MS-ISAC

Details

ID	`MS-ISAC`
Provider	CIS
Category	Utilities
From Version	5.5.0
Docker Image	`demisto/python3:3.12.8.3720084`
Supported Modules	Agentix XSIAM

README

This API queries alerts and alert data from the MS-ISAC API to enrich and query alerts from the platform
This integration was integrated and tested with version 1.2 (7/1/25) of the MS-ISAC API.

Configure MS-ISAC in Cortex

Parameter	Description	Required
API Key	Key provided by MS-ISAC according to the detailed Instructions	True
Server URL	This is the URL provided by MS-ISAC for the base of all endpoints	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msisac-get-alert

Retrieve alert data by its ID

Base Command

msisac-get-alert

Input

Argument Name	Description	Required
alert_id	The ID of the MS-ISAC alert.	True

Context Output

Path	Type	Description
MSISAC.Alert.alertId	string	The id for this alert
MSISAC.Alert.affectedIp	string	The internal IP that is associated with the traffic
MSISAC.Alert.alertedAt	string	The timestamp when the alert happened
MSISAC.Alert.applicationProtocol	string	The protocol associated with the traffic
MSISAC.Alert.category	string	The category of the alert
MSISAC.Alert.createdAt	string	The timestamp when the alert was created
MSISAC.Alert.destinationIp	string	The destination IP of the traffic
MSISAC.Alert.destinationPort	number	The destination port number of the traffic
MSISAC.Alert.encodedPayload	string	The encoded payload of the traffic
MSISAC.Alert.httpHostname	string	The HTTP hostname of the traffic
MSISAC.Alert.httpMethod	string	The HTTP method of the traffic
MSISAC.Alert.httpStatus	number	The HTTP status code of the traffic
MSISAC.Alert.httpUrl	string	The HTTP url of the traffic
MSISAC.Alert.logicalSensor	string	The name for the sensor that triggered the event
MSISAC.Alert.mitreTactic	string	The mitre tactic associated with the traffic
MSISAC.Alert.mitreTechnique	string	The mitre technique associated with the traffic
MSISAC.Alert.signatureDirection	string	The direction of the traffic flow
MSISAC.Alert.signatureId	number	The signature id of the traffic
MSISAC.Alert.signatureName	string	The signature name of the traffic
MSISAC.Alert.sourceIp	string	The source IP of the traffic
MSISAC.Alert.sourcePort	number	The source port number of the traffic
MSISAC.Alert.transportProtocol	string	The transport protocol of the traffic

msisac-retrieve-cases

Retrieves a list of MS-ISAC cases created since the given timestamp.

Base Command

msisac-retrieve-cases

Input

Argument Name	Description	Required
timestamp	Needs to be in “2025-07-01T00:00:00” format, in UTC. If no timestamp is given, command will return cases from the last 72 hours.	False

Context Output

Path	Type	Description
MSISAC.RetrievedCases.caseId	string	ID for the retrieved MS-ISAC case
MSISAC.RetrievedCases.affectedIp	string	The internal IP that is associated with the traffic
MSISAC.RetrievedCases.alertIds	list	The MSISAC alert ids associated with the case
MSISAC.RetrievedCases.createdAt	string	The timestamp when the case was created. This is associated with the timestamp input parameter
MSISAC.RetrievedCases.logicalSensorName	string	The name for the sensor that triggered the event
MSISAC.RetrievedCases.modifiedAt	string	The timestamp for when the case was last modified
MSISAC.RetrievedCases.severity	string	The severity of the case

Configuration parameters

apikey — (required)
url — Server URL (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First Fetch Time

Commands (4)

msisac-get-alert
Retrieve alert data by its ID.
msisac-get-event Deprecated
Retrieve alert data by its ID.
msisac-retrieve-cases
Retrieves a list of MS-ISAC cases since the given timestamp. If no timestamp is given, command will return cases from the last 72 hours.
msisac-retrieve-events Deprecated
Retrieves a list of MS-ISAC events for a given number of days (one or greater).

Source

MSISAC.py MSISAC.yml MSISAC_description.md

Download History Raw

category: Utilities
provider: CIS
sectionorder:
- Connect
- Collect
commonfields:
  id: MS-ISAC
  version: -1
configuration:
- displaypassword: API Key
  display: ""
  additionalinfo: Key provided by MS-ISAC according to the detailed Instructions
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  section: Connect
- display: Server URL
  additionalinfo: This is the URL provided by MS-ISAC for the base of all endpoints
  defaultvalue: https://socapi.cisecurity.org
  name: url
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Fetch incidents
  name: isFetch
  section: Collect
  type: 8
  required: false
- display: Incidents Fetch Interval
  section: Collect
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  advanced: true
- display: First Fetch Time
  name: first_fetch
  section: Collect
  additionalinfo: When the integration intstance is configured to fetch for the first time, this parameter will determine how far back it will look to fetch.
  defaultvalue: 1 day ago
  type: 0
  required: false
  advanced: true
description: This API queries alerts and alert data from the MS-ISAC API to enrich and query alerts from the platform.
display: MS-ISAC
name: MS-ISAC
script:
  commands:
  - name: msisac-get-event
    deprecated: true
    arguments:
    - description: The ID of the MS-ISAC event.
      name: event_id
    description: Retrieve alert data by its ID.
    outputs:
    - contextPath: MSISAC.Event.EventID
      description: The event ID for this specific retrieval.
      type: string
    - contextPath: MSISAC.Event.Stream
      description: A list of data streams that were pulled from this MS-ISAC event. These lists of dictionaries contain more detailed information.
      type: unknown
    - contextPath: MSISAC.Event.Stream.flow_id
      description: The ID for this specific data flow.
      type: number
    - contextPath: MSISAC.Event.Stream.start
      description: The start data for this stream.
      type: date
    - contextPath: MSISAC.Event.Stream.src_ip
      description: The source IP of the event.
      type: string
    - contextPath: MSISAC.Event.Stream.vlan
      description: A list of all the VLANs configured for this interface.
    - contextPath: MSISAC.Event.Stream.pkts_toserver
      description: The number of packets sent.
      type: number
    - contextPath: MSISAC.Event.Stream.dest_ip
      description: The destination IP for this flow.
      type: string
    - contextPath: MSISAC.Event.Stream.length
      description: The length of this flow.
      type: number
    - contextPath: MSISAC.Event.Stream.streamdataascii
      description: A string representation of the flow data that is granularly displayed.
      type: string
    - contextPath: MSISAC.Event.Stream.host
      description: The Albert sensor that detected the traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.proto
      description: TCP or UDP communication.
      type: string
    - contextPath: MSISAC.Event.Stream.app_proto
      description: The application protocol that was used in this communication.
      type: string
    - contextPath: MSISAC.Event.Stream.logical_sensor_id
      description: The ID for the sensor that detected the traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.streamdatalen
      description: The total data sent in the request.
      type: string
    - contextPath: MSISAC.Event.Stream.pkts_toclient
      description: The total amount of packets sent.
      type: number
    - contextPath: MSISAC.Event.Stream.flow_id
      description: The specific ID for this flow.
      type: number
    - contextPath: MSISAC.Event.Stream.in_iface
      description: The physical interface that this traffic traversed.
      type: string
    - contextPath: MSISAC.Event.Stream.time
      description: The time that this traffic occured in a more human readable format than 'start'.
      type: date
    - contextPath: MSISAC.Event.Stream.url
      description: The URL that was attempted with this traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.bytes_toserver
      description: The size of the data sent to the server.
      type: number
    - contextPath: MSISAC.Event.Stream.status
      description: The status code for this data stream.
      type: number
    - contextPath: MSISAC.Event.Stream.hostname
      description: The hostname (not URL) of the attempted traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.tx_id
      description: The transaction ID for the MSISAC stream.
      type: number
    - contextPath: MSISAC.Event.Stream.http_content_type
      description: The content encoding used for the response traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.http_method
      description: The method used to send the traffic (GET, POST, etc).
      type: string
    - contextPath: MSISAC.Event.Stream.protocol
      description: What web protocol was used (HTTP/1.1 etc).
      type: string
    - contextPath: MSISAC.Event.Stream.bytes_toclient
      description: The size of the data sent to the client.
      type: number
    - contextPath: MSISAC.Event.Stream.src_port
      description: The source port for the traffic.
      type: number
    - contextPath: MSISAC.Event.Stream.dest_port
      description: The destination port for the traffic.
      type: string
    - contextPath: MSISAC.Event.Stream.event_type
      description: The type of event submitted from MS-ISAC.
  - name: msisac-retrieve-events
    deprecated: true
    arguments:
    - defaultValue: '1'
      description: The number of days worth of events to return. Must be one or greater.
      name: days
      required: true
    - description: If you want to search the list of events for a specific event, specify this optional command to return just those results.
      name: event_id
    description: Retrieves a list of MS-ISAC events for a given number of days (one or greater).
    outputs:
    - contextPath: MSISAC.RetrievedEvents.event_id
      description: ID for the retrieved MS-ISAC event.
      type: number
    - contextPath: MSISAC.RetrievedEvents.stime
      description: The time that the traffic started.
      type: date
    - contextPath: MSISAC.RetrievedEvents.sourceip
      description: The IP that originated the traffic.
      type: string
    - contextPath: MSISAC.RetrievedEvents.analyzed_ts
      description: The time that this traffic was analyzed by MS-ISAC.
      type: date
    - contextPath: MSISAC.RetrievedEvents.logical_sensor_id
      description: The ID for the sensor that triggered the event.
      type: string
    - contextPath: MSISAC.RetrievedEvents.ticket_id
      description: String representation of event_id.
      type: string
    - contextPath: MSISAC.RetrievedEvents.queue
      description: The group that originated the event.
      type: string
    - contextPath: MSISAC.RetrievedEvents.status
      description: The current state of the event.
      type: string
    - contextPath: MSISAC.RetrievedEvents.previous_escalations
      description: How many times this alert has been escalated.
      type: string
    - contextPath: MSISAC.RetrievedEvents.last_stime
      description: The last time that this traffic was observed (stop time).
      type: date
    - contextPath: MSISAC.RetrievedEvents.sensor
      description: The hostname of the sensor that triggered the event.
      type: string
    - contextPath: MSISAC.RetrievedEvents.analysis
      description: The analysis provided by MS-ISAC.
      type: string
    - contextPath: MSISAC.RetrievedEvents.description
      description: The description of the event.
      type: string
    - contextPath: MSISAC.RetrievedEvents.severity
      description: The severity assigned to the MS-ISAC alert.
      type: string
  - name: msisac-get-alert
    arguments:
    - description: The ID of the MS-ISAC alert.
      name: alert_id
    description: Retrieve alert data by its ID.
    outputs:
    - contextPath: MSISAC.Alert.alertId
      description: The id for this alert.
      type: string
    - contextPath: MSISAC.Alert.affectedIp
      description: The internal IP that is associated with the traffic.
      type: string
    - contextPath: MSISAC.Alert.alertedAt
      description: The timestamp when the alert happened.
      type: string
    - contextPath: MSISAC.Alert.applicationProtocol
      description: The protocol associated with the traffic.
      type: string
    - contextPath: MSISAC.Alert.category
      description: The category of the alert.
      type: string
    - contextPath: MSISAC.Alert.createdAt
      description: The timestamp when the alert was created.
      type: string
    - contextPath: MSISAC.Alert.destinationIp
      description: The destination IP of the traffic.
      type: string
    - contextPath: MSISAC.Alert.destinationPort
      description: The destination port number of the traffic.
      type: number
    - contextPath: MSISAC.Alert.encodedPayload
      description: The encoded payload of the traffic.
      type: string
    - contextPath: MSISAC.Alert.httpHostname
      description: The HTTP hostname of the traffic.
      type: string
    - contextPath: MSISAC.Alert.httpMethod
      description: The HTTP method of the traffic.
      type: string
    - contextPath: MSISAC.Alert.httpStatus
      description: The HTTP status code of the traffic.
      type: number
    - contextPath: MSISAC.Alert.httpUrl
      description: The HTTP url of the traffic.
      type: string
    - contextPath: MSISAC.Alert.logicalSensor
      description: The name for the sensor that triggered the event.
      type: string
    - contextPath: MSISAC.Alert.mitreTactic
      description: The mitre tactic associated with the traffic.
      type: string
    - contextPath: MSISAC.Alert.mitreTechnique
      description: The mitre technique associated with the traffic.
      type: string
    - contextPath: MSISAC.Alert.signatureDirection
      description: The direction of the traffic flow.
      type: string
    - contextPath: MSISAC.Alert.signatureId
      description: The signature id of the traffic.
      type: number
    - contextPath: MSISAC.Alert.signatureName
      description: The signature name of the traffic.
      type: string
    - contextPath: MSISAC.Alert.sourceIp
      description: The source IP of the traffic.
      type: string
    - contextPath: MSISAC.Alert.sourcePort
      description: The source port number of the traffic.
      type: number
    - contextPath: MSISAC.Alert.transportProtocol
      description: The transport protocol of the traffic.
      type: string
  - name: msisac-retrieve-cases
    arguments:
    - name: timestamp
      description: Needs to be in "2025-07-01T00:00:00" format, in UTC. If no timestamp is given, command will return cases from the last 72 hours.
      required: false
    description: Retrieves a list of MS-ISAC cases since the given timestamp. If no timestamp is given, command will return cases from the last 72 hours.
    outputs:
    - contextPath: MSISAC.RetrievedCases.caseId
      description: ID for the retrieved MS-ISAC case.
      type: string
    - contextPath: MSISAC.RetrievedCases.affectedIp
      description: The internal IP that is associated with the traffic.
      type: string
    - contextPath: MSISAC.RetrievedCases.alertIds
      description: The MSISAC alert ids associated with the case.
      type: list
    - contextPath: MSISAC.RetrievedCases.createdAt
      description: The timestamp when the case was created. This is associated with the timestamp input parameter.
      type: string
    - contextPath: MSISAC.RetrievedCases.logicalSensorName
      description: The name for the sensor that triggered the event.
      type: string
    - contextPath: MSISAC.RetrievedCases.modifiedAt
      description: The timestamp for when the case was last modified.
      type: string
    - contextPath: MSISAC.RetrievedCases.severity
      description: The severity of the case.
      type: string
  dockerimage: demisto/python3:3.12.8.3720084
  isfetch: true
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- No tests (auto formatted)