FeedExpanse Deprecated

Deprecated. Use Xpanse Feed integration instead. > Use this feed to retrieve the discovered IPs/Domains/Certificates from Expanse Expander asset database.

Data Enrichment & Threat Intelligence · Cortex Xpanse by Palo Alto Networks (Deprecated) · Feed

Details

ID	`FeedExpanse`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.10.13.72123`

README

Use this feed to retrieve the discovered IPs/Domains/Certificates from Expanse Expander asset database.

This integration was developed and tested with version 2 of Expander Asset API.

Expanse is a Palo Alto Networks company.

Supported Cortex XSOAR versions: 6.0.0 and later.

Configure Expanse Expander Feed in Cortex

Parameter	Description	Required
url	Your server URL	True
apikey	API Key	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
feed	Fetch indicators	False
max_fetch	The maximum number of indicators to fetch.	False
min_last_observed	Retrieve indicators observed in the last specified number of days	False
feedExpirationPolicy		False
feedExpirationInterval		False
feedFetchInterval	Feed Fetch Interval	False
feedBypassExclusionList	Bypass exclusion list	False
feedReliability	Source Reliability	True
feedReputation	Indicator Reputation	False
feedTags	Tags	False
tlp_color	Traffic Light Protocol Color	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

feedexpanse-get-indicators

Retrieve discovered IPs/IP Ranges/Domains/Certificates

Base Command

feedexpanse-get-indicators

Input

Argument Name	Description	Required
max_indicators	The maximum number of results to return per type	Optional
ip	Retrieve discovered IPs	Optional
domain	Retrieve discovered Domains	Optional
certificate	Retrieve discovered certificates	Optional
iprange	Retrieve IP Ranges	Optional

Context Output

There is no context output for this command.

Command Example

!feedexpanse-get-indicators max_indicators=1 certificate=yes ip=yes domain=yes

Human Readable Output

Expanse Indicators (capped at 1)

value type

198.51.100.220 IP

e0ce1c7a7e02d3a9f361a760e9f2ab22fe3d7e9a9ee9188386b1abff44be6b5f Certificate

test.example.com Domain

198.51.100..0/24 CIDR

value	type
198.51.100.220	IP
e0ce1c7a7e02d3a9f361a760e9f2ab22fe3d7e9a9ee9188386b1abff44be6b5f	Certificate
test.example.com	Domain
198.51.100..0/24	CIDR

Configuration parameters

url — Your server URL (required)
credentials —
apikey — API Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
max_fetch — The maximum number of indicators to fetch.
min_last_observed — Retrieve indicators observed in the last specified number of days
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedReliability — Source Reliability (required)
feedReputation — Indicator Reputation
feedTags — Tags
tlp_color — Traffic Light Protocol Color

Commands (1)

feedexpanse-get-indicators
Retrieve discovered IPs/IP Ranges/Domains/Certificates

Source

FeedExpanse.py FeedExpanse_test.py FeedExpanse.yml FeedExpanse_description.md command_examples.txt

Download History Raw

import io
import json


def util_load_json(path):
    with io.open(path, mode='r', encoding='utf-8') as f:
        return json.loads(f.read())


def test_indicator_generator(requests_mock):
    """
    Given:
        - an Expanse client
        - a valid API Key
    When
        - indicator generator is called
    Then
        - all 4 types of assets are retrieved from the API (IPs, Certificates, IPRanges and Domains)
        - Expanse assets are mapped into the appropriate fields
    """
    from FeedExpanse import Client, indicator_generator

    # load mock responses
    ipranges_mock_response = util_load_json('test_data/ipranges.json')
    certificates_mock_response = util_load_json('test_data/certificates.json')
    domains_mock_response = util_load_json('test_data/domains.json')
    ips0_mock_response = util_load_json('test_data/ips-page0.json')
    ips1_mock_response = util_load_json('test_data/ips-page1.json')

    # hook the mock responses in requests_mock
    requests_mock.get(
        'https://example.com/api/v2/ip-range',
        json=ipranges_mock_response
    )
    requests_mock.get(
        'https://example.com/api/v2/assets/certificates',
        json=certificates_mock_response
    )
    requests_mock.get(
        'https://example.com/api/v2/assets/domains',
        json=domains_mock_response
    )
    requests_mock.get(
        'https://example.com/api/v2/assets/ips',
        json=ips0_mock_response
    )
    requests_mock.get(
        ips0_mock_response['pagination']['next'],
        json=ips1_mock_response
    )

    client = Client(
        base_url='https://example.com/api',
        verify=True,
        api_key="FakeAPIKey",
        proxy=False
    )

    result = list(indicator_generator(
        client,
        max_indicators=2,
        tlp_color='Red',
        feed_tags='tag1'
    ))

    expected_result = util_load_json('./test_data/test_indicators_generator_result.json')

    assert result == expected_result