iDefense Feed Deprecated

Deprecated. Use Accenture CTI Feed instead.

Data Enrichment & Threat Intelligence · Accenture CTI (Deprecated) · Feed

Details

IDiDefense Feed
ProviderAccenture
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/jmespath:1.0.0.23980
Supported ModulesAgentix

README

Fetches indicators from an Accenture CTI feed. You can filter returned indicators by indicator type, indicator severity, threat type, confidence, and malware family (each of these are an integration parameter).
Ingesting the indicator is being done in an incremental manner.
This feed integration was integrated and tested with version v2.61.1 of ACTI.

Configure ACTI Feed in Cortex

Parameter Description Required
feed Fetch indicators False
api_token API Key True
feedReputation Indicator Reputation False
feedReliability Source Reliability True
tlp_color Traffic Light Protocol Color False
feedExpirationPolicy   False
feedExpirationInterval   False
feedFetchInterval Feed Fetch Interval False
feedIncremental Incremental Feed False
fetch_time First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False
indicator_type Indicator Type True
severity Indicator Severity False
threat_type Threat Type False
confidence_from Confidence False
malware_family Malware Family False
feedBypassExclusionList Bypass exclusion list False
feedTags Tags False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

idefense-get-indicators

Gets the feed indicators.

Base Command

idefense-get-indicators

Input

Argument Name Description Required
limit The maximum number of results to return. The default value is 50. Optional

Context Output

There is no context output for this command.

Command Example

!idefense-get-indicators limit=10

Context Example

There is no context output for this command.

Indicators

value type rawJSON
http://example.com URL confidence: 50
display_text: http://example.com
index_timestamp: 2020-12-13T23:31:03.848Z
key: http://example.com
last_modified: 2020-12-13T23:29:13.000Z
last_published: 2020-12-07T14:50:44.000Z
last_seen: 2020-12-13T20:08:24.000Z
last_seen_as: MALWARE_DOWNLOAD
malware_family:
replication_id: xxx
severity: 3
threat_types: Cyber Crime
type: url
uuid: xxx

Configuration parameters

  • feed — Fetch indicators
  • api_token — (required)
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedIncremental — Incremental Feed
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • indicator_type — Indicator Type (required)
  • severity — Indicator Severity
  • threat_type — Threat Type
  • confidence_from — Confidence
  • malware_family — Malware Family
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • idefense-get-indicators

    Gets the feed indicators.

Source

FeediDefense.py FeediDefense_test.py FeediDefense.yml FeediDefense_description.md
Download History Raw 
Fetch indicators from a Accenture CTI feed. You can apply filters to the feed to focus which indicators you want to ingest, for example, indicator severity, confidence, threat type and malware family. By default, the feed fetches three indicator types: IP, Domain and URL. 

## Get Your API Key
 This feed requires that you have an ACTI API key. To get your API key refer to the **Obtain API token** section in the [Accenture CTI documentation](https://intelgraph.idefense.com/#/docs/view#page-section-2-0).