FireEyeFeed

FireEye Intelligence Feed Integration.

Data Enrichment & Threat Intelligence · FireEye Feed · Feed

Details

IDFireEyeFeed
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use the FireEye feed integration to fetch indicators from the FireEye Intelligence Feed feed.

Configure FireEye Feed in Cortex

Parameter Description
Name A meaningful name for the integration instance.
Fetch indicators If checked, fetches indicators.
Indicator Reputation The reputation applied to indicators from this integration instance. Default is “Bad”.
Source Reliability The reliability of the source providing the intelligence data. Default is “A - Completely reliable”
Traffic Light Protocol color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp.
Indicator Expiration Method The method by which to expire indicators from this feed for this integration instance.
Indicator Expiration Interval How often to expire the indicators from this integration instance (in minutes). This only applies if the feedExpirationPolicy is set to interval.
Feed Fetch Interval How often to fetch indicators from the feed for this integration instance (in minutes). Default is 60.
Public Key + Password The credentials used to access the feed’s data.
Collection(s) to fetch from feed Select which collections to fetch from the feed. Default is “Indicators, Reports”
First Fetch Time First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).
Malicious Threshold The minimum score returned from the feed to determine whether the indicator is malicious. Default is 70.
Reputation Interval If this amount of days passed since the indicator was created, then its reputation can be at most Suspicious. Default is 30.
Bypass exclusion list Whether the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get indicators from the feed

Gets the feed indicators and reports.

Base Command

fireeye-get-indicators

Input
Argument Name Description Required
limit The maximum number of results to return. Default is 10. Optional
Context Output

There is no context output for this command.

Command Example

!fireeye-get-indicators limit=10

fireeye-reset-fetch-indicators

WARNING: This command will reset your fetch history.

Base Command

fireeye-reset-fetch-indicators

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!fireeye-reset-fetch-indicators

Human Readable Output

Fetch was reset successfully. Your next indicator fetch will collect indicators from the configured “First Fetch Time”

Configuration parameters

  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • credentials — Public Key (required)
  • collections_to_fetch — Collection(s) to fetch from feed (required)
  • first_fetch_timestamp — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year). Leave empty to fetch from the first indicator available.
  • threshold — Malicious Threshold
  • reputation_interval — Reputation Interval
  • feedTags — Tags
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • polling_timeout — Request Timeout

Commands (2)

  • fireeye-get-indicators

    Gets indicators from the feed.

  • fireeye-reset-fetch-indicators

    WARNING: This command will reset your fetch history.

Source

FeedFireEye.py FeedFireEye_test.py FeedFireEye.yml FeedFireEye_description.md
Download History Raw 
## FireEye Feed
Fetch indicators and reports from FireEye Intelligence Feed.

* **Public Key** - The public key to access the feed's data.
* **Password** - The private key to access the feed's data.
* **Tags** - Will be assigned to the indicators and reports fetched from the feed. Supports CSV values.
* **Traffic Light Protocol Color** - Will be assigned to the indicators and reports fetched from the feed.
* **Malicious Threshold** - The minimum score from the feed in order to to determine whether the indicator is malicious. Default is "70".
* **Reputation Interval** - If this amount of days passed since the indicator was created, then its reputation can be at most "Suspicious". Default is "30".

Examples of reputation calculation:
* Case 1:
    * 'Malicious Threshold' = 60
    * 'Reputation Interval' = 30
    * Indicator publish date < 30 days
    * Indicator confidence = 70
    * **Result = Malicious**

* Case 2:
    * 'Malicious Threshold' = 60
    * 'Reputation Interval' = 30
    * Indicator publish date > 30 days
    * Indicator confidence = 70
    * **Result = Suspicious**