Intel471 Watcher Alerts

Details

ID	`Intel471 Watcher Alerts`
Provider	Intel 471
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/py3-tools:1.0.0.8544956`
Supported Modules	Agentix XSIAM

README

Intel 471’s watcher alerts provide a mechanism by which customers can be notified in a timely manner of Intel471 content that is most relevant to them.

Configure Intel471 Watcher Alerts in Cortex

Parameter	Description	Required
Fetches incidents		False
Username	API username	False
Password	API key	False
Intel 471 backend	Intel 471 backend selection	True
Maximum number of incidents per fetch		False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Incidents Fetch Interval		False
Watcher group UID(s)	The UID(s) of the watcher group(s) for which alerts should be fetched	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	How far back in time to go when performing the first fetch.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

Fetched Incidents Data

Returns the Intel 471 Watcher Alerts. Creates incidents in Cortex XSOAR and populate the incident details field
with the alert content.

Configuration parameters

intel471_backend — Intel 471 backend (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Maximum number of incidents per fetch
credentials — Username
tlp_color — Traffic Light Protocol Color
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
watcher_group_uids — Watcher group UID(s)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (0)

This integration defines no commands.

Source

Intel471WatcherAlerts.py Intel471WatcherAlerts_test.py Intel471WatcherAlerts.yml Intel471WatcherAlerts_description.md command_examples.txt

Download History Raw

import json

import Intel471WatcherAlerts as feed
import pytest


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


GET_REPORT_TYPE_DATA = [
    (
        "https://titan.intel471.com/report/inforep/fd1636d9f5a66098bcea8ae341b0304d",  # input
        "INFO REPORT:\n",  # expected
    ),
    (
        "https://titan.intel471.com/report/fintel/3820588e7fab5f9e24cd582fe2a9f276",  # input
        "FINTEL:\n",  # expected
    ),
    (
        "https://titan.intel471.com/report/spotrep/3ff4ef482649a94e792f8476edc84381",  # input
        "SPOT REPORT:\n",  # expected
    ),
]


@pytest.mark.parametrize("input,expected_results", GET_REPORT_TYPE_DATA)
def test_get_report_type(mocker, input, expected_results):
    """
    Given:
        - set of parameters from demisto.

    When:
        - create an instance and on every run.

    Then:
        - Returns a report type.

    """
    report_type: str = feed.get_report_type(input)
    assert report_type == expected_results


def test_fetch_incidents(requests_mock):
    """Tests the fetch-incidents command function.

    Configures requests_mock instance to generate the appropriate
    get_alert API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from Intel471WatcherAlerts import Client, fetch_incidents_titan

    mock_response = util_load_json("test_data/search_alerts.json")
    requests_mock.get(
        "https://api.test.com/v1/alerts?showRead=true&displayWatchers=true&markAsRead=false&sort=earliest&count=1&"
        "from=1581944401",
        json=mock_response,
    )

    client = Client(base_url="https://api.test.com/v1", verify=False, headers={"Authentication": "Bearer some_api_key"})

    last_run = {
        "last_fetch": 1581944401  # Mon Feb 17 2020
    }

    latest_alert_uid, next_run, incidents = fetch_incidents_titan(
        client=client,
        max_results=1,
        last_run=last_run,
        first_fetch_time=0,
        watcher_group_uids=None,
        last_alert_uid="",
    )

    assert incidents == [
        {
            "name": "INSTANT MESSAGE:\nPart 1 sell part2",
            "occurred": "2021-10-25T11:34:47.000Z",
            "rawJSON": json.dumps(mock_response["alerts"][0]),
            "type": "Intel 471 Watcher Alert",
            "severity": 2,
            "CustomFields": {
                "intel471url": "https://titan.intel471.com/ims_thread/45678901234567890123456789012345?message_uid"
                "=34567890123456789012345678901234",
                "watchergroup": "Test Watcher Group 1",
                "watcher": 'Watcher on "sell"',
            },
            "details": "Source Object: INSTANT MESSAGE\nService: TestService\nChannel:"
            " TEST CHANNEL\nActor: \n\nPart 1 sell part2",
        }
    ]