FeedORKL

Details

ID	`FeedORKL`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use the ORKL Threat Intel Feed integration to get receive threat intelligence indicators from the feed.
This integration was integrated and tested with version 1.0.0 of FeedORKL.

Configure ORKL Threat Intel Feed in Cortex

Parameter	Description	Required
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Create Relationships	Fetch related indicators. Default is “False”.	False
		False
		False
Feed Fetch Interval		False
Maximum Indicators per fetch		False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

orkl-get-reports

Retrieves latest Threat Reports from ORKL

Base Command

orkl-get-reports

Input

Argument Name	Description	Required
limit	Maximum number of Reports to return. Default is 5.	Optional
order_by	Criteria to order Threat Reports. Possible values are: created_at, updated_at, file_creation_date, file_modification_date. Default is file_creation_date.	Optional
order	Ordering of results. Possible values are: asc, desc. Default is desc.	Optional

Context Output

There is no context output for this command.

Configuration parameters

feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedExpirationInterval —
createRelationships — Create Relationships
feedFetchInterval — Feed Fetch Interval
limit — Maximum Indicators per fetch
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list
verify — Trust any certificate (not secure)
proxy — Use system proxy settings
feedIncremental — Incremental Feed

Commands (1)

orkl-get-reports
Retrieves latest Threat Reports from ORKL.

Source

FeedORKL.py FeedORKL_test.py FeedORKL.yml FeedORKL_description.md command_examples.txt

Download History Raw

import json
import unittest
from importlib import import_module
from unittest.mock import patch

from FeedORKL import Client, DemistoException, fetch_indicator_command, get_reports_command, module_of_testing
from test_data.feed_data import RESPONSE_DATA

FeedORKL = import_module("FeedORKL")
main = FeedORKL.main


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_fetch_integration(requests_mock):
    requests_mock.get(
        "https://orkl.eu/api/v1/library/entries?order_by=file_creation_date&limit=1&offset=0&order=desc", json=RESPONSE_DATA
    )

    client = Client(verify=False)
    params = {
        "feedTags": "Test Tag",
        "tlp_color": "RED",
        "limit": 1,
        "createRelationships": "true",
        "feedReliability": "C - Fairly reliable",
    }

    indicators = fetch_indicator_command(
        client,
        params.get("feedTags"),
        params.get("tlp_color"),
        params.get("limit"),
        params.get("createRelationships"),
        params.get("feedReliability"),
    )

    assert len(indicators) == 47

    for indicator in indicators:
        if indicator.get("value") == "ALPHVM":
            assert indicator.get("source") == "ORKL Feed"
            break


def test_get_reports_command(requests_mock):
    requests_mock.get(
        "https://orkl.eu/api/v1/library/entries?order_by=created_at&limit=1&offset=0&order=desc", json=RESPONSE_DATA
    )

    expected_human_readable = (
        "### ORKL Reports\n"
        "|Created At|Report Name|Source|References|Threat Actors|\n"
        "|---|---|---|---|---|\n"
        "| 2023-11-18T02:07:23.236896Z | Scattered Spider | Malpedia | "
        "https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf | "
        "ETDA:ALPHV,<br>ETDA:Muddled Libra,<br>ETDA:Lead,<br>MITRE:Scattered Spider,<br>"
        "MISPGALAXY:Scattered Spider,<br>ETDA:Scattered Spider,<br>Secureworks:GOLD HARVEST |\n"
    )

    client = Client(verify=False)
    params = {
        "feedTags": "Test Tag",
        "tlp_color": "RED",
        "limit": 1,
        "createRelationships": "true",
        "feedReliability": "C - Fairly reliable",
    }
    reports = get_reports_command(client=client, limit=params.get("limit"), order_by="created_at", order="desc")
    assert reports.readable_output == expected_human_readable


class TestTestModule(unittest.TestCase):
    def setUp(self):
        self.client = Client(verify=False)

    @patch.object(Client, "fetch_indicators")
    def test_test_module_success(self, mock_fetch):
        # Arrange
        mock_fetch.return_value = {"data": ["some data"]}

        # Act
        result = module_of_testing(self.client)

        # Assert
        assert result == "ok"

    @patch.object(Client, "fetch_indicators")
    def test_test_module_no_data(self, mock_fetch):
        # Arrange
        mock_fetch.return_value = {}

        # Act
        result = module_of_testing(self.client)

        # Assert
        assert result.startswith("Test Command Error:")

    @patch.object(Client, "fetch_indicators")
    def test_test_module_exception(self, mock_fetch):
        # Arrange
        mock_fetch.side_effect = DemistoException("API Error")

        # Act and Assert
        with self.assertRaises(DemistoException):
            module_of_testing(self.client)