Feedly Feed
Ingest articles with indicators, entities and relationships from Feedly into XSOAR.
Data Enrichment & Threat Intelligence · Feedly · Feed
Details
| ID | Feedly Feed |
|---|---|
| Provider | Feedly Inc |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.1.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Supported Modules | Agentix XSIAM |
README
Ingest articles with indicators, entities and relationships from Feedly into XSOAR
Configure Feedly in Cortex
| Parameter | Description | Required |
|---|---|---|
| Fetch indicators | False | |
| API key | False | |
| Indicator Reputation | Indicators from this integration instance will be marked with this reputation | False |
| Source Reliability | Reliability of the source providing the intelligence data | True |
| Traffic Light Protocol Color | The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed | False |
| Feed Fetch Interval | False | |
| Bypass exclusion list | When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. | False |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| False | ||
| False | ||
| Stream ID | The stream id you want to fetch articles from. You can find it in Feedly by going to the stream, clicking on `…` > `Sharing`, then `Copy ID` in the `Feedly API Stream ID` section. | True |
| Days to fetch for first run | Number of days to fetch articles from when running the integration for the first time | True |
| Incremental feed | Incremental feeds pull only new or modified indicators that have been sent from the integration. The determination if the indicator is new or modified happens on the 3rd-party vendor’s side, so only indicators that are new or modified are sent to Cortex XSOAR. Therefore, all indicators coming from these feeds are labeled new or modified. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
feedly-get-indicators
Gets indicators from the feed.
Base Command
feedly-get-indicators
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The maximum number of results to return. Default is 10. | Optional |
Context Output
There is no context output for this command.
Command example
!feedly-get-indicators limit=100
Human Readable Output
Indicators from Feedly Feed
Value A new sophisticated SkidMap variant targets unsecured Redis servers DarkWatchman RAT detection with Wazuh Microsoft Fixes 87 Flaws and 2 Actively Exploited 0Day Bugs Colorado Department of Higher Education Experiences Ransomware Atta… Skidmap DarkWatchman WScript.exe ROMCOM RAT SkidMap pupy pupy pupy reptile Melofee BPFDoor Syslogk Match Legitimate Name or Location Masquerade File Type Command and Scripting Interpreter Ingress Tool Transfer SSH SSH Authorized Keys Resource Hijacking Rootkit Windows Command Shell Modify Registry Fileless Storage Disable or Modify Tools Keylogging DLL Side-Loading Clipboard Data Command and Scripting Interpreter JavaScript Visual Basic Regsvr32 Hidden Window PowerShell Exploitation for Client Execution Mark-of-the-Web Bypass Endpoint Denial of Service Resource Hijacking Ingress Tool Transfer Match Legitimate Name or Location Masquerade File Type Command and Scripting Interpreter Malware Rootkit Port Knocking Fallback Channels SSH Authorized Keys RomCom Earth Berberoka Red Menshen
Configuration parameters
feed— Fetch indicatorscredentials— (required)feedReputation— Indicator ReputationfeedReliability— Source Reliability (required)tlp_color— Traffic Light Protocol ColorfeedFetchInterval— Feed Fetch IntervalfeedBypassExclusionList— Bypass exclusion listfeedExpirationPolicy—feedExpirationInterval—feedly_stream_id— Stream ID (required)days_to_backfill— Days to fetch for first run (required)feedIncremental— Incremental feedfeedTags— Tagsinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
feedly-get-indicatorsGets indicators from the feed.
category: Data Enrichment & Threat Intelligence provider: Feedly Inc commonfields: id: Feedly Feed version: -1 sectionorder: - Connect - Collect configuration: - defaultvalue: 'true' display: Fetch indicators name: feed required: false type: 8 section: Collect - displaypassword: API key name: credentials type: 9 required: true hiddenusername: true section: Connect - additionalinfo: Indicators from this integration instance will be marked with this reputation defaultvalue: Bad display: Indicator Reputation name: feedReputation options: - None - Good - Suspicious - Bad required: false type: 18 section: Collect - additionalinfo: Reliability of the source providing the intelligence data defaultvalue: F - Reliability cannot be judged display: Source Reliability name: feedReliability options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed display: Traffic Light Protocol Color name: tlp_color options: - RED - AMBER - GREEN - WHITE required: false type: 15 section: Collect - defaultvalue: '30' display: Feed Fetch Interval name: feedFetchInterval required: false type: 19 section: Collect - additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. defaultvalue: 'true' display: Bypass exclusion list name: feedBypassExclusionList required: false type: 8 section: Collect - display: '' name: feedExpirationPolicy type: 17 required: false options: - never - interval - indicatorType section: Collect - display: '' name: feedExpirationInterval type: 1 required: false section: Collect - display: Stream ID name: feedly_stream_id required: true type: 0 additionalinfo: The stream id you want to fetch articles from. You can find it in Feedly by going to the stream, clicking on `...` > `Sharing`, then `Copy ID` in the `Feedly API Stream ID` section. section: Connect - display: Days to fetch for first run name: days_to_backfill required: true type: 0 defaultvalue: '7' additionalinfo: Number of days to fetch articles from when running the integration for the first time section: Collect - additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. The determination if the indicator is new or modified happens on the 3rd-party vendor's side, so only indicators that are new or modified are sent to Cortex XSOAR. Therefore, all indicators coming from these feeds are labeled new or modified. defaultvalue: 'true' display: Incremental feed hidden: true name: feedIncremental required: false type: 8 section: Collect - display: Tags type: 0 additionalinfo: Supports CSV values. name: feedTags section: Collect - display: Trust any certificate (not secure) name: insecure required: false type: 8 section: Connect - display: Use system proxy settings name: proxy required: false type: 8 section: Connect display: Feedly Feed name: Feedly Feed script: commands: - arguments: - default: false defaultValue: '10' description: The maximum number of results to return. isArray: false name: limit required: false secret: false deprecated: false description: Gets indicators from the feed. execution: false name: feedly-get-indicators dockerimage: demisto/python3:3.12.13.10404775 feed: true isfetch: false longRunning: false longRunningPort: false runonce: false script: '-' subtype: python3 type: python fromversion: 6.1.0 description: 'Ingest articles with indicators, entities and relationships from Feedly into XSOAR.' marketplaces: - xsoar - marketplacev2 - platform tests: - No tests (auto formatted)