FeedORKL

Details

ID	`FeedORKL`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use the ORKL Threat Intel Feed integration to get receive threat intelligence indicators from the feed.
This integration was integrated and tested with version 1.0.0 of FeedORKL.

Configure ORKL Threat Intel Feed in Cortex

Parameter	Description	Required
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Create Relationships	Fetch related indicators. Default is “False”.	False
		False
		False
Feed Fetch Interval		False
Maximum Indicators per fetch		False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

orkl-get-reports

Retrieves latest Threat Reports from ORKL

Base Command

orkl-get-reports

Input

Argument Name	Description	Required
limit	Maximum number of Reports to return. Default is 5.	Optional
order_by	Criteria to order Threat Reports. Possible values are: created_at, updated_at, file_creation_date, file_modification_date. Default is file_creation_date.	Optional
order	Ordering of results. Possible values are: asc, desc. Default is desc.	Optional

Context Output

There is no context output for this command.

Configuration parameters

feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedExpirationInterval —
createRelationships — Create Relationships
feedFetchInterval — Feed Fetch Interval
limit — Maximum Indicators per fetch
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list
verify — Trust any certificate (not secure)
proxy — Use system proxy settings
feedIncremental — Incremental Feed

Commands (1)

orkl-get-reports
Retrieves latest Threat Reports from ORKL.

Source

FeedORKL.py FeedORKL_test.py FeedORKL.yml FeedORKL_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: FeedORKL
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  required: false
  type: 8
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: Bad
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  type: 18
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  required: false
  type: 15
  section: Collect
- display: ''
  name: feedExpirationPolicy
  type: 17
  options:
  - never
  - interval
  - indicatorType
  required: false
  section: Collect
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- additionalinfo: Fetch related indicators. Default is "False".
  defaultvalue: 'false'
  display: Create Relationships
  name: createRelationships
  required: false
  type: 8
  section: Collect
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  required: false
  type: 19
  section: Collect
- defaultvalue: '1000'
  display: Maximum Indicators per fetch
  name: limit
  required: false
  type: 0
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  required: false
  type: 0
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: 'true'
  display: Bypass exclusion list
  name: feedBypassExclusionList
  required: false
  type: 8
  section: Collect
- display: Trust any certificate (not secure)
  name: verify
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental Feed
  hidden: true
  name: feedIncremental
  type: 8
  section: Collect
  required: false
description: Use the ORKL Threat Intel Feed integration to get receive threat intelligence indicators from the feed.
display: ORKL Threat Intel Feed
name: FeedORKL
script:
  commands:
  - arguments:
    - defaultValue: '5'
      description: Maximum number of Reports to return.
      name: limit
    - auto: PREDEFINED
      defaultValue: file_creation_date
      description: Criteria to order Threat Reports.
      name: order_by
      predefined:
      - created_at
      - updated_at
      - file_creation_date
      - file_modification_date
    - auto: PREDEFINED
      default: true
      defaultValue: desc
      description: Ordering of results.
      name: order
      predefined:
      - asc
      - desc
    description: Retrieves latest Threat Reports from ORKL.
    name: orkl-get-reports
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- No tests (auto formatted)