Hoxhunt v2

Use the Hoxhunt integration to send feedback to reporters of incidents, set incident sensitivity, and apply SOC classification to incidents.

Email · Hoxhunt

Details

IDHoxhunt v2
ProviderHoxhunt
CategoryEmail
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use the Hoxhunt integration to send feedback to reporters of incidents, set incident sensitivity, and apply SOC classification to incidents.
This integration was integrated and tested with version August 2024 of Hoxhunt.

Configure Hoxhunt v2 in Cortex

Parameter Description Required
Server URL e.g. https://api.hoxhunt.com/graphql-external True
API Key Input your api key from Hoxhunt True
Fetch incidents   False
Incidents Fetch Interval   False
Incident type   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Defaults to 7 days. False
Fetch limit Maxium number of incidents per fetch. Cap is 100. False
Only fetch escalated incidents If enabled, only escalated incidents will be fetched. Set up escalation rules in Hoxhunt Response -> Incident Rules False
Only fetch open incidents If enabled, only open incidents will be fetched. False
Use system proxy settings   False
Incident Mirroring Direction Choose the direction to mirror the incident: Incoming (from Hoxhunt to Cortex XSOAR), Outgoing (from Cortex XSOAR to Hoxhunt), or Incoming and Outgoing (from/to Cortex XSOAR and Hoxhunt). False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

hoxhunt-current-user-get

Gets the current user information from Hoxhunt.

Base Command

hoxhunt-current-user-get

Input

| Argument Name | Description | Required |
| — | — | — |

Command Example

!hoxhunt-current-user-get

Context Output

Path Type Description
HoxHunt.CurrentUser string Current User information from Hoxhunt.

hoxhunt-incident-threats-get

Gets threats from Hoxhunt.

Base Command

hoxhunt-incident-threats-get

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident the threats will be from. Required
sort Sorting strategy to use when returning threats from API. Defaults to createdAt_DESC. See Hoxhunt API documentation for more information. Optional
limit Limit the amount of threats returned. Defaults to 50, maximum is 100. Optional
filter Filter string to use to pick only threats of interest. See Hoxhunt API documentation for more information. Optional

Context Output

Path Type Description
Hoxhunt.Threats string Threats from Hoxhunt.
Command Example

!hoxhunt-incident-threats-get incident_id="12345" limit=5 sort="createdAt_DESC"

hoxhunt-incident-note-add

Add Incident note.

Base Command

hoxhunt-incident-note-add

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident to which the note will be added. Required
note The text content of the note to add to the Hoxhunt incident. Required

Context Output

Path Type Description
Hoxhunt.addIncidentNode string Add Incident note.
Command Example

!hoxhunt-incident-note-add incident_id="12345" note="Investigated and escalated to the SOC team."

hoxhunt-incident-threats-remove

Remove all threats that belong to an incident.

Base Command

hoxhunt-incident-threats-remove

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident from which threats will be removed. Required

Context Output

Path Type Description
Hoxhunt.removeIncidentThreats number Returns number of removed threats.
Command Example

!hoxhunt-incident-threats-remove incident_id="12345"

hoxhunt-incident-soc-feedback-send

Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.

Base Command

hoxhunt-incident-soc-feedback-send

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident for which SOC feedback will be sent. Required
custom_message A custom message to include with the SOC feedback. Required
threat_feedback_reported_at_limit Datetime limit. Accepts (<number> <time unit>), e.g “7 days”, “one month” or a iso string (e.g. “2024-10-30T08:37:42.359Z”) Required

Context Output

Path Type Description
Hoxhunt.sendIncidentSocFeedback string The reporter will be informed the incident has been resolved and that no further actions are required from them.
Command Example

!hoxhunt-incident-soc-feedback-send incident_id="12345" custom_message="User reported a phishing email." threat_feedback_reported_at_limit="2024-09-01T00:00:00Z"

hoxhunt-incident-set-sensitive

Set incident to contain sensitive information.

Base Command

hoxhunt-incident-set-sensitive

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident to be marked as sensitive or not sensitive. Required
is_sensitive True or False Boolean for whether the incident contains sensitive information. Possible values are: TRUE, FALSE. Required

Context Output

Path Type Description
Hoxhunt.setIncidentSensitive string Incident sensitivity information.
Command Example

!hoxhunt-incident-set-sensitive incident_id="12345" is_sensitive=true

hoxhunt-incident-set-soc-classification

Set soc classification for an incident.

Base Command

hoxhunt-incident-set-soc-classification

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident to classify. Required
classification The SOC classification to apply to the incident. Possible values are: MALICIOUS, SPAM, SAFE. Required

Context Output

Path Type Description
Hoxhunt.setIncidentSocClassification string Incident SOC classification information.
Command Example

!hoxhunt-incident-set-soc-classification incident_id="12345" classification="Malware"

hoxhunt-incident-update-state

Updates Incident state.

Base Command

hoxhunt-incident-update-state

Input

Argument Name Description Required
incident_id The ID of the Hoxhunt incident to update. Required
state The new state of the incident. Possible values are: OPEN, RESOLVED. Required

Context Output

Path Type Description
Hoxhunt.updateIncidentState string Incident state information.
Command Example

!hoxhunt-incident-update-state incident_id="12345" state="RESOLVED"

get-mapping-fields

Get mapping fields from remote incident. Please note that this method will not update the current incident. It’s here for debugging purposes.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Hoxhunt v2 corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Turns off incident mirroring.
    Incoming Any changes in Hoxhunt v2 events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
    Outgoing Any changes in Cortex XSOAR incidents will be reflected in Hoxhunt v2 events (outgoing mirrored fields).
    Incoming And Outgoing Changes in Cortex XSOAR incidents and Hoxhunt v2 events will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Hoxhunt v2.

Configuration parameters

  • url — Server URL (required)
  • api_key — API Key (required)
  • mirror_direction — Incident Mirroring Direction
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • first_fetch — First fetch timestamp
  • max_fetch — Fetch limit
  • only_escalated_incidents — Only fetch escalated incidents
  • only_open_incidents — Only fetch open incidents

Commands (9)

  • get-mapping-fields

    Get mapping fields from remote incident. Please note that this method will not update the current incident. It's here for debugging purposes.

  • hoxhunt-current-user-get

    Gets the current user information from Hoxhunt.

  • hoxhunt-incident-note-add

    Add Incident note.

  • hoxhunt-incident-set-sensitive

    Set incident to contain sensitive information.

  • hoxhunt-incident-set-soc-classification

    Set soc classification for an incident.

  • hoxhunt-incident-soc-feedback-send

    Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.

  • hoxhunt-incident-threats-get

    Gets threats from Hoxhunt.

  • hoxhunt-incident-threats-remove

    Remove all threats that belong to an incident.

  • hoxhunt-incident-update-state

    Updates Incident state.

Source

HoxhuntV2.py HoxhuntV2_test.py HoxhuntV2.yml HoxhuntV2_description.md command_examples.txt
Download History Raw 
sectionorder:
- Connect
- Collect
commonfields:
  id: Hoxhunt v2
  version: -1
name: Hoxhunt v2
display: Hoxhunt v2
category: Email
provider: Hoxhunt
description: "Use the Hoxhunt integration to send feedback to reporters of incidents, set incident sensitivity, and apply SOC classification to incidents."
configuration:
- display: Server URL
  name: url
  type: 0
  required: true
  additionalinfo: e.g. https://api.hoxhunt.com/graphql-external
  defaultvalue: https://api.hoxhunt.com/graphql-external
  section: Connect
- display: API Key
  name: api_key
  type: 4
  required: true
  additionalinfo: Input your api key from Hoxhunt
  section: Connect
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: Incoming And Outgoing
  type: 15
  required: false
  additionalinfo: "Choose the direction to mirror the incident: Incoming (from Hoxhunt to Cortex XSOAR), Outgoing (from Cortex XSOAR to Hoxhunt), or Incoming and Outgoing (from/to Cortex XSOAR and Hoxhunt)."
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  hidden:
  - marketplacev2
  - platform
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  defaultvalue: "1"
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: First fetch timestamp
  name: first_fetch
  type: 0
  required: false
  additionalinfo: (<number> <time unit>, e.g., 12 hours, 7 days). Defaults to 7 days.
  defaultvalue: "7 days"
  section: Collect
- display: Fetch limit
  defaultvalue: "50"
  name: max_fetch
  type: 0
  required: false
  additionalinfo: Maxium number of incidents per fetch. Cap is 100.
  section: Collect
- display: Only fetch escalated incidents
  defaultvalue: "false"
  name: only_escalated_incidents
  type: 8
  required: false
  additionalinfo: "If enabled, only escalated incidents will be fetched. Set up escalation rules in Hoxhunt Response -> Incident Rules"
  section: Collect
- display: Only fetch open incidents
  defaultvalue: "true"
  name: only_open_incidents
  type: 8
  required: false
  additionalinfo: "If enabled, only open incidents will be fetched."
  section: Collect
script:
  script: ""
  type: python
  commands:
  - name: hoxhunt-current-user-get
    arguments: []
    outputs:
    - contextPath: HoxHunt.CurrentUser
      description: Current User information from Hoxhunt.
      type: string
    description: Gets the current user information from Hoxhunt.
  - name: hoxhunt-incident-threats-get
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident the threats will be from.
    - name: sort
      description: Sorting strategy to use when returning threats from API. Defaults to createdAt_DESC. See Hoxhunt API documentation for more information.
      type: string
    - name: limit
      description: Limit the amount of threats returned. Defaults to 50, maximum is 100.
      type: number
    - name: filter
      description: Filter string to use to pick only threats of interest. See Hoxhunt API documentation for more information.
      type: string
    outputs:
    - contextPath: Hoxhunt.Threats
      description: Threats from Hoxhunt.
      type: string
    description: Gets threats from Hoxhunt.
  - name: hoxhunt-incident-note-add
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to which the note will be added.
    - name: note
      required: true
      description: The text content of the note to add to the Hoxhunt incident.
    outputs:
    - contextPath: Hoxhunt.addIncidentNode
      description: Add Incident note.
      type: string
    description: Add Incident note.
  - name: hoxhunt-incident-threats-remove
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident from which threats will be removed.
    outputs:
    - contextPath: Hoxhunt.removeIncidentThreats
      description: Returns number of removed threats.
      type: number
    description: Remove all threats that belong to an incident.
    execution: true
  - name: hoxhunt-incident-soc-feedback-send
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident for which SOC feedback will be sent.
      type: unknown
    - name: custom_message
      required: true
      description: A custom message to include with the SOC feedback.
      type: unknown
    - name: threat_feedback_reported_at_limit
      required: true
      description: Datetime limit. Accepts (<number> <time unit>), e.g "7 days", "one month" or a iso string (e.g. "2024-10-30T08:37:42.359Z").
      type: unknown
    outputs:
    - contextPath: Hoxhunt.sendIncidentSocFeedback
      description: The reporter will be informed the incident has been resolved and that no further actions are required from them.
      type: string
    description: Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.
  - name: hoxhunt-incident-set-sensitive
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to be marked as sensitive or not sensitive.
      type: unknown
    - name: is_sensitive
      required: true
      auto: PREDEFINED
      predefined:
      - "TRUE"
      - "FALSE"
      description: True or False Boolean for whether the incident contains sensitive information.
      type: unknown
    outputs:
    - contextPath: Hoxhunt.setIncidentSensitive
      description: Incident sensitivity information.
      type: string
    description: Set incident to contain sensitive information.
  - name: hoxhunt-incident-set-soc-classification
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to classify.
    - name: classification
      required: true
      auto: PREDEFINED
      predefined:
      - MALICIOUS
      - SPAM
      - SAFE
      description: The SOC classification to apply to the incident.
    outputs:
    - contextPath: Hoxhunt.setIncidentSocClassification
      description: Incident SOC classification information.
      type: string
    description: Set soc classification for an incident.
  - name: hoxhunt-incident-update-state
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to update.
    - name: state
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - RESOLVED
      description: The new state of the incident.
    outputs:
    - contextPath: Hoxhunt.updateIncidentState
      description: Incident state information.
      type: string
    description: Updates Incident state.
  - description: Get mapping fields from remote incident. Please note that this method will not update the current incident. It's here for debugging purposes.
    name: get-mapping-fields
    arguments: []
    outputs: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  subtype: python3
  isremotesyncin: true
  isremotesyncout: true
  isFetchSamples: true
  ismappable: true
fromversion: 6.10.0
tests:
- Hoxhunt_test
defaultclassifier: Hoxhunt-classifier
defaultmapperin: Hoxhunt-mapper-incoming
defaultmapperout: Hoxhunt-mapper-outgoing