RecordedFutureASI

Attack Surface Intelligence Risk Rules help security teams take risk and vulnerability prioritization to the next level by helping organizations identify the biggest weaknesses within their attack surface in mere seconds.

Data Enrichment & Threat Intelligence · Recorded Future Attack Surface Intelligence

Details

ID	`RecordedFutureASI`
Provider	Mastercard
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

What does this pack do?

This pack enables security teams to

Access a unified risk management from the most popular SOAR platform.
Visualize to the most critical risks within your organization
Identify security incidents filtered by severity (critical, medium and low)
See the full context of the incident, including CVE id, name, description, and affected hostnames.

Configure RecordedFutureASI in Cortex

Get your Project ID

Log in to SecurityTrails SurfaceBrowser
Go to the Projects page by clicking the Projects link in the top right
Click on the Project that you want to use in XSOAR
Copy the ID from the URL (looks like c1234567-c123-4123-9123-0123456789ab)

Get your API Key

Log in to SecurityTrails SurfaceBrowser
Click the username in the top right corner
Click on Account
Go to API > API Keys
Create a new API key with a note that it is being used for the XSOAR Integration

Setting up the Integration

Parameter	Required
API Key	False
Project ID	True
Min Severity	False
Issue Grouping	False
Expand Issues	False
Fetch incidents	False
Incidents Fetch Interval	False
Incident type	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	False
Max Fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

asi-project-issues-fetch

Fetches all the current or added issues.

Base Command

asi-project-issues-fetch

Input

Argument Name	Description	Required
issues_start	Timestamp to get added issues after	Optional
group_by_host	Whether to group results by host	Optional
expand_issues	Whether to expand grouped host issues by each issue	Optional

Context Output

There is no context output for this command.

Configuration parameters

isFetch — Fetch incidents
apikey — API Key
credentials — API Key
project_id — Project ID (required)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
min_severity — Minimum severity of alerts to fetch
issue_grouping — How to group new issues
expand_issues — Expand grouped By Host rules into separate Incidents (applicable if grouping By Host)
max_fetch — Fetch limit
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)

Commands (1)

asi-project-issues-fetch
Gets the issues for a project from a particular snapshot (defaults to recent).

Source

RecordedFutureASI.py RecordedFutureASI_test.py RecordedFutureASI.yml RecordedFutureASI_description.md command_examples.txt

Download History Raw

!asi-project-issues-fetch
!asi-project-issues-fetch issues_start=1646769704
!asi-project-issues-fetch group_by_host=false expand_issues=false
!asi-project-issues-fetch group_by_host=true expand_issues=false
!asi-project-issues-fetch group_by_host=true expand_issues=true