Intel471 Watcher Alerts

Details

ID	`Intel471 Watcher Alerts`
Provider	Intel 471
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/py3-tools:1.0.0.8544956`
Supported Modules	Agentix XSIAM

README

Intel 471’s watcher alerts provide a mechanism by which customers can be notified in a timely manner of Intel471 content that is most relevant to them.

Configure Intel471 Watcher Alerts in Cortex

Parameter	Description	Required
Fetches incidents		False
Username	API username	False
Password	API key	False
Intel 471 backend	Intel 471 backend selection	True
Maximum number of incidents per fetch		False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Incidents Fetch Interval		False
Watcher group UID(s)	The UID(s) of the watcher group(s) for which alerts should be fetched	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	How far back in time to go when performing the first fetch.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

Fetched Incidents Data

Returns the Intel 471 Watcher Alerts. Creates incidents in Cortex XSOAR and populate the incident details field
with the alert content.

Configuration parameters

intel471_backend — Intel 471 backend (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Maximum number of incidents per fetch
credentials — Username
tlp_color — Traffic Light Protocol Color
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
watcher_group_uids — Watcher group UID(s)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (0)

This integration defines no commands.

Source

Intel471WatcherAlerts.py Intel471WatcherAlerts_test.py Intel471WatcherAlerts.yml Intel471WatcherAlerts_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Intel 471
sectionorder:
- Connect
- Collect
commonfields:
  id: Intel471 Watcher Alerts
  version: -1
configuration:
- additionalinfo: The Intel 471 backend from which to source data
  display: Intel 471 backend
  name: intel471_backend
  defaultvalue: TITAN
  options:
  - TITAN
  - Verity471
  type: 15
  required: true
  section: Connect
- defaultvalue: 'true'
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- defaultvalue: Intel 471 Watcher Alert
  display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: '100'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to incidents fetched from the feed
  defaultvalue: AMBER
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- additionalinfo: How far back in time to go when performing the first fetch.
  defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: The UID(s) of the watcher group(s) for which alerts should be fetched (comma separated).
  display: Watcher group UID(s)
  name: watcher_group_uids
  type: 0
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
description: |-
  Intel 471's watcher alerts provide a mechanism by which customers can be notified in a timely manner of Intel471 content that is most relevant to them.
display: Intel471 Watcher Alerts
name: Intel471 Watcher Alerts
script:
  runonce: false
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/py3-tools:1.0.0.8544956
fromversion: 6.0.0
tests:
- No tests (auto formatted)