Hoxhunt

Details

ID	`Hoxhunt`
Provider	Hoxhunt
Category	Email
From Version	6.10.0
Docker Image	`demisto/python3:3.12.12.5490952`
Supported Modules	Agentix XSIAM

README

Use the Hoxhunt integration to send feedback to reporters of incidents, set incident sensitivity, and apply SOC classification to incidents.
This integration was integrated and tested with version August 2024 of Hoxhunt.

Configure Hoxhunt in Cortex

Parameter	Description	Required
Server URL (e.g. https://api.hoxhunt.com/graphql-external)		True
Trust any certificate (not secure)		False
Use system proxy settings		False
API Key	Input your api key from Hoxhunt	False
Fetch incidents		False
Incidents Fetch Interval		False
Incident type		False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Query Filter	Input a query filter for incidents to be fetched	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

hoxhunt-get-current-user

Gets the current user information from Hoxhunt.

Base Command

hoxhunt-get-current-user

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
HoxHunt.CurrentUser	string	Current User information from Hoxhunt.

hoxhunt-get-incidents

Gets incidents from Hoxhunt.

Base Command

hoxhunt-get-incidents

Input

Argument Name	Description	Required
filter	Input here the filter or other arguments.	Optional

Context Output

Path	Type	Description
Hoxhunt.Incidents	string	Incidents from Hoxhunt.

hoxhunt-get-threats

Gets threats from Hoxhunt.

Base Command

hoxhunt-get-threats

Input

Argument Name	Description	Required
filter	Input here the filter or other arguments.	Optional

Context Output

Path	Type	Description
Hoxhunt.Threats	string	Threats from Hoxhunt.

hoxhunt-add-incident-note

Add Incident note.

Base Command

hoxhunt-add-incident-note

Input

Argument Name	Description	Required
incident_id	The ID of the incident to which the note will be added.	Required
note	The content of the note to add to the incident.	Required

Context Output

Path	Type	Description
Hoxhunt.addIncidentNode	string	Add Incident note.

hoxhunt-remove-incident-threats

Remove all threats that belong to an incident.

Base Command

hoxhunt-remove-incident-threats

Input

Argument Name	Description	Required
incident_id	The ID of the incident from which threats will be removed.	Required

Context Output

Path	Type	Description
Hoxhunt.removeIncidentThreats	number	Returns number of removed threats.

hoxhunt-send-incident-soc-feedback

Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.

Base Command

hoxhunt-send-incident-soc-feedback

Input

Argument Name	Description	Required
incident_id	The ID of the incident for which SOC feedback will be sent.	Required
custom_message	A custom message to include with the SOC feedback.	Required
threat_feedback_reported_at_limit	Datetime limit.	Required

Context Output

Path	Type	Description
Hoxhunt.sendIncidentSocFeedback	string	The reporter will be informed the incident has been resolved and that no further actions are required from them.

hoxhunt-set-incident-sensitive

Set incident to contain sensitive information.

Base Command

hoxhunt-set-incident-sensitive

Input

Argument Name	Description	Required
incident_id	The ID of the incident to be marked as sensitive or not sensitive.	Required
is_sensitive	True or False Boolean. Possible values are: TRUE, FALSE.	Required

Context Output

Path	Type	Description
Hoxhunt.setIncidentSensitive	string	Incident sensitivity information.

hoxhunt-set-incident-soc-classification

Set soc classification for an incident.

Base Command

hoxhunt-set-incident-soc-classification

Input

Argument Name	Description	Required
incident_id	The ID of the incident to classify.	Required
classification	The SOC classification to apply to the incident. Possible values are: MALICIOUS, SPAM, SAFE.	Required

Context Output

Path	Type	Description
Hoxhunt.setIncidentSocClassification	string	Incident SOC classification information.

hoxhunt-update-incident-state

Updates Incident state.

Base Command

hoxhunt-update-incident-state

Input

Argument Name	Description	Required
incident_id	The ID of the incident to update.	Required
state	The new state of the incident. Possible values are: OPEN, RESOLVED.	Required

Context Output

Path	Type	Description
Hoxhunt.updateIncidentState	string	Incident state information.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Hoxhunt corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Hoxhunt.

Configuration parameters

url — Server URL (e.g. https://api.hoxhunt.com/graphql-external) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
api_key — API Key
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
queryfilter — Query Filter

Commands (9)

hoxhunt-add-incident-note
Add Incident note.
hoxhunt-get-current-user
Gets the current user information from Hoxhunt.
hoxhunt-get-incidents
Gets incidents from Hoxhunt.
hoxhunt-get-threats
Gets threats from Hoxhunt.
hoxhunt-remove-incident-threats
Remove all threats that belong to an incident.
hoxhunt-send-incident-soc-feedback
Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.
hoxhunt-set-incident-sensitive
Set incident to contain sensitive information.
hoxhunt-set-incident-soc-classification
Set soc classification for an incident.
hoxhunt-update-incident-state
Updates Incident state.

Source

Hoxhunt.py Hoxhunt.yml Hoxhunt_description.md

Download History Raw

commonfields:
  id: Hoxhunt
  version: -1
name: Hoxhunt
display: Hoxhunt (Deprecated)
category: Email
provider: Hoxhunt
description: "Deprecated. Use Hoxhunt V2 instead."
configuration:
- display: Server URL (e.g. https://api.hoxhunt.com/graphql-external)
  name: url
  defaultvalue: https://api.hoxhunt.com/graphql-external
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: API Key
  name: api_key
  type: 4
  required: false
  additionalinfo: Input your api key from Hoxhunt
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
- display: Query Filter
  name: queryfilter
  type: 0
  required: false
  additionalinfo: Input a query filter for incidents to be fetched
script:
  script: ''
  type: python
  commands:
  - name: hoxhunt-get-current-user
    arguments: []
    outputs:
    - contextPath: HoxHunt.CurrentUser
      description: Current User information from Hoxhunt.
      type: string
    description: Gets the current user information from Hoxhunt.
  - name: hoxhunt-get-incidents
    arguments:
    - name: filter
      description: Input here the filter or other arguments.
      type: unknown
    outputs:
    - contextPath: Hoxhunt.Incidents
      description: Incidents from Hoxhunt.
      type: string
    description: Gets incidents from Hoxhunt.
  - name: hoxhunt-get-threats
    arguments:
    - name: filter
      description: Input here the filter or other arguments.
    outputs:
    - contextPath: Hoxhunt.Threats
      description: Threats from Hoxhunt.
      type: string
    description: Gets threats from Hoxhunt.
  - name: hoxhunt-add-incident-note
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident to which the note will be added.
    - name: note
      required: true
      description: The content of the note to add to the incident.
    outputs:
    - contextPath: Hoxhunt.addIncidentNode
      description: Add Incident note.
      type: string
    description: Add Incident note.
  - name: hoxhunt-remove-incident-threats
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident from which threats will be removed.
    outputs:
    - contextPath: Hoxhunt.removeIncidentThreats
      description: Returns number of removed threats.
      type: number
    description: Remove all threats that belong to an incident.
    execution: true
  - name: hoxhunt-send-incident-soc-feedback
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident for which SOC feedback will be sent.
      type: unknown
    - name: custom_message
      required: true
      description: A custom message to include with the SOC feedback.
      type: unknown
    - name: threat_feedback_reported_at_limit
      required: true
      description: Datetime limit.
      type: unknown
    outputs:
    - contextPath: Hoxhunt.sendIncidentSocFeedback
      description: The reporter will be informed the incident has been resolved and that no further actions are required from them.
      type: string
    description: Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.
  - name: hoxhunt-set-incident-sensitive
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident to be marked as sensitive or not sensitive.
      type: unknown
    - name: is_sensitive
      required: true
      auto: PREDEFINED
      predefined:
      - 'TRUE'
      - 'FALSE'
      description: True or False Boolean.
      type: unknown
    outputs:
    - contextPath: Hoxhunt.setIncidentSensitive
      description: Incident sensitivity information.
      type: string
    description: Set incident to contain sensitive information.
  - name: hoxhunt-set-incident-soc-classification
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident to classify.
    - name: classification
      required: true
      auto: PREDEFINED
      predefined:
      - MALICIOUS
      - SPAM
      - SAFE
      description: The SOC classification to apply to the incident.
    outputs:
    - contextPath: Hoxhunt.setIncidentSocClassification
      description: Incident SOC classification information.
      type: string
    description: Set soc classification for an incident.
  - name: hoxhunt-update-incident-state
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident to update.
    - name: state
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - RESOLVED
      description: The new state of the incident.
    outputs:
    - contextPath: Hoxhunt.updateIncidentState
      description: Incident state information.
      type: string
    description: Updates Incident state.
  dockerimage: demisto/python3:3.12.12.5490952
  isfetch: true
  runonce: false
  subtype: python3
  isremotesyncin: true
  isremotesyncout: true
  isFetchSamples: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)
deprecated: true

Hoxhunt Deprecated

Details

README

Configure Hoxhunt in Cortex

Commands

hoxhunt-get-current-user

Base Command

Input

Context Output

hoxhunt-get-incidents

Base Command

Input

Context Output

hoxhunt-get-threats

Base Command

Input

Context Output

hoxhunt-add-incident-note

Base Command

Input

Context Output

hoxhunt-remove-incident-threats

Base Command

Input

Context Output

hoxhunt-send-incident-soc-feedback

Base Command

Input

Context Output

hoxhunt-set-incident-sensitive

Base Command

Input

Context Output

hoxhunt-set-incident-soc-classification

Base Command

Input

Context Output

hoxhunt-update-incident-state

Base Command

Input

Context Output

Incident Mirroring

Configuration parameters

Commands (9)

Source