FireEye iSIGHT

FireEye cyber threat intelligence.

Data Enrichment & Threat Intelligence · FireEye iSIGHT

Details

IDFireEye iSIGHT
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Supported ModulesAgentix XSIAM

README

ip

basic search reports by ip

Base Command

ip

Input

Argument Name Description Required
ip ip to search by. Required

Context Output

Path Type Description
DBotScore.Indicator unknown The indicator we tested
DBotScore.Type unknown The type of the indicator
DBotScore.Vendor unknown Vendor used to calculate the score
DBotScore.Score unknown The actual score
IP.Address unknown The IP address
Report.ID unknown Report ID
Report.title unknown Report title
Report.publishDate unknown Report publish date
Report.intelligenceType unknown Report intelligence type (overview, vulnerability, malware, threat)

domain

basic search reports by domain.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name Description Required
domain domain to search by. Required

Context Output

Path Type Description
DBotScore.Indicator unknown The indicator we tested
DBotScore.Type unknown The type of the indicator
DBotScore.Vendor unknown Vendor used to calculate the score
DBotScore.Score unknown The actual score
Domain.Name unknown The domain name.
Report.ID unknown Report ID
Report.title unknown Report title
Report.publishDate unknown Report publish date
Report.intelligenceType unknown Report intelligence type (overview, vulnerability, malware, threat)

file

basic search file report by md5/sha1. NOTE - specify only one of md5/sha1 arguments

Base Command

file

Input

Argument Name Description Required
file md5 or sha1 to search by. Optional

Context Output

Path Type Description
DBotScore.Indicator unknown The indicator we tested
DBotScore.Type unknown The type of the indicator
DBotScore.Vendor unknown Vendor used to calculate the score
DBotScore.Score unknown The actual score
Report.ID unknown Report ID
Report.title unknown Report title
Report.publishDate unknown Report publish date
Report.intelligenceType unknown Report intelligence type (overview, vulnerability, malware, threat)

isight-get-report

Get specific report

Base Command

isight-get-report

Input

Argument Name Description Required
reportID Report ID to search by. Required

Context Output

Path Type Description
Report.ID unknown Report ID
Report.title unknown Report title
Report.publishDate unknown Report publish date
Report.intelligenceType unknown Report intelligence type (overview, vulnerability, malware, threat)
Report.audience unknown Report audience
Report.ThreatScape unknown Report threat scape
Report.operatingSystems unknown Report operating systems
Report.riskRating unknown Report risk rating
Report.version unknown Report version
Report.tagSection unknown Report tag section

isight-submit-file

Submission of malware and other files for community sharing

Base Command

isight-submit-file

Input

Argument Name Description Required
entryID entry-id of the file to submit (e.g. 41@18). Required
description file description. Required
type Type of the given file. Possible values are: malware, other. Required

Context Output

There is no context output for this command.

Configuration parameters

  • publicKey — Public Key (required)
  • privateKey — Private Key
  • credentials_private_key —
  • version — Version (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (5)

  • domain

    basic search reports by domain.

  • file

    basic search file report by md5/sha1. NOTE - specify only one of md5/sha1 arguments.

  • ip

    basic search reports by ip.

  • isight-get-report

    Get specific report.

  • isight-submit-file

    Submission of malware and other files for community sharing.

Source

FireEyeISIGHT.js FireEyeISIGHT.yml FireEyeISIGHT_description.md
Download History Raw 
commonfields:
  id: FireEye iSIGHT
  version: -1
name: FireEye iSIGHT
display: FireEye iSIGHT
category: Data Enrichment & Threat Intelligence
provider: Google
description: FireEye cyber threat intelligence.
configuration:
- display: Public Key
  name: publicKey
  defaultvalue: ""
  type: 0
  required: true
- display: Private Key
  name: privateKey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: Private Key
  name: credentials_private_key
  hiddenusername: true
  type: 9
  required: false
- display: Version
  name: version
  defaultvalue: "2.5"
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      isArray: true
      description: A comma separated list of IPs to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: IP.Address
      description: The IP address.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search reports by ip.
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      isArray: true
      description: A comma separated list of domains to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: Domain.Name
      description: The domain name.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search reports by domain.
  - name: file
    arguments:
    - name: file
      isArray: true
      description: A comma separated list of md5 or sha1 to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search file report by md5/sha1. NOTE - specify only one of md5/sha1 arguments.
  - name: isight-get-report
    arguments:
    - name: reportID
      required: true
      default: true
      description: Report ID to search by.
    outputs:
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    - contextPath: Report.audience
      description: Report audience.
    - contextPath: Report.ThreatScape
      description: Report threat scape.
    - contextPath: Report.operatingSystems
      description: Report operating systems.
    - contextPath: Report.riskRating
      description: Report risk rating.
    - contextPath: Report.version
      description: Report version.
    - contextPath: Report.tagSection
      description: Report tag section.
    description: Get specific report.
  - name: isight-submit-file
    arguments:
    - name: entryID
      required: true
      default: true
      description: entry-id of the file to submit (e.g. 41@18).
    - name: description
      required: true
      description: file description.
    - name: type
      description: "Type of the given file."
      required: true
      auto: PREDEFINED
      predefined:
      - malware
      - other
    description: Submission of malware and other files for community sharing.
tests:
- No test
fromversion: 5.0.0