FlashpointFeed Deprecated
Deprecated. Use Flashpoint Ignite Feed instead.
Data Enrichment & Threat Intelligence · Flashpoint Feed · Feed
Details
| ID | FlashpointFeed |
|---|---|
| Provider | Flashpoint |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.8.1983910 |
| Supported Modules | Agentix XSIAM |
README
Deprecated. Use Flashpoint Ignite Feed instead.
This integration was integrated and tested with version 4.0.0 of FlashpointFeed
Fetch Indicators
Fetching the Flashpoint indicators. The indicators that are created or updated after the provided first fetch time interval will be fetched in the ascending order.
Configure FlashpointFeed in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | Server URL to connect to Flashpoint. | True |
| API Key | True | |
| Types of the indicators to fetch | Supports multiple values such as url, domain, ip-src. Supports comma separated values. If not specified, it fetches all the indicators. See all available types: https://www.circl.lu/doc/misp/categories-and-types/#types. | False |
| First fetch time interval | Backfill indicators by providing date or relative timestamp. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc) | False |
| Fetch indicators | False | |
| Indicator Reputation | Indicators from this integration instance will be marked with this reputation | False |
| Source Reliability | Reliability of the source providing the intelligence data | True |
| feedExpirationPolicy | False | |
| feedExpirationInterval | False | |
| Feed Fetch Interval | False | |
| Bypass exclusion list | When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. | False |
| Tags | Supports CSV values. | False |
| Traffic Light Protocol Color | The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed | False |
| feedIncremental | To indicate to the Cortex XSOAR server that a feed is incremental. Generally feeds that fetch based on a time range. For example, a daily feed which provides new indicators for the last day or a feed which is immutable and provides indicators from a search date onwards. | False |
| Create relationships | Create relationships between indicators as part of Enrichment. | False |
| Default Indicator Mapping | When selected, all the incoming indicators will map to the Flashpoint Indicator. | False |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
flashpoint-get-indicators
Retrieves indicators from the Flashpoint API. It displays the content of the fetch-indicators command.
Base Command
flashpoint-get-indicators
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The maximum number of result objects to return. Maximum allowed limit is 1000. Default is 10. | Optional |
| updated_since | Only retrieve values after the given timestamp. This parameter operates on the timestamp when an IOC was last updated, i.e. enriched with more metadata. When you want the most recent IOCs shared in the past week, the freshest data, we recommend using this parameter. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Default is 3 days. | Optional |
| types | Search by Attribute types. Can have multiple terms. Example: url, domain, ip-src. See all available types: https://www.circl.lu/doc/misp/categories-and-types/#types. | Optional |
Context Output
There is no context output for this command.
Command Example
!flashpoint-get-indicators limit=10 types=url updated_since="3 days"
Human Readable Output
Indicator(s)
FPID Indicator Type Indicator Value Category Event Name Event Tags Created Timestamp (UTC) First Observed Date dummy_fpid1 url https://dummy_url1.com/attachments/1234/1234/dummy_file1.exe Payload delivery Analysis: dummy_event1 “dummy_value1” [2021-07-06 20:11:11] analysis_id:12345,
event:analysis,
malware:dummy_event1,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Software Packing - T1045”,
os:windows,
source:virustotal,
type:trojan2021-07-06T22:31:24Z 2021-07-06T22:31:44+00:00 dummy_fpid2 url http://dummy_url2.com/dummy_file2.exe Payload delivery Analysis: dummy_event1 “dummy_value2” [2021-07-06 21:17:56] analysis_id:56789,
event:analysis,
file_type:exe,
malware:remcos,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Code Signing - T1116”,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Disabling Security Tools - T1089”,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Registry Run Keys / Start Folder - T1060”,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Software Packing - T1045”,
misp-galaxy:mitre-enterprise-attack-attack-pattern=”Timestomp - T1099”,
misp-galaxy:mitre-enterprise-attack-course-of-action=”Process Injection Mitigation - T1055”,
misp-galaxy:mitre-mobile-attack-attack-pattern=”Lockscreen Bypass - MOB-T1064”,
os:windows,
source:virustotal2021-07-06T22:33:18Z 2021-07-06T22:34:02+00:00
Configuration parameters
url— Server URL (required)api_key— API Key (required)types— Types of the indicators to fetchfirst_fetch— First fetch time intervalfeed— Fetch indicatorsfeedReputation— Indicator ReputationfeedReliability— Source Reliability (required)feedExpirationPolicy—feedExpirationInterval—feedFetchInterval— Feed Fetch IntervalfeedBypassExclusionList— Bypass exclusion listfeedTags— Tagstlp_color— Traffic Light Protocol ColorfeedIncremental—createRelationship— Create relationshipsdefaultMap— Default Indicator Mappinginsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
flashpoint-get-indicatorsRetrieves indicators from the Flashpoint API. It displays the content of the fetch-indicators command.
"""Flashpoint Feed Test File.""" import json import io import pytest from unittest.mock import patch from test_data import input_data from FlashpointFeed import Client, HTTP_ERRORS, MESSAGES, MAX_FETCH from CommonServerPython import DemistoException from requests.exceptions import HTTPError BASE_URL = "https://fp.tools/api/v4" URL_SUFFIX = "/indicators/attribute?limit=1" MOCKER_HTTP_METHOD = 'FlashpointFeed.Client.http_request' PARAMS = { 'feedTags': 'Flashpoint Indicator', 'tlp_color': 'AMBER', 'createRelationship': 'true' } def util_load_json(path: str) -> dict: """Load a json to python dict.""" with io.open(path, mode='r', encoding='utf-8') as f: return json.loads(f.read()) @pytest.fixture() def client(): """Client Fixture.""" client_obj = Client(base_url=BASE_URL) return client_obj class MockResponse: """Creates mock response.""" def __init__(self, status_code): """Initialize class object.""" self.status_code = status_code def raise_for_status(self): """Raise status code error.""" if self.status_code != 200: raise HTTPError('test') def test_test_module_success(requests_mock, client): """Tests test_module.""" from FlashpointFeed import test_module requests_mock.get(BASE_URL + URL_SUFFIX, json={"message": "dummy"}, status_code=200) response = test_module(client, {}) assert response == "ok" @pytest.mark.parametrize("status_code", [ 400, 401, 403, 404, 500 ]) def test_http_request_when_error_is_returned(requests_mock, client, status_code): """Tests http_request method of Client class.""" requests_mock.get(BASE_URL + URL_SUFFIX, status_code=status_code) with pytest.raises(DemistoException) as e: client.http_request(method='GET', url_suffix=URL_SUFFIX) assert str(e.value) == HTTP_ERRORS[status_code] def test_http_request_when_raise_for_status(client): """Tests http_request when error raised for status.""" resp = MockResponse(status_code=503) with pytest.raises(HTTPError): client.handle_errors(resp) def test_create_indicators_from_response(client): """Tests scenario when valid response is provided to create_indicators_from_response.""" response = util_load_json('test_data/fetch_indicators_response.json') indicators = util_load_json('test_data/fetch_indicators.json') params = PARAMS assert client.create_indicators_from_response(response, '', params, False) == indicators def test_validate_fetch_indicators_params_when_valid_params_are_provided(): """Test case scenario when the parameters provided are valid.""" from FlashpointFeed import validate_fetch_indicators_params params = { 'types': 'url', 'first_fetch': '03/07/2021' } fetch_params = { 'limit': MAX_FETCH, 'types': 'url', 'updated_since': '2021-03-07T00:00:00Z', 'sort_timestamp': 'asc' } assert validate_fetch_indicators_params(params) == fetch_params @pytest.mark.parametrize("params, err_msg", input_data.fetch_indicator_params) def test_validate_fetch_indicators_params_when_invalid_params_are_provided(params, err_msg): """Test case scenario when the parameters provided are not valid.""" from FlashpointFeed import validate_fetch_indicators_params with pytest.raises(ValueError) as err: validate_fetch_indicators_params(params) assert str(err.value) == err_msg @patch(MOCKER_HTTP_METHOD) def test_fetch_indicators_command_when_valid_response_is_returned(mocker_http_request, client): """Test case scenario for successful execution of fetch_indicators_command.""" from FlashpointFeed import fetch_indicators_command response = util_load_json('test_data/fetch_indicators_response.json') mocker_http_request.return_value = response indicators = util_load_json('test_data/fetch_indicators.json') params = PARAMS assert fetch_indicators_command(client, params, {}, False) == indicators def test_validate_get_indicators_params_when_valid_params_are_provided(): """Test case scenario when the parameters provided are valid.""" from FlashpointFeed import validate_get_indicators_args params = { 'limit': 5, 'types': 'url', 'updated_since': '03/07/2021' } fetch_params = { 'limit': 5, 'types': 'url', 'updated_since': '2021-03-07T00:00:00Z', 'sort_timestamp': 'asc' } assert validate_get_indicators_args(params) == fetch_params @pytest.mark.parametrize("params, err_msg", input_data.get_indicator_params) def test_validate_get_indicators_params_when_invalid_params_are_provided(params, err_msg): """Test case scenario when the parameters provided are not valid.""" from FlashpointFeed import validate_get_indicators_args with pytest.raises(ValueError) as err: validate_get_indicators_args(params) assert str(err.value) == err_msg @patch(MOCKER_HTTP_METHOD) def test_get_indicators_command_when_valid_response_is_returned(mocker_http_request, client): """Test case scenario for successful execution of get_indicators_command.""" from FlashpointFeed import get_indicators_command mock_response = util_load_json('test_data/fetch_indicators_response.json') mocker_http_request.return_value = mock_response indicators = util_load_json('test_data/fetch_indicators.json') with open('test_data/get_indicators.md') as data: expected_hr = data.read() params = PARAMS result = get_indicators_command(client, params, {}) assert result.raw_response == indicators assert result.readable_output == expected_hr @patch(MOCKER_HTTP_METHOD) def test_get_indicators_command_when_empty_response_is_returned(mocker_http_request, client): """Test case scenario for successful execution of get_indicators_command with an empty response.""" from FlashpointFeed import get_indicators_command mocker_http_request.return_value = {} result = get_indicators_command(client, {}, {}) assert result.readable_output == MESSAGES["NO_INDICATORS_FOUND"]