Github Feed

Details

ID	`Github Feed`
Provider	Microsoft
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/taxii2:1.0.0.11040999`
Supported Modules	Agentix XSIAM

README

This is the Feed GitHub integration for getting started with your feed integration.
This integration was integrated and tested with version 1.0.0 of Github Feed.

Configure Github Feed in Cortex

Parameter	Description	Required
Fetch indicators		False
Base URL	The URL to the GitHub API.	True
API Token		False
Incremental Feed	When enabled (default), only new/modified files since the last fetch are reported (legacy behavior). Disable to fetch the full current set on every cycle so the “When removed from the feed” (suddenDeath) expiration policy can expire indicators removed from the source.	False
Trust any certificate (not secure)		False
Owner	Username of the repository owner	True
Repository / Path to fetch	The name of the repository.	True
Feed type	Predefined list of indicator types: - YARA: Parses YARA rules from the feed. The “Yara” pack is required for this type. - STIX: Parses STIX data from the feed. - IOCs: Parses Indicators of Compromise (IOCs) using regex patterns.	True
Branch name	The name of the main branch to which to compare.	True
Files extensions to fetch	The extension of the file names to target.	True
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
First fetch time	First commit date of first published indicators to bring. e.g., “1 min ago”,”2 weeks ago”,”3 months ago”.	False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Feed Expiration Policy	Controls when indicators expire. Choose “suddenDeath” together with disabling the Incremental Feed option to expire indicators that were removed from the source repository.	False
Feed Expiration Interval	Only used when Feed Expiration Policy is set to “interval”. Ignored for the “suddenDeath”, “never” and “indicatorType” policies.	False
Tags	Supports CSV values.	False
Enrichment Excluded	Select this option to exclude the fetched indicators from the enrichment process.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

github-get-indicators

Retrieves indicators from the feed within a specified date range and up to a maximum limit.

Base Command

github-get-indicators

Input

Argument Name	Description	Required
since	The start date from which to fetch indicators. Accepts date strings like “7 days ago”, “2 weeks ago”, etc. Default is 7 days.	Optional
until	The end date until which to fetch indicators. Accepts date strings like “now”, “2023-05-19”, etc.	Optional
limit	The maximum number of results to return. Default is 50.	Optional

Context Output

There is no context output for this command.

Troubleshooting

HTTP 404 Error: No common ancestor between {commit} and {branch}
- Typically occurs when a “force push” or a “commit squash” overwrites previously pushed commits on the configured branch.
- Resolution: To resolve this issue, reset indicator fetching of the affected integration instance.
- Prevention: To avoid this error, refrain from force pushing or squashing commits on the branch configured in the integration instance.

Configuration parameters

feed — Fetch indicators
url — Base URL (required)
api_token —
feedIncremental — Incremental Feed
insecure — Trust any certificate (not secure)
owner — Owner (required)
repo — Repository / Path to fetch (required)
feedType — Feed type (required)
branch_head — Branch name (required)
extensions_to_fetch — Files extensions to fetch (required)
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
fetch_since — First fetch time
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
feedExpirationPolicy —
feedExpirationInterval — Feed Expiration Interval
feedTags — Tags
enrichmentExcluded — Enrichment Excluded
feedReputation — Indicator Reputation

Commands (1)

github-get-indicators
Retrieves indicators from the feed within a specified date range and up to a maximum limit.

Source

FeedGitHub.py FeedGitHub_test.py FeedGitHub.yml FeedGitHub_description.md command_examples.txt

Download History Raw

# Feed GitHub

The integration supports the following workflow:

- Publication of indicators from a specific repo.

 To access the requested repository, you need to provide
 the owner(username), repo(repository) name, and API key as parameters for the
 integration.

#### It is recommended to use Api Token in order to avoid being rate limited.

To generate your personal access token, visit:[GitHub](https://github.com/settings/tokens)


- `Owner:` The owner of the repository (see the example)
- `Repository:` The name of the repository (see the example)
- `Feed type:` The type of indicators to publish
- `Branch name:` The required head branch
- `Files extensions to fetch:` A list of file extensions from which only the indicators will be extracted

#### Owner, Repo sources example

![exa photo](../../doc_files/owner-repo-example.png)