHA1, FileHash-SHA256, FileHash-MD5, FileHash-SSDEEP.'
    - name: source_type
      description: The indicators source type. Allowed values are incident-report, my-report.
    - name: source_id
      description: The indicators source ID.
    - name: limit
      description: The maximum number of indicators to get. The default value is 50.
      defaultValue: '50'
    name: cyjax-get-indicators
    description: Get indicators.
  - arguments:
    - description: Indicator value.
      name: value
      required: true
    name: cyjax-indicator-sighting
    description: Get sighting of a indicator.
  - name: cyjax-unset-indicators-last-fetch-date
    description: 'Unset the indicators feed last fetch date. Should only be used if user needs to use `re-fetch` button and wants to fetch old indicators from CYJAX. Next feed will use date set in first_fetch (default is last 3 days).'
  feed: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/cyjax:1.0.0.10133006
fromversion: 5.5.0
tests:
- No tests (auto formatted)