RecordedFutureASI

Attack Surface Intelligence Risk Rules help security teams take risk and vulnerability prioritization to the next level by helping organizations identify the biggest weaknesses within their attack surface in mere seconds.

Data Enrichment & Threat Intelligence · Recorded Future Attack Surface Intelligence

Details

ID	`RecordedFutureASI`
Provider	Mastercard
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

What does this pack do?

This pack enables security teams to

Access a unified risk management from the most popular SOAR platform.
Visualize to the most critical risks within your organization
Identify security incidents filtered by severity (critical, medium and low)
See the full context of the incident, including CVE id, name, description, and affected hostnames.

Configure RecordedFutureASI in Cortex

Get your Project ID

Log in to SecurityTrails SurfaceBrowser
Go to the Projects page by clicking the Projects link in the top right
Click on the Project that you want to use in XSOAR
Copy the ID from the URL (looks like c1234567-c123-4123-9123-0123456789ab)

Get your API Key

Log in to SecurityTrails SurfaceBrowser
Click the username in the top right corner
Click on Account
Go to API > API Keys
Create a new API key with a note that it is being used for the XSOAR Integration

Setting up the Integration

Parameter	Required
API Key	False
Project ID	True
Min Severity	False
Issue Grouping	False
Expand Issues	False
Fetch incidents	False
Incidents Fetch Interval	False
Incident type	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	False
Max Fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

asi-project-issues-fetch

Fetches all the current or added issues.

Base Command

asi-project-issues-fetch

Input

Argument Name	Description	Required
issues_start	Timestamp to get added issues after	Optional
group_by_host	Whether to group results by host	Optional
expand_issues	Whether to expand grouped host issues by each issue	Optional

Context Output

There is no context output for this command.

Configuration parameters

isFetch — Fetch incidents
apikey — API Key
credentials — API Key
project_id — Project ID (required)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
min_severity — Minimum severity of alerts to fetch
issue_grouping — How to group new issues
expand_issues — Expand grouped By Host rules into separate Incidents (applicable if grouping By Host)
max_fetch — Fetch limit
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)

Commands (1)

asi-project-issues-fetch
Gets the issues for a project from a particular snapshot (defaults to recent).

Source

RecordedFutureASI.py RecordedFutureASI_test.py RecordedFutureASI.yml RecordedFutureASI_description.md command_examples.txt

Download History Raw

commonfields:
  id: RecordedFutureASI
  version: -1
name: RecordedFutureASI
display: Recorded Future Attack Surface Intelligence
category: Data Enrichment & Threat Intelligence
provider: Mastercard
sectionorder:
- Connect
- Collect
description: Attack Surface Intelligence Risk Rules help security teams take risk and vulnerability prioritization to the next level by helping organizations identify the biggest weaknesses within their attack surface in mere seconds.
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: API Key
  name: apikey
  type: 4
  required: false
  hidden: true
  section: Connect
- display: API Key
  name: credentials
  type: 9
  required: false
  displaypassword: API Key
  hiddenusername: true
  section: Connect
- display: Project ID
  name: project_id
  type: 4
  required: true
  additionalinfo: The Project ID to fetch issues from
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: Recorded Future ASI Alert
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 'Informational'
  display: Minimum severity of alerts to fetch
  name: min_severity
  type: 15
  required: false
  options:
  - Informational
  - Moderate
  - Critical
  section: Collect
- display: How to group new issues
  name: issue_grouping
  defaultvalue: "By Issue"
  type: 15
  required: false
  options:
  - By Host
  - By Issue
  section: Collect
- defaultvalue: 'false'
  display: Expand grouped By Host rules into separate Incidents (applicable if grouping By Host)
  name: expand_issues
  type: 8
  required: false
  section: Collect
- additionalinfo: Maximum number of incidents per fetch
  defaultvalue: '200'
  display: Fetch limit
  name: max_fetch
  required: false
  type: 0
  section: Collect
- defaultvalue: 24 hours
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch
  required: false
  type: 0
  section: Collect
script:
  script: '-'
  type: python
  commands:
  - name: asi-project-issues-fetch
    arguments:
    - name: issues_start
      description: timestamp to get incidents after.
    - name: group_by_host
      description: true/false whether to group incidents by changed host.
    - name: expand_issues
      description: true/false to make an incident per host & per new issue.
    description: Gets the issues for a project from a particular snapshot (defaults to recent).
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  subtype: python3
fromversion: 6.5.0
tests:
- No tests (auto formatted)
defaultmapperin: Recorded Future ASI - Incoming Mapper