Github Feed

Details

ID	`Github Feed`
Provider	Microsoft
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/taxii2:1.0.0.11040999`
Supported Modules	Agentix XSIAM

README

This is the Feed GitHub integration for getting started with your feed integration.
This integration was integrated and tested with version 1.0.0 of Github Feed.

Configure Github Feed in Cortex

Parameter	Description	Required
Fetch indicators		False
Base URL	The URL to the GitHub API.	True
API Token		False
Incremental Feed	When enabled (default), only new/modified files since the last fetch are reported (legacy behavior). Disable to fetch the full current set on every cycle so the “When removed from the feed” (suddenDeath) expiration policy can expire indicators removed from the source.	False
Trust any certificate (not secure)		False
Owner	Username of the repository owner	True
Repository / Path to fetch	The name of the repository.	True
Feed type	Predefined list of indicator types: - YARA: Parses YARA rules from the feed. The “Yara” pack is required for this type. - STIX: Parses STIX data from the feed. - IOCs: Parses Indicators of Compromise (IOCs) using regex patterns.	True
Branch name	The name of the main branch to which to compare.	True
Files extensions to fetch	The extension of the file names to target.	True
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
First fetch time	First commit date of first published indicators to bring. e.g., “1 min ago”,”2 weeks ago”,”3 months ago”.	False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Feed Expiration Policy	Controls when indicators expire. Choose “suddenDeath” together with disabling the Incremental Feed option to expire indicators that were removed from the source repository.	False
Feed Expiration Interval	Only used when Feed Expiration Policy is set to “interval”. Ignored for the “suddenDeath”, “never” and “indicatorType” policies.	False
Tags	Supports CSV values.	False
Enrichment Excluded	Select this option to exclude the fetched indicators from the enrichment process.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

github-get-indicators

Retrieves indicators from the feed within a specified date range and up to a maximum limit.

Base Command

github-get-indicators

Input

Argument Name	Description	Required
since	The start date from which to fetch indicators. Accepts date strings like “7 days ago”, “2 weeks ago”, etc. Default is 7 days.	Optional
until	The end date until which to fetch indicators. Accepts date strings like “now”, “2023-05-19”, etc.	Optional
limit	The maximum number of results to return. Default is 50.	Optional

Context Output

There is no context output for this command.

Troubleshooting

HTTP 404 Error: No common ancestor between {commit} and {branch}
- Typically occurs when a “force push” or a “commit squash” overwrites previously pushed commits on the configured branch.
- Resolution: To resolve this issue, reset indicator fetching of the affected integration instance.
- Prevention: To avoid this error, refrain from force pushing or squashing commits on the branch configured in the integration instance.

Configuration parameters

feed — Fetch indicators
url — Base URL (required)
api_token —
feedIncremental — Incremental Feed
insecure — Trust any certificate (not secure)
owner — Owner (required)
repo — Repository / Path to fetch (required)
feedType — Feed type (required)
branch_head — Branch name (required)
extensions_to_fetch — Files extensions to fetch (required)
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
fetch_since — First fetch time
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
feedExpirationPolicy —
feedExpirationInterval — Feed Expiration Interval
feedTags — Tags
enrichmentExcluded — Enrichment Excluded
feedReputation — Indicator Reputation

Commands (1)

github-get-indicators
Retrieves indicators from the feed within a specified date range and up to a maximum limit.

Source

FeedGitHub.py FeedGitHub_test.py FeedGitHub.yml FeedGitHub_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Microsoft
commonfields:
  id: Github Feed
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  required: false
  type: 8
  section: Collect
- defaultvalue: https://api.github.com
  display: Base URL
  name: url
  type: 0
  additionalinfo: The URL to the GitHub API.
  section: Connect
  required: true
- displaypassword: API Token
  name: api_token
  type: 9
  hiddenusername: true
  section: Connect
  required: false
- display: Incremental Feed
  defaultvalue: 'true'
  name: feedIncremental
  section: Collect
  type: 8
  required: false
  additionalinfo: When enabled (default), only new/modified files since the last fetch are reported (legacy behavior). Disable to fetch the full current set on every cycle so the "When removed from the feed" (suddenDeath) expiration policy can expire indicators removed from the source.
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- defaultvalue: ""
  display: Owner
  name: owner
  type: 0
  additionalinfo: Username of the repository owner
  section: Connect
  required: true
- defaultvalue: ""
  display: Repository / Path to fetch
  name: repo
  type: 0
  additionalinfo: The name of the repository.
  section: Connect
  required: true
- defaultvalue: ""
  display: Feed type
  name: feedType
  options:
  - YARA
  - STIX
  - IOCs
  type: 15
  additionalinfo: |
    Predefined list of indicator types:
    - YARA: Parses YARA rules from the feed. The "Yara" pack is required for this type.
    - STIX: Parses STIX data from the feed.
    - IOCs: Parses Indicators of Compromise (IOCs) using regex patterns.
  section: Collect
  required: true
- display: Branch name
  name: branch_head
  type: 0
  required: true
  defaultvalue: main
  additionalinfo: The name of the main branch to which to compare.
  section: Connect
- display: Files extensions to fetch
  name: extensions_to_fetch
  type: 16
  required: true
  defaultvalue: txt,yar,json
  options:
  - txt
  - yar
  - json
  additionalinfo: The extension of the file names to target.
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  required: false
  type: 15
  section: Collect
- display: First fetch time
  additionalinfo: First commit date of first published indicators to bring. e.g., "1 min ago","2 weeks ago","3 months ago".
  name: fetch_since
  type: 0
  defaultvalue: '90 days ago'
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  defaultvalue: '240'
  required: false
  section: Collect
  advanced: true
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: 'true'
  display: Bypass exclusion list
  name: feedBypassExclusionList
  required: false
  type: 8
  section: Collect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- display: ""
  name: feedExpirationPolicy
  type: 17
  required: false
  additionalinfo: Controls when indicators expire. Choose "suddenDeath" together with disabling the *Incremental Feed* option to expire indicators that were removed from the source repository.
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
  advanced: true
- display: Feed Expiration Interval
  name: feedExpirationInterval
  type: 1
  required: false
  additionalinfo: Only used when *Feed Expiration Policy* is set to "interval". Ignored for the "suddenDeath", "never" and "indicatorType" policies.
  section: Collect
  advanced: true
- display: Tags
  name: feedTags
  type: 0
  additionalinfo: Supports CSV values.
  required: false
  section: Collect
  advanced: true
- display: Enrichment Excluded
  name: enrichmentExcluded
  type: 8
  required: false
  defaultvalue: 'false'
  additionalinfo: Select this option to exclude the fetched indicators from the enrichment process.
  hidden:
  - xsoar_on_prem
  section: Collect
- name: feedReputation
  display: Indicator Reputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  section: Collect
display: Github Feed
name: Github Feed
script:
  commands:
  - arguments:
    - defaultValue: '7 days'
      description: 'The start date from which to fetch indicators. Accepts date strings like "7 days ago", "2 weeks ago", etc.'
      name: since
    - description: 'The end date until which to fetch indicators. Accepts date strings like "now", "2023-05-19", etc.'
      name: until
    - defaultValue: '50'
      description: The maximum number of results to return.
      name: limit
    description: Retrieves indicators from the feed within a specified date range and up to a maximum limit.
    name: github-get-indicators
  dockerimage: demisto/taxii2:1.0.0.11040999
  feed: true
  isfetch: false
  longRunning: false
  longRunningPort: false
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.8.0
description: This is the Feed GitHub integration for getting started with your feed integration.
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)
sectionorder:
- Connect
- Collect