Haseen Threat Intel

Details

ID	`Haseen Threat Intel`
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.14.13053055`

README

Fetches indicators of compromise from the Haseen STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.
This integration was integrated and tested with the Haseen STIX 2.1 threat-intelligence feed.

Configure Haseen Threat Intel in Cortex

Parameter	Description	Required
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Incremental Feed	Incremental feeds pull only new or modified indicators that have been sent from the integration.	False
The maximum number of indicators that can be fetched per fetch. If this field is left empty, there will be no limit on the number of indicators fetched.	The maximum number of indicators to fetch per iteration. Leave empty to fetch all indicators (no limit).	False
First Fetch Time	The time interval for the first retroactive fetch, formatted as <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hours.	False
Feed Fetch Interval	How often to fetch indicators in minutes. Haseen rate-limits the feed to 2 requests per hour, so set this to 60 or higher to avoid 429 throttling.	False
Server URL	The full STIX export URL, including the export ID. Example: `https://share.haseen.gov.sa/api/v1/threat-intelligence/export/1234`.	True
API Token	The API token from Haseen (settings page). Sent as a `token` query parameter on every request (not a Bearer header). Enter it in the password field.	True
Basic Auth Credentials (optional)	For exports that require Basic authentication in addition to the token. Username is the account email; password is the API token.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

What this integration does

The integration operationalizes Haseen intelligence inside Cortex XSOAR through an automated pipeline:

Automated Feed Retrieval — downloads the Haseen STIX 2.x bundle from the configured export endpoint once new indicators are added/updated.
STIX Parsing — parses the STIX content and identifies actionable intelligence objects (indicators, malware, threat actors, relationships).
Indicator Extraction — extracts relevant indicators and observables from the STIX bundle.
Normalization — converts Haseen intelligence into Cortex XSOAR-native indicator formats.
Deduplication — prevents duplicate indicators from being created within the platform (seen-indicator watermark across fetches).
Enrichment — applies metadata such as source, feed name, confidence, labels, TLP, and intelligence context.
Operationalization — makes threat intelligence immediately available to detection, threat hunting, incident response, and automated correlation use cases.

Supported indicator types

Network — IPv4, IPv6, domains, URLs, FQDNs.
File — MD5, SHA1, SHA256.
Threat context — malware references, campaign information, threat attribution, intelligence metadata.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Configuration parameters

url — Server URL (required)
api_token — API Token (required)
credentials — Basic Auth Credentials (optional)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedTags — Tags
feedBypassExclusionList — Bypass exclusion list
feedIncremental — Incremental Feed
limit — Indicator Limit
first_fetch — First Fetch Time
feedFetchInterval — Feed Fetch Interval
feedExpirationInterval —
feedExpirationPolicy —

Commands (0)

This integration defines no commands.

Source

HaseenThreatIntel.py HaseenThreatIntel_test.py HaseenThreatIntel.yml HaseenThreatIntel_description.md

Download History Raw

# Haseen Threat Intel

Fetches indicators of compromise from a STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.

## Authentication

Requires a **minimum role of Analyst** (and an account with access granted to the Haseen Threat Intelligence portal) to obtain the API token.

Per the Haseen API Integration Guide, authentication is:

1. **Token-based** — a `token` is sent as a URL query parameter on every request:
   `https://share.haseen.gov.sa/api/v1/threat-intelligence/export/{exportID}?token=<token>`
2. **Basic authentication** (optional) — for specific exports that require it in
   addition to the token. Username is the account email; password is the API token
   (found on the settings page).

## Rate limits

Haseen permits **2 requests per hour per export type**. Exceeding this returns a
`429` (`Request was throttled. Expected available in 3588 seconds`). Configure the
**Feed Fetch Interval** to 60 minutes or higher to stay within the limit.

## Feed specifics

This is a **full-dump** STIX 2.x endpoint — it returns the entire bundle on every
request rather than a `modified_after` delta. The integration parses the bundle
and relies on the Cortex XSOAR feed engine to deduplicate and merge indicators, applying
the configured **Tags**, **Reputation**, **Source Reliability**, **TLP Color**, and
**Bypass exclusion list** settings.