ReliaQuest GreyMatter DRP Incidents

ReliaQuest GreyMatter DR monitors and manages an organization's digital risk across the widest range of data sources within the open, deep, and dark web.

Data Enrichment & Threat Intelligence · ReliaQuest Digital Risk Protection

Details

ID	`ReliaQuest GreyMatter DRP Incidents`
Provider	ReliaQuest
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

ReliaQuest GreyMatter DR monitors and manages an organization’s digital risk across the widest range of data sources within the open, deep, and dark web.
This integration was integrated and tested with version v1 of ReliaQuest GreyMatter DRP Incidents.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure ReliaQuest GreyMatter DRP Incidents in Cortex

Parameter	Description	Required
Fetch incidents	Start fetching incidents	False
DS SearchLight API URL	Enter the Digital Shadows SearchLight API URL	True
Account ID	Account ID associated with this account.	True
API Key	Enter the API Key for this account.	True
API Secret	Enter the API Secret for this account.	True
Trust any certificate (not secure)	Verify certificate	False
Risk Types	Remove all if you don’t want to select all risk types, and then select specifically	True
Risk Level	Remove all if you don’t want to select all risk types, and then select specifically	False
Ingest Closed / Auto-rejected Alerts	If you don’t want to ingest rejected/resolved/closed incidents then set it to False. Otherwise incidents will ingested with auto-closed=True	False
Fetch Limit	The maximum number of incidents to fetch	True
Incidents Fetch Interval	This controls how often the integration will perform a fetch_incidents command	False
Start date	Since when want to fetch the data with given format(%Y-%m-%dT%H:%M:%SZ)	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ds-search

Perform a general search against incidents, threats closed sources, etc.

Base Command

ds-search

Input

Argument Name	Description	Required
query	No description provided.	Required

Context Output

There is no context output for this command.

Configuration parameters

searchLightUrl — DS SearchLight API URL (required)
accountId — Account ID (required)
apiKey — (required)
apiSecret — (required)
insecure — Trust any certificate (not secure)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in "%Y-%m-%d %H:%M:%S" format)
riskTypes — Risk Types (required)
riskLevel — Risk Level
ingestClosedIncidents — Ingest Closed / Auto-rejected Alerts
max_fetch — Fetch Limit (required)
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
isFetch — Fetch incidents

Commands (1)

ds-search
Perform a general search against incidents, threats closed sources, etc.

Source

ReliaQuestGreyMatterDRPIncidents.py ReliaQuestGreyMatterDRPIncidents_test.py ReliaQuestGreyMatterDRPIncidents.yml ReliaQuestGreyMatterDRPIncidents_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: ReliaQuest
commonfields:
  id: ReliaQuest GreyMatter DRP Incidents
  version: -1
description: ReliaQuest GreyMatter DR monitors and manages an organization's digital risk across the widest range of data sources within the open, deep, and dark web.
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: Enter the Digital Shadows SearchLight API URL
  defaultvalue: https://api.searchlight.app
  display: DS SearchLight API URL
  name: searchLightUrl
  required: true
  type: 0
  section: Connect
- additionalinfo: Account ID associated with this account.
  name: accountId
  display: Account ID
  required: true
  type: 0
  section: Connect
- additionalinfo: Enter the API Key for this account.
  hiddenusername: true
  displaypassword: API Key
  name: apiKey
  required: true
  type: 9
  section: Connect
- additionalinfo: Enter the API Secret for this account.
  hiddenusername: true
  displaypassword: API Secret
  name: apiSecret
  required: true
  type: 9
  section: Connect
- additionalinfo: Verify certificate
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- additionalinfo: First fetch
  defaultvalue: 2 years
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in "%Y-%m-%d %H:%M:%S" format)
  name: first_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: Remove all if you don't want to select  all risk types, and then select specifically
  defaultvalue: all
  display: Risk Types
  name: riskTypes
  options:
  - association-with-malware
  - custom-risk
  - evidence-of-adversary-impact
  - evidence-of-credential-access
  - evidence-of-initial-access
  - evidence-of-reconnaissance
  - evidence-of-resource-development
  - expired-certificate
  - exposed-access-key
  - exposed-cloud-service
  - exposed-commercial-document
  - exposed-credential
  - exposed-customer-account
  - exposed-device
  - exposed-employee-pii
  - exposed-payment-card
  - exposed-technical-document
  - impersonating-company-profile
  - impersonating-domain
  - impersonating-employee-profile
  - impersonating-mobile-app
  - impersonating-subdomain
  - leaked-sensitive-code
  - leaked-sensitive-technology
  - marked-document
  - mention-by-a-threat-actor
  - misconfigured-web-server
  - exposed-port
  - phishing-report
  - phishing-webpage
  - report-of-botnet-activity
  - report-of-technical-vulnerability
  - reported-data-breach
  - revoked-certificate
  - selling-unauthorized-goods
  - unauthorized-code-commit
  - vulnerable-product
  - vulnerable-service
  - weak-certificate
  - all
  required: true
  type: 16
  section: Collect
- additionalinfo: Remove all if you don't want to select  all risk types, and then select specifically
  defaultvalue: all
  display: Risk Level
  name: riskLevel
  options:
  - all
  - none
  - low
  - medium
  - high
  - very-low
  - very-high
  required: false
  type: 16
  section: Collect
- additionalinfo: If you don't want to ingest rejected/resolved/closed incidents then set it to False. Otherwise incidents will ingested with auto-closed=True
  defaultvalue: "true"
  display: Ingest Closed / Auto-rejected Alerts
  name: ingestClosedIncidents
  required: false
  type: 8
  section: Collect
- additionalinfo: The maximum number of incidents to fetch
  defaultvalue: "50"
  display: Fetch Limit
  name: max_fetch
  required: true
  type: 0
  section: Collect
- additionalinfo: This controls how often the integration will perform a fetch_incidents command
  display: Incidents Fetch Interval
  defaultvalue: "1"
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
display: ReliaQuest GreyMatter DRP Incidents
name: ReliaQuest GreyMatter DRP Incidents
script:
  commands:
  - arguments:
    - name: query
      required: true
      description: Query string to search.
    description: Perform a general search against incidents, threats closed sources, etc.
    name: ds-search
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
supportlevelheader: xsoar
defaultmapperin: Reliaquest GreyMatter DRP Incidents Mapper
defaultclassifier: Reliaquest GreyMatter DRP Incidents Classifier
tests:
- No tests (auto formatted)