Haseen Threat Intel

Fetches indicators of compromise from a STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.

Data Enrichment & Threat Intelligence · HaseenThreatIntel · Feed

Details

ID	`Haseen Threat Intel`
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.14.13053055`

README

Fetches indicators of compromise from the Haseen STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.
This integration was integrated and tested with the Haseen STIX 2.1 threat-intelligence feed.

Configure Haseen Threat Intel in Cortex

Parameter	Description	Required
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Incremental Feed	Incremental feeds pull only new or modified indicators that have been sent from the integration.	False
The maximum number of indicators that can be fetched per fetch. If this field is left empty, there will be no limit on the number of indicators fetched.	The maximum number of indicators to fetch per iteration. Leave empty to fetch all indicators (no limit).	False
First Fetch Time	The time interval for the first retroactive fetch, formatted as <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hours.	False
Feed Fetch Interval	How often to fetch indicators in minutes. Haseen rate-limits the feed to 2 requests per hour, so set this to 60 or higher to avoid 429 throttling.	False
Server URL	The full STIX export URL, including the export ID. Example: `https://share.haseen.gov.sa/api/v1/threat-intelligence/export/1234`.	True
API Token	The API token from Haseen (settings page). Sent as a `token` query parameter on every request (not a Bearer header). Enter it in the password field.	True
Basic Auth Credentials (optional)	For exports that require Basic authentication in addition to the token. Username is the account email; password is the API token.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

What this integration does

The integration operationalizes Haseen intelligence inside Cortex XSOAR through an automated pipeline:

Automated Feed Retrieval — downloads the Haseen STIX 2.x bundle from the configured export endpoint once new indicators are added/updated.
STIX Parsing — parses the STIX content and identifies actionable intelligence objects (indicators, malware, threat actors, relationships).
Indicator Extraction — extracts relevant indicators and observables from the STIX bundle.
Normalization — converts Haseen intelligence into Cortex XSOAR-native indicator formats.
Deduplication — prevents duplicate indicators from being created within the platform (seen-indicator watermark across fetches).
Enrichment — applies metadata such as source, feed name, confidence, labels, TLP, and intelligence context.
Operationalization — makes threat intelligence immediately available to detection, threat hunting, incident response, and automated correlation use cases.

Supported indicator types

Network — IPv4, IPv6, domains, URLs, FQDNs.
File — MD5, SHA1, SHA256.
Threat context — malware references, campaign information, threat attribution, intelligence metadata.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Configuration parameters

url — Server URL (required)
api_token — API Token (required)
credentials — Basic Auth Credentials (optional)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list
feedIncremental — Incremental Feed
limit — Indicator Limit
first_fetch — First Fetch Time
feedFetchInterval — Feed Fetch Interval
feedExpirationInterval —
feedExpirationPolicy —

Commands (0)

This integration defines no commands.

Source

HaseenThreatIntel.py HaseenThreatIntel_test.py HaseenThreatIntel.yml HaseenThreatIntel_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
commonfields:
  id: Haseen Threat Intel
  version: -1
name: Haseen Threat Intel
display: Haseen Threat Intel
description: Fetches indicators of compromise from a STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.
sectionorder:
- Connect
- Collect
marketplaces:
- xsoar
- marketplacev2
configuration:
- display: Server URL
  name: url
  defaultvalue: 'https://share.haseen.gov.sa/api/v1/threat-intelligence/export/{export_id}'
  type: 0
  required: true
  section: Connect
  additionalinfo: "The full STIX export URL, including the export ID (e.g. https://share.haseen.gov.sa/api/v1/threat-intelligence/export/1234). Do not append ?token=... to this URL - provide the token in the API Token field below; it is sent automatically as a query parameter."
- display: API Token
  name: api_token
  type: 14
  required: true
  section: Connect
  additionalinfo: The API token from Haseen (settings page). Sent as a `token` query parameter on every request, per the Haseen API guide. This token and the Basic Auth Password below are the same secret - keep them in sync when rotating.
- display: Basic Auth Credentials (optional)
  displaypassword: Password
  name: credentials
  type: 9
  required: false
  section: Connect
  additionalinfo: The credentials for exports that require Basic authentication in addition to the token. Username is the account email; password is the API token. This password and the API Token parameter above are the same secret - keep them in sync when rotating.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
  defaultvalue: 'true'
  additionalinfo: Whether to fetch indicators from the Haseen feed.
- display: Indicator Reputation
  name: feedReputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  section: Collect
  additionalinfo: The reputation to apply to indicators from this integration instance.
- display: Source Reliability
  name: feedReliability
  type: 15
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  defaultvalue: 'B - Usually reliable'
  section: Collect
  additionalinfo: The reliability of the source providing the intelligence data.
- display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: 'WHITE'
  required: false
  section: Collect
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
- display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: A comma-separated list of tags to apply to the fetched indicators.
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  advanced: true
  additionalinfo: Whether to bypass the exclusion list for indicators from this feed. When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- display: Incremental Feed
  name: feedIncremental
  type: 8
  required: false
  section: Collect
  advanced: true
  defaultvalue: 'false'
  additionalinfo: Whether to pull only new or modified indicators that have been sent from the integration.
- display: Indicator Limit
  name: limit
  type: 0
  defaultvalue: '1000'
  required: false
  section: Collect
  additionalinfo: The maximum number of indicators to fetch per iteration. Leave empty to fetch all indicators (no limit).
- display: First Fetch Time
  name: first_fetch
  defaultvalue: '7 days'
  type: 0
  required: false
  section: Collect
  additionalinfo: The time interval for the first retroactive fetch, formatted as <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hours.
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  defaultvalue: '60'
  required: false
  section: Collect
  advanced: true
  additionalinfo: The interval at which to fetch indicators, in minutes. Haseen rate-limits the feed to 2 requests per hour, so set this to 60 or higher (the minimum) to avoid 429 throttling.
- name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  defaultvalue: '20160'
  additionalinfo: The interval in minutes after which an indicator's expiration is reset (in case the indicator has not been updated by the feed).
  advanced: true
  section: Collect
- name: feedExpirationPolicy
  display: ''
  type: 17
  required: false
  defaultvalue: indicatorType
  additionalinfo: The policy applied when a fetched indicator expires.
  advanced: true
  section: Collect
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
script:
  commands: []
  dockerimage: demisto/python3:3.12.14.13053055
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)