IntSights

Details

ID	`IntSights`
Provider	Rapid7
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.10.10.51930`
Supported Modules	Agentix XSIAM

README

Use IntSights to manage and mitigate threats.
This integration was tested with Intsights API version 3.

Configure IntSights in Cortex

Parameter	Required
Server URL (e.g. https://192.168.0.1)	True
Credentials	True
Password	True
Alert type to fetch as incidents, allowed: “AttackIndication”, “DataLeakage”, “Phishing”, “BrandSecurity”, “ExploitableData”, “VIP”	False
Minimum Alert severity level to fetch incidents incidents from, allowed values are: ‘All’, ‘Low’, ‘Medium’,’High’(Setting to All will fetch all incidents)	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Fetch incidents	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	False
Max fetch	False
Incident type	False
Sub Account ID (MSSP accounts only)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

intsights-get-alert-image

Returns an image of an alert by ID.

Base Command

intsights-get-alert-image

Input

Argument Name	Description	Required
image-id	The ID of the image to return.	Required

Context Output

There is no context output for this command.

intsights-get-alert-activities

Returns alert activities.

Base Command

intsights-get-alert-activities

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Activities.Type	string	The type of the activity.
IntSights.Alerts.Activities.Initiator	string	The initiator of the alert.
IntSights.Alerts.Activities.CreatedDate	date	The date the alert was created.
IntSights.Alerts.Activities.UpdateDate	date	The date the alert was updated.
IntSights.Alerts.Activities.RemediationBlocklistUpdate	string	The remediation blocked list update.
IntSights.Alerts.Activities.AskTheAnalyst.Replies	string	The replies to questions of the analyst.
IntSights.Alerts.Activities.Mail.Replies	string	The replies to an email.
IntSights.Alerts.Activities.ReadBy	string	The alert that was read by.

intsights-assign-alert

Assigns an alert.

Base Command

intsights-assign-alert

Input

Argument Name	Description	Required
alert-id	The unique ID of the Alert.	Required
assignee-email	The user email of the assignee.	Required
is-mssp-optional	Whether the assigned user is an MSSP user. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Assignees.AssigneeID	string	The ID of the assignee.

intsights-unassign-alert

Unassigns an alert from a user.

Base Command

intsights-unassign-alert

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.

intsights-send-mail

Sends an email containing a question and details of the alert.

Base Command

intsights-send-mail

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required
emails	The destination email addresses array (comma-separated).	Required
content	The content added to the alert details.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the Alert.
IntSights.Alerts.Mail.EmailID	string	The ID of the email.
IntSights.Alerts.Question	string	Details of the question.

intsights-ask-the-analyst

Sends a question to the IntSights analyst about the requested alert.

Base Command

intsights-ask-the-analyst

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required
question	Question to ask the Intsights analyst about the requested alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the Alert.
IntSights.Alerts.Question	string	Details of the question.

intsights-add-tag-to-alert

Adds a tag to the alert.

Base Command

intsights-add-tag-to-alert

Input

Argument Name	Description	Required
alert-id	The ID of the unique alert.	Required
tag-name	The new tag string.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Tags.TagName	string	The name of the tag.
IntSights.Alerts.Tags.ID	string	The ID of the Tag.

intsights-remove-tag-from-alert

Removes a tag from the specified alert.

Base Command

intsights-remove-tag-from-alert

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required
tag-id	The unique ID of the tag to remove.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Tags.ID	string	The ID of the tag.

intsights-add-comment-to-alert

Adds a comment to a specified alert.

Base Command

intsights-add-comment-to-alert

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required
comment	The comment to add to the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Comment	string	The comment in the alert.

intsights-update-alert-severity

Changes the severity of a specified alert.

Base Command

intsights-update-alert-severity

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required
severity	The severity of the alert. Can be: “High”, “Medium”, or “Low”. Possible values are: High, Medium, Low.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Severity	string	The severity of the alert.

intsights-get-alert-by-id

Returns the alert object by alert ID.

Base Command

intsights-get-alert-by-id

Input

Argument Name	Description	Required
alert-id	The unique ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Severity	string	The severity of the alert.
IntSights.Alerts.Type	string	The type of the alert.
IntSights.Alerts.FoundDate	date	The date that the alert was found.
IntSights.Alerts.SourceType	string	The source type of the alert.
IntSights.Alerts.SourceURL	string	The source URL of the alert.
IntSights.Alerts.SourceEmail	string	The source email of the alert.
IntSights.Alerts.SourceNetworkType	string	The network type of the alert.
IntSights.Alerts.IsClosed	boolean	Whether or not the alert is closed.
IntSights.Alerts.IsFlagged	boolean	Whether or not the alert is flagged.
IntSights.Alerts.Tags.CreatedBy	string	Name of the service for which the tag was created.
IntSights.Alerts.Tag.Name	string	Name of the tag.
IntSights.Alerts.Tag.ID	string	The ID of the tag.
IntSights.Alerts.Images	string	The ID of the images.
IntSights.Alerts.Description	string	The description of the alert.
IntSights.Alerts.Title	string	The title of the alert.
IntSights.Alerts.TakedownStatus	string	The TakedownStatus of the alert.
IntSights.Alerts.SubType	string	The sub type of the alert.

intsights-get-ioc-by-value

Searches for an exact IOC value.

Base Command

intsights-get-ioc-by-value

Input

Argument Name	Description	Required
value	The IOC value for which to search.	Required

Context Output

Path	Type	Description
IntSights.Iocs.Value	string	The value of the IOC.
IntSights.Iocs.Type	string	The type of the IOC.
IntSights.Iocs.FirstSeen	date	The date the IOC was first seen.
IntSights.Iocs.LastSeen	date	The date the IOC was last seen.
IntSights.Iocs.LastUpdatedDate	date	The date the IOC was last updated.
IntSights.Iocs.SourceID	string	The source ID of the IOC.
IntSights.Iocs.SourceName	string	The source name of the IOC.
IntSights.Iocs.SourceConfidenceLevel	string	The confidence level of the IOC source.
IntSights.Iocs.Severity	string	The severity of the IOC.
IntSights.Iocs.Status	string	The status of the IOC.
IntSights.Iocs.Sources.name	string	The source name of the IOC.
IntSights.Iocs.Sources.confidenceLevel	string	The confidence level of the IOC source.
IntSights.Iocs.Sources.id	string	The source id of the IOC.
IntSights.Iocs.tags	Array	The tags of the IOC.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The type of the indicator.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
File.Name	String	The full file name (including file extension).
File.Malicious.Vendor	String	The vendor that reported the file as malicious.
File.Malicious.Description	String	A description explaining why the file was determined to be malicious.
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
URL.Data	String	The URL.
URL.Malicious.Vendor	String	The vendor reporting the URL as malicious.
URL.Malicious.Description	String	A description of the malicious URL.
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.
IP.Address	String	IP address.
Domain.Name	String	The domain name. For example, “google.com”.
Domain.Malicious.Vendor	String	The vendor reporting the domain as malicious.
Domain.Malicious.Description	String	A description explaining why the domain was reported as malicious.

intsights-get-iocs

Returns count totals of the available IOCs.

Base Command

intsights-get-iocs

Input

Argument Name	Description	Required
type	The type of the IOC. Can be: “Urls”, “Hashes”, “IpAddresses”, or “domains”. Possible values are: Urls, Hashes, IpAddresses, Domains.	Optional
limit	The maximum number of results from 1-1000. Default is 1000.	Optional
severity	The severity level of the IOC. Can be: “High”, “Medium”, or “Low”. Possible values are: High, Medium, Low.	Optional
source-ID	The source of the IOC.	Optional
first-seen-from	Beginning of the date range when the IOC was first seen (MM/DD/YYYY). Default is 0.	Optional
first-seen-to	End of the date range when the IOC was first seen (MM/DD/YYYY). Default is 0.	Optional
last-seen-from	Beginning of the date range when the IOC was last seen (MM/DD/YYYY). Default is 0.	Optional
last-updated-from	Beginning of the date range when the IOC was last updated (YYYY-MM-DD).	Optional
last-seen-to	End of the date range when the IOC was last seen (MM/DD/YYYY). Default is 0.	Optional

Context Output

Path	Type	Description
IntSights.Iocs.Value	string	The value of the IOC.
IntSights.Iocs.Type	string	The type of the IOC.
IntSights.Iocs.FirstSeen	date	The date the IOC was first seen.
IntSights.Iocs.LastSeen	date	The date the IOC was last seen.
IntSights.Iocs.LastUpdatedDate	date	The date the IOC was last updated.
IntSights.Iocs.SourceID	string	The source ID of the IOC.
IntSights.Iocs.SourceName	string	The source name of the IOC.
IntSights.Iocs.SourceConfidenceLevel	string	The confidence level of the IOC source.
IntSights.Iocs.Severity	string	The severity of the IOC.
IntSights.Iocs.Status	string	The status of the IOC.
IntSights.Iocs.Sources.name	string	The source name of the IOC.
IntSights.Iocs.Sources.confidenceLevel	string	The confidence level of the IOC source.
IntSights.Iocs.Sources.id	string	The source id of the IOC.
IntSights.Iocs.tags	Array	The tags of the IOC.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The type of the indicator.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
File.Name	String	The full file name (including file extension).
File.Malicious.Vendor	String	The vendor that reported the file as malicious.
File.Malicious.Description	String	A description explaining why the file was determined to be malicious.
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
URL.Data	String	The URL.
URL.Malicious.Vendor	String	The vendor reporting the URL as malicious.
URL.Malicious.Description	String	A description of the malicious URL.
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.
IP.Address	String	IP address.
Domain.Name	String	The domain name. For example, “google.com”.
Domain.Malicious.Vendor	String	The vendor reporting the domain as malicious.
Domain.Malicious.Description	String	A description explaining why the domain was reported as malicious.

intsights-get-alerts

Returns alerts.

Base Command

intsights-get-alerts

Input

Argument Name	Description	Required
alert-type	The type of the alert. Can be: “AttackIndication”, “DataLeakage”, “Phishing”, “BrandSecurity”, “ExploitableData”, “VIP”. Possible values are: AttackIndication, DataLeakage, Phishing, BrandSecurity, ExploitableData, VIP.	Optional
severity	The severity of the alert. Can be: “High”, “Medium”, or “Low”. Possible values are: High, Medium, Low.	Optional
source-type	The source type of the alert. Can be: “ApplicationStores”, “BlackMarkets”, “HackingForums”, “SocialMedia”, “PasteSites”, or “Others”. Possible values are: ApplicationStores, BlackMarkets, HackingForums, SocialMedia, PasteSites, Others.	Optional
network-type	The network type of the alert. Can be: “ClearWeb”, or “DarkWeb”. Possible values are: ClearWeb, DarkWeb.	Optional
source-date-from	The start date for which to fetch in Millisecond Timestamp in UNIX.	Optional
source-date-to	The end date for which to fetch in Millisecond Timestamp in UNIX.	Optional
found-date-from	The start date for which fetch in Millisecond Timestamp in UNIX.	Optional
found-date-to	The end date for which fetch in Millisecond Timestamp in UNIX.	Optional
assigned	Whether to show assigned or unassigned alerts.	Optional
is-flagged	Whether to show flagged or unflagged alerts.	Optional
is-closed	Whether to show closed/open alerts.	Optional
time-delta	Shows alerts within a specified time delta, given in days.	Optional

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Severity	string	The severity of the alert.
IntSights.Alerts.Type	string	The type of the alert.
IntSights.Alerts.FoundDate	date	The date that the alert was found.
IntSights.Alerts.SourceType	string	The source type of the alert.
IntSights.Alerts.SourceURL	string	The source URL of the alert.
IntSights.Alerts.SourceEmail	string	The source email of the alert.
IntSights.Alerts.SourceNetworkType	string	The network type of the alert.
IntSights.Alerts.IsClosed	boolean	Whether or not the alert is closed.
IntSights.Alerts.IsFlagged	boolean	Whether or not the alert is flagged.
IntSights.Alerts.Tags.CreatedBy	string	Name of the service that the tag was created.
IntSights.Alerts.Tag.Name	string	Name of the tag.
IntSights.Alerts.Tag.ID	string	The ID of the tag.
IntSights.Alerts.Images	string	The ID of each image.
IntSights.Alerts.Description	string	The description of the alert.
IntSights.Alerts.Title	string	The title of the alert.
IntSights.Alerts.TakedownStatus	string	The TakedownStatus of the alert.
IntSights.Alerts.SubType	string	The sub type of the alert.

intsights-alert-takedown-request

Requests an alert takedown.

Base Command

intsights-alert-takedown-request

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.

intsights-get-alert-takedown-status

Returns the alert takedown status.

Base Command

intsights-get-alert-takedown-status

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.TakedownStatus	string	The status of the takedown.

intsights-update-ioc-blocklist-status

Updates the IOC block list status.

Base Command

intsights-update-ioc-blocklist-status

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required
type	A comma separated list of each type of IOC. Options: Domains, IPs, URLs.	Required
value	A comma separated list of the value of the IOCs.	Required
blocklist-status	A comma separated list of the IOCs block list status. Options: Sent, NotSent.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Status	string	The status of the block list.

intsights-get-ioc-blocklist-status

Returns the status of the IOC block list.

Base Command

intsights-get-ioc-blocklist-status

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Status	string	The status of the block list.

intsights-close-alert

Closes an alert

Base Command

intsights-close-alert

Input

Argument Name	Description	Required
alert-id	The ID of the alert.	Required
reason	The reason to close the alert. Can be: “ProblemSolved”, “InformationalOnly”, “ProblemWeAreAlreadyAwareOf”, “CompanyOwnedDomain”, “LegitimateApplication/Profile”, “NotRelatedToMyCompany”, “FalsePositive”, or “Other”. Possible values are: ProblemSolved, InformationalOnly, ProblemWeAreAlreadyAwareOf, CompanyOwnedDomain, LegitimateApplication/Profile, NotRelatedToMyCompany, FalsePositive, Other.	Required
free-text	The comments in the alert.	Optional
is-hidden	The hidden status of the alert. Deletes an alert from the account instance - only when reason is a FalsePositive). Possible values are: True, False. Default is False.	Optional
rate	The rate of the alert.	Optional

Context Output

Path	Type	Description
IntSights.Alerts.ID	string	The ID of the alert.
IntSights.Alerts.Closed.Reason	string	The closed reason of the alert.

intsights-mssp-get-sub-accounts

Returns all Managed Security Service Provider’s (MSSP) sub accounts.

Base Command

intsights-mssp-get-sub-accounts

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
IntSights.MsspAccount.ID	String	The ID of IntSights MSSP sub account.
IntSights.MsspAccount.Status	String	The enabled status of IntSights MSSP sub account
IntSights.MsspAccount.AssetsCount	Number	The assets count of IntSights MSSP sub account.
IntSights.MsspAccount.AssetLimit	Number	The asset limit of IntSights MSSP sub account.
IntSights.MsspAccount.CompanyName	String	The company name of IntSights MSSP sub account.

intsights-request-ioc-enrichment

Request and receive enrichment of an IOC.

Base Command

intsights-request-ioc-enrichment

Input

Argument Name	Description	Required
value	The IOC value for which to enrich.	Required

Context Output

Path	Type	Description
Domain.Name	String	domain name
Domain.DNS	String	domain dns
Domain.Resolutions	String	domain resolutions
Domain.Subdomains	String	domain subdomains
Domain.WHOIS/History	String	domain whois
Domain.Malicious	String	domain malicious
IP.Address	String	ip address
IP.IpDetails	String	ip details
IP.RelatedHashes	String	ip related hashes
IP.WHOIS	String	ip whois
IP.Malicious	String	ip malicious
URL.Data	String	URL Data
URL.AntivirusDetectedEngines	String	URL Antivirus Detected Engines
URL.AntivirusDetectionRatio	String	URL Antivirus Detection Ratio
URL.AntivirusDetections	String	URL Antivirus Detections
URL.AntivirusScanDate	String	URL Antivirus Scan Date
URL.RelatedHashes	String	URL Related Hashes
URL.Malicious	String	URL Malicious
File.Name	String	File Name
File.AntivirusDetectedEngines	String	File Antivirus Detected Engines
File.AntivirusDetectionRatio	String	File Antivirus Detection Ratio
File.AntivirusDetections	String	File Antivirus Detections
File.AntivirusScanDate	String	File Antivirus Scan Date
File.Malicious	String	File Malicious
IntSights.Iocs.Type	String	IntSights Iocs Type
IntSights.Iocs.Value	String	IntSights Iocs Value
IntSights.Iocs.FirstSeen	String	IntSights Iocs First Seen
IntSights.Iocs.LastSeen	String	IntSights Iocs Last Seen
IntSights.Iocs.Status	String	IntSights Iocs Status
IntSights.Iocs.Severity	String	IntSights Iocs Severity
IntSights.Iocs.RelatedMalwares	String	IntSights Iocs Related Malwares
IntSights.Iocs.Sources	String	IntSights Iocs Sources
IntSights.Iocs.IsKnownIoc	String	IntSights Iocs Is Known Ioc
IntSightsIocs.RelatedThreatActors	String	IntSights Iocs Related Threat Actors
IntSights.Iocs.SystemTags	String	IntSights Iocs SystemTags
IntSights.Iocs.Tags	String	IntSights Iocs Tags
IntSights.Iocs.Whitelisted	String	IntSights Iocs Whitelisted
IntSights.Iocs.OriginalValue	String	IntSights Iocs Original Value
Domain.WHOIS	String	Domain WHOIS

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
credentials — Credentials (required)
type — Alert type to fetch as incidents, allowed: "AttackIndication", "DataLeakage", "Phishing", "BrandSecurity", "ExploitableData", "VIP"
severity_level — Minimum Alert severity level to fetch incidents incidents from, allowed values are: 'All', 'Low', 'Medium','High'(Setting to All will fetch all incidents)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Max fetch
incidentType — Incident type
mssp_sub_account_id — Sub Account ID (MSSP accounts only)

Commands (21)

intsights-add-comment-to-alert
Adds a comment to a specified alert.
intsights-add-tag-to-alert
Adds a tag to the alert.
intsights-alert-takedown-request
Requests an alert takedown.
intsights-ask-the-analyst
Sends a question to the IntSights analyst about the requested alert.
intsights-assign-alert
Assigns an alert.
intsights-close-alert
Closes an alert
intsights-get-alert-activities
Returns alert activities.
intsights-get-alert-by-id
Returns the alert object by alert ID.
intsights-get-alert-image
Returns an image of an alert by ID.
intsights-get-alert-takedown-status
Returns the alert takedown status.
intsights-get-alerts
Returns alerts.
intsights-get-ioc-blocklist-status
Returns the status of the IOC block list.
intsights-get-ioc-by-value
Searches for an exact IOC value.
intsights-get-iocs
Returns count totals of the available IOCs.
intsights-mssp-get-sub-accounts
Returns all Managed Security Service Provider's (MSSP) sub accounts.
intsights-remove-tag-from-alert
Removes a tag from the specified alert.
intsights-request-ioc-enrichment
Request and receive enrichment of an IOC.
intsights-send-mail
Sends an email containing a question and details of the alert.
intsights-unassign-alert
Unassigns an alert from a user.
intsights-update-alert-severity
Changes the severity of a specified alert.
intsights-update-ioc-blocklist-status
Updates the IOC block list status.

Source

IntSight.py IntSight_test.py IntSight.yml IntSight_description.md

Download History Raw

commonfields:
  id: IntSights
  version: -1
sectionorder:
- Connect
- Collect
name: IntSights
display: IntSights (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: Rapid7
description: Deprecated. Use Rapid7 Threat Command instead.
deprecated: true
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: https://api.intsights.com/
  type: 0
  required: true
  section: Connect
- display: Credentials
  name: credentials
  type: 9
  required: true
  section: Connect
- display: 'Alert type to fetch as incidents, allowed: "AttackIndication", "DataLeakage", "Phishing", "BrandSecurity", "ExploitableData", "VIP"'
  name: type
  type: 0
  section: Collect
  advanced: true
  required: false
- display: 'Minimum Alert severity level to fetch incidents incidents from, allowed values are: ''All'', ''Low'', ''Medium'',''High''(Setting to All will fetch all incidents)'
  name: severity_level
  defaultvalue: All
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  defaultvalue: 1 day
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Max fetch
  defaultvalue: '50'
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Sub Account ID (MSSP accounts only)
  name: mssp_sub_account_id
  type: 0
  section: Connect
  advanced: true
  required: false
script:
  script: ''
  type: python
  commands:
  - name: intsights-get-alert-image
    arguments:
    - name: image-id
      required: true
      default: true
      description: The ID of the image to return.
    description: Returns an image of an alert by ID.
  - name: intsights-get-alert-activities
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Activities.Type
      description: The type of the activity.
      type: string
    - contextPath: IntSights.Alerts.Activities.Initiator
      description: The initiator of the alert.
      type: string
    - contextPath: IntSights.Alerts.Activities.CreatedDate
      description: The date the alert was created.
      type: date
    - contextPath: IntSights.Alerts.Activities.UpdateDate
      description: The date the alert was updated.
      type: date
    - contextPath: IntSights.Alerts.Activities.RemediationBlocklistUpdate
      description: The remediation blocked list update.
      type: string
    - contextPath: IntSights.Alerts.Activities.AskTheAnalyst.Replies
      description: The replies to questions of the analyst.
      type: string
    - contextPath: IntSights.Alerts.Activities.Mail.Replies
      description: The replies to an email.
      type: string
    - contextPath: IntSights.Alerts.Activities.ReadBy
      description: The alert that was read by.
      type: string
    description: Returns alert activities.
  - name: intsights-assign-alert
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the Alert.
    - name: assignee-email
      required: true
      description: The user email of the assignee.
    - name: is-mssp-optional
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the assigned user is an MSSP user.
      defaultValue: "false"
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Assignees.AssigneeID
      description: The ID of the assignee.
      type: string
    description: Assigns an alert.
  - name: intsights-unassign-alert
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    description: Unassigns an alert from a user.
  - name: intsights-send-mail
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    - name: emails
      required: true
      description: The destination email addresses array (comma-separated).
    - name: content
      required: true
      description: The content added to the alert details.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the Alert.
      type: string
    - contextPath: IntSights.Alerts.Mail.EmailID
      description: The ID of the email.
      type: string
    - contextPath: IntSights.Alerts.Question
      description: Details of the question.
      type: string
    description: Sends an email containing a question and details of the alert.
  - name: intsights-ask-the-analyst
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    - name: question
      required: true
      description: Question to ask the Intsights analyst about the requested alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the Alert.
      type: string
    - contextPath: IntSights.Alerts.Question
      description: Details of the question.
      type: string
    description: Sends a question to the IntSights analyst about the requested alert.
  - name: intsights-add-tag-to-alert
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the unique alert.
    - name: tag-name
      required: true
      description: The new tag string.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Tags.TagName
      description: The name of the tag.
      type: string
    - contextPath: IntSights.Alerts.Tags.ID
      description: The ID of the Tag.
      type: string
    description: Adds a tag to the alert.
  - name: intsights-remove-tag-from-alert
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    - name: tag-id
      required: true
      description: The unique ID of the tag to remove.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Tags.ID
      description: The ID of the tag.
      type: string
    description: Removes a tag from the specified alert.
  - name: intsights-add-comment-to-alert
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    - name: comment
      required: true
      description: The comment to add to the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Comment
      description: The comment in the alert.
      type: string
    description: Adds a comment to a specified alert.
  - name: intsights-update-alert-severity
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    - name: severity
      required: true
      auto: PREDEFINED
      predefined:
      - High
      - Medium
      - Low
      description: 'The severity of the alert. Can be: "High", "Medium", or "Low".'
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Severity
      description: The severity of the alert.
      type: string
    description: Changes the severity of a specified alert.
  - name: intsights-get-alert-by-id
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The unique ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Severity
      description: The severity of the alert.
      type: string
    - contextPath: IntSights.Alerts.Type
      description: The type of the alert.
      type: string
    - contextPath: IntSights.Alerts.FoundDate
      description: The date that the alert was found.
      type: date
    - contextPath: IntSights.Alerts.SourceType
      description: The source type of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceURL
      description: The source URL of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceEmail
      description: The source email of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceNetworkType
      description: The network type of the alert.
      type: string
    - contextPath: IntSights.Alerts.IsClosed
      description: Whether or not the alert is closed.
      type: boolean
    - contextPath: IntSights.Alerts.IsFlagged
      description: Whether or not the alert is flagged.
      type: boolean
    - contextPath: IntSights.Alerts.Tags.CreatedBy
      description: Name of the service for which the tag was created.
      type: string
    - contextPath: IntSights.Alerts.Tag.Name
      description: Name of the tag.
      type: string
    - contextPath: IntSights.Alerts.Tag.ID
      description: The ID of the tag.
      type: string
    - contextPath: IntSights.Alerts.Images
      description: The ID of the images.
      type: string
    - contextPath: IntSights.Alerts.Description
      description: The description of the alert.
      type: string
    - contextPath: IntSights.Alerts.Title
      description: The title of the alert.
      type: string
    - contextPath: IntSights.Alerts.TakedownStatus
      description: The TakedownStatus of the alert.
      type: string
    - contextPath: IntSights.Alerts.SubType
      description: The sub type of the alert.
      type: string
    description: Returns the alert object by alert ID.
  - name: intsights-get-ioc-by-value
    arguments:
    - name: value
      required: true
      default: true
      description: The IOC value for which to search.
    outputs:
    - contextPath: IntSights.Iocs.Value
      description: The value of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Type
      description: The type of the IOC.
      type: string
    - contextPath: IntSights.Iocs.FirstSeen
      description: The date the IOC was first seen.
      type: date
    - contextPath: IntSights.Iocs.LastSeen
      description: The date the IOC was last seen.
      type: date
    - contextPath: IntSights.Iocs.LastUpdatedDate
      description: The date the IOC was last updated.
      type: date
    - contextPath: IntSights.Iocs.SourceID
      description: The source ID of the IOC.
      type: string
    - contextPath: IntSights.Iocs.SourceName
      description: The source name of the IOC.
      type: string
    - contextPath: IntSights.Iocs.SourceConfidenceLevel
      description: The confidence level of the IOC source.
      type: string
    - contextPath: IntSights.Iocs.Severity
      description: The severity of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Status
      description: The status of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Sources.name
      description: The source name of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Sources.confidenceLevel
      description: The confidence level of the IOC source.
      type: string
    - contextPath: IntSights.Iocs.Sources.id
      description: The source id of the IOC.
      type: string
    - contextPath: IntSights.Iocs.tags
      description: The tags of the IOC.
      type: Array
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The type of the indicator.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: Domain.Name
      description: The domain name. For example, "google.com".
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    description: Searches for an exact IOC value.
  - name: intsights-get-iocs
    arguments:
    - name: type
      auto: PREDEFINED
      predefined:
      - Urls
      - Hashes
      - IpAddresses
      - Domains
      description: 'The type of the IOC. Can be: "Urls", "Hashes", "IpAddresses", or "domains".'
    - name: limit
      description: The maximum number of results from 1-1000. Default is 1000.
    - name: severity
      auto: PREDEFINED
      predefined:
      - High
      - Medium
      - Low
      description: 'The severity level of the IOC. Can be: "High", "Medium", or "Low"'
    - name: source-ID
      description: The source of the IOC.
    - name: first-seen-from
      description: Beginning of the date range when the IOC was first seen (MM/DD/YYYY). Default is 0.
    - name: first-seen-to
      description: End of the date range when the IOC was first seen (MM/DD/YYYY). Default is 0.
    - name: last-seen-from
      description: Beginning of the date range when the IOC was last seen (MM/DD/YYYY). Default is 0.
    - name: last-updated-from
      description: Beginning of the date range when the IOC was last updated (YYYY-MM-DD).
    - name: last-seen-to
      description: End of the date range when the IOC was last seen (MM/DD/YYYY). Default is 0.
    outputs:
    - contextPath: IntSights.Iocs.Value
      description: The value of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Type
      description: The type of the IOC.
      type: string
    - contextPath: IntSights.Iocs.FirstSeen
      description: The date the IOC was first seen.
      type: date
    - contextPath: IntSights.Iocs.LastSeen
      description: The date the IOC was last seen.
      type: date
    - contextPath: IntSights.Iocs.LastUpdatedDate
      description: The date the IOC was last updated.
      type: date
    - contextPath: IntSights.Iocs.SourceID
      description: The source ID of the IOC.
      type: string
    - contextPath: IntSights.Iocs.SourceName
      description: The source name of the IOC.
      type: string
    - contextPath: IntSights.Iocs.SourceConfidenceLevel
      description: The confidence level of the IOC source.
      type: string
    - contextPath: IntSights.Iocs.Severity
      description: The severity of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Status
      description: The status of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Sources.name
      description: The source name of the IOC.
      type: string
    - contextPath: IntSights.Iocs.Sources.confidenceLevel
      description: The confidence level of the IOC source.
      type: string
    - contextPath: IntSights.Iocs.Sources.id
      description: The source id of the IOC.
      type: string
    - contextPath: IntSights.Iocs.tags
      description: The tags of the IOC.
      type: Array
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The type of the indicator.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: Domain.Name
      description: The domain name. For example, "google.com".
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    description: Returns count totals of the available IOCs.
  - name: intsights-get-alerts
    arguments:
    - name: alert-type
      auto: PREDEFINED
      predefined:
      - AttackIndication
      - DataLeakage
      - Phishing
      - BrandSecurity
      - ExploitableData
      - VIP
      description: 'The type of the alert. Can be: "AttackIndication", "DataLeakage", "Phishing", "BrandSecurity", "ExploitableData", "VIP".'
    - name: severity
      auto: PREDEFINED
      predefined:
      - High
      - Medium
      - Low
      description: 'The severity of the alert. Can be: "High", "Medium", or "Low".'
    - name: source-type
      auto: PREDEFINED
      predefined:
      - ApplicationStores
      - BlackMarkets
      - HackingForums
      - SocialMedia
      - PasteSites
      - Others
      description: 'The source type of the alert. Can be: "ApplicationStores", "BlackMarkets", "HackingForums", "SocialMedia", "PasteSites", or "Others".'
    - name: network-type
      auto: PREDEFINED
      predefined:
      - ClearWeb
      - DarkWeb
      description: 'The network type of the alert. Can be: "ClearWeb", or "DarkWeb".'
    - name: source-date-from
      description: The start date for which to fetch in Millisecond Timestamp in UNIX.
    - name: source-date-to
      description: The end date for which to fetch in Millisecond Timestamp in UNIX.
    - name: found-date-from
      description: The start date for which fetch in Millisecond Timestamp in UNIX.
    - name: found-date-to
      description: The end date for which fetch in Millisecond Timestamp in UNIX.
    - name: assigned
      description: Whether to show assigned or unassigned alerts.
    - name: is-flagged
      description: Whether to show flagged or unflagged alerts.
    - name: is-closed
      description: Whether to show closed/open alerts.
    - name: time-delta
      description: Shows alerts within a specified time delta, given in days.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Severity
      description: The severity of the alert.
      type: string
    - contextPath: IntSights.Alerts.Type
      description: The type of the alert.
      type: string
    - contextPath: IntSights.Alerts.FoundDate
      description: The date that the alert was found.
      type: date
    - contextPath: IntSights.Alerts.SourceType
      description: The source type of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceURL
      description: The source URL of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceEmail
      description: The source email of the alert.
      type: string
    - contextPath: IntSights.Alerts.SourceNetworkType
      description: The network type of the alert.
      type: string
    - contextPath: IntSights.Alerts.IsClosed
      description: Whether or not the alert is closed.
      type: boolean
    - contextPath: IntSights.Alerts.IsFlagged
      description: Whether or not the alert is flagged.
      type: boolean
    - contextPath: IntSights.Alerts.Tags.CreatedBy
      description: Name of the service that the tag was created.
      type: string
    - contextPath: IntSights.Alerts.Tag.Name
      description: Name of the tag.
      type: string
    - contextPath: IntSights.Alerts.Tag.ID
      description: The ID of the tag.
      type: string
    - contextPath: IntSights.Alerts.Images
      description: The ID of each image.
      type: string
    - contextPath: IntSights.Alerts.Description
      description: The description of the alert.
      type: string
    - contextPath: IntSights.Alerts.Title
      description: The title of the alert.
      type: string
    - contextPath: IntSights.Alerts.TakedownStatus
      description: The TakedownStatus of the alert.
      type: string
    - contextPath: IntSights.Alerts.SubType
      description: The sub type of the alert.
      type: string
    description: Returns alerts.
  - name: intsights-alert-takedown-request
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    description: Requests an alert takedown.
  - name: intsights-get-alert-takedown-status
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.TakedownStatus
      description: The status of the takedown.
      type: string
    description: Returns the alert takedown status.
  - name: intsights-update-ioc-blocklist-status
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the alert.
    - name: type
      required: true
      description: 'A comma separated list of each type of IOC. Options: Domains, IPs, URLs'
    - name: value
      required: true
      description: A comma separated list of the value of the IOCs.
    - name: blocklist-status
      required: true
      description: 'A comma separated list of the IOCs block list status. Options: Sent, NotSent.'
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Status
      description: The status of the block list.
      type: string
    description: Updates the IOC block list status.
  - name: intsights-get-ioc-blocklist-status
    arguments:
    - name: alert-id
      required: true
      default: true
      description: The ID of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Status
      description: The status of the block list.
      type: string
    description: Returns the status of the IOC block list.
  - name: intsights-close-alert
    arguments:
    - name: alert-id
      required: true
      description: The ID of the alert.
    - name: reason
      required: true
      auto: PREDEFINED
      predefined:
      - ProblemSolved
      - InformationalOnly
      - ProblemWeAreAlreadyAwareOf
      - CompanyOwnedDomain
      - LegitimateApplication/Profile
      - NotRelatedToMyCompany
      - FalsePositive
      - Other
      description: 'The reason to close the alert. Can be: "ProblemSolved", "InformationalOnly", "ProblemWeAreAlreadyAwareOf", "CompanyOwnedDomain", "LegitimateApplication/Profile", "NotRelatedToMyCompany", "FalsePositive", or "Other".'
    - name: free-text
      description: The comments in the alert.
    - name: is-hidden
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      description: The hidden status of the alert. Deletes an alert from the account instance - only when reason is a FalsePositive).
      defaultValue: "False"
    - name: rate
      description: The rate of the alert.
    outputs:
    - contextPath: IntSights.Alerts.ID
      description: The ID of the alert.
      type: string
    - contextPath: IntSights.Alerts.Closed.Reason
      description: The closed reason of the alert.
      type: string
    description: Closes an alert
  - name: intsights-mssp-get-sub-accounts
    arguments: []
    outputs:
    - contextPath: IntSights.MsspAccount.ID
      description: The ID of IntSights MSSP sub account.
      type: String
    - contextPath: IntSights.MsspAccount.Status
      description: The enabled status of IntSights MSSP sub account
      type: String
    - contextPath: IntSights.MsspAccount.AssetsCount
      description: The assets count of IntSights MSSP sub account.
      type: Number
    - contextPath: IntSights.MsspAccount.AssetLimit
      description: The asset limit of IntSights MSSP sub account.
      type: Number
    - contextPath: IntSights.MsspAccount.CompanyName
      description: The company name of IntSights MSSP sub account.
      type: String
    description: Returns all Managed Security Service Provider's (MSSP) sub accounts.
  - name: intsights-request-ioc-enrichment
    arguments:
    - name: value
      required: true
      default: true
      description: The IOC value for which to enrich.
    outputs:
    - contextPath: Domain.Name
      description: domain name
      type: String
    - contextPath: Domain.DNS
      description: domain dns
      type: String
    - contextPath: Domain.Resolutions
      description: domain resolutions
      type: String
    - contextPath: Domain.Subdomains
      description: domain subdomains
      type: String
    - contextPath: Domain.WHOIS/History
      description: domain whois
      type: String
    - contextPath: Domain.Malicious
      description: domain malicious
      type: String
    - contextPath: IP.Address
      description: ip address
      type: String
    - contextPath: IP.IpDetails
      description: ip details
      type: String
    - contextPath: IP.RelatedHashes
      description: ip related hashes
      type: String
    - contextPath: IP.WHOIS
      description: ip whois
      type: String
    - contextPath: IP.Malicious
      description: ip malicious
      type: String
    - contextPath: URL.Data
      description: URL Data
      type: String
    - contextPath: URL.AntivirusDetectedEngines
      description: URL Antivirus Detected Engines
      type: String
    - contextPath: URL.AntivirusDetectionRatio
      description: URL Antivirus Detection Ratio
      type: String
    - contextPath: URL.AntivirusDetections
      description: URL Antivirus Detections
      type: String
    - contextPath: URL.AntivirusScanDate
      description: URL Antivirus Scan Date
      type: String
    - contextPath: URL.RelatedHashes
      description: URL Related Hashes
      type: String
    - contextPath: URL.Malicious
      description: URL Malicious
      type: String
    - contextPath: File.Name
      description: File Name
      type: String
    - contextPath: File.AntivirusDetectedEngines
      description: File Antivirus Detected Engines
      type: String
    - contextPath: File.AntivirusDetectionRatio
      description: File Antivirus Detection Ratio
      type: String
    - contextPath: File.AntivirusDetections
      description: File Antivirus Detections
      type: String
    - contextPath: File.AntivirusScanDate
      description: File Antivirus Scan Date
      type: String
    - contextPath: File.Malicious
      description: File Malicious
      type: String
    - contextPath: IntSights.Iocs.Type
      description: IntSights Iocs Type
      type: String
    - contextPath: IntSights.Iocs.Value
      description: IntSights Iocs Value
      type: String
    - contextPath: IntSights.Iocs.FirstSeen
      description: IntSights Iocs First Seen
      type: String
    - contextPath: IntSights.Iocs.LastSeen
      description: IntSights Iocs Last Seen
      type: String
    - contextPath: IntSights.Iocs.Status
      description: IntSights Iocs Status
      type: String
    - contextPath: IntSights.Iocs.Severity
      description: IntSights Iocs Severity
      type: String
    - contextPath: IntSights.Iocs.RelatedMalwares
      description: IntSights Iocs Related Malwares
      type: String
    - contextPath: IntSights.Iocs.Sources
      description: IntSights Iocs Sources
      type: String
    - contextPath: IntSights.Iocs.IsKnownIoc
      description: IntSights Iocs Is Known Ioc
      type: String
    - contextPath: IntSightsIocs.RelatedThreatActors
      description: IntSights Iocs Related Threat Actors
      type: String
    - contextPath: IntSights.Iocs.SystemTags
      description: IntSights Iocs SystemTags
      type: String
    - contextPath: IntSights.Iocs.Tags
      description: IntSights Iocs Tags
      type: String
    - contextPath: IntSights.Iocs.Whitelisted
      description: IntSights Iocs Whitelisted
      type: String
    - contextPath: IntSights.Iocs.OriginalValue
      description: IntSights Iocs Original Value
      type: String
    - contextPath: Domain.WHOIS
      description: Domain WHOIS
      type: String
    important:
    - contextPath: IntSights.Type
      description: TypeDesc
      related: ""
    description: Request and receive enrichment of an IOC.
  isfetch: true
  subtype: python3
  dockerimage: demisto/python3:3.10.10.51930
fromversion: 5.0.0
tests:
- No tests (auto formatted)

IntSights Deprecated

Details

README

Configure IntSights in Cortex

Commands

intsights-get-alert-image

Base Command

Input

Context Output

intsights-get-alert-activities

Base Command

Input

Context Output

intsights-assign-alert

Base Command

Input

Context Output

intsights-unassign-alert

Base Command

Input

Context Output

intsights-send-mail

Base Command

Input

Context Output

intsights-ask-the-analyst

Base Command

Input

Context Output

intsights-add-tag-to-alert

Base Command

Input

Context Output

intsights-remove-tag-from-alert

Base Command

Input

Context Output

intsights-add-comment-to-alert

Base Command

Input

Context Output

intsights-update-alert-severity

Base Command

Input

Context Output

intsights-get-alert-by-id

Base Command

Input

Context Output

intsights-get-ioc-by-value

Base Command

Input

Context Output

intsights-get-iocs

Base Command

Input

Context Output

intsights-get-alerts

Base Command

Input

Context Output

intsights-alert-takedown-request

Base Command

Input

Context Output

intsights-get-alert-takedown-status

Base Command

Input

Context Output

intsights-update-ioc-blocklist-status

Base Command

Input

Context Output

intsights-get-ioc-blocklist-status

Base Command

Input

Context Output

intsights-close-alert

Base Command

Input