ReliaquestTakedown

Details

ID	`ReliaquestTakedown`
Provider	ReliaQuest
Category	Vulnerability Management
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This is Reliaquest DRP Takedown integration. It enables xsoar user to create and manage takedowns.
This integration was integrated and tested with version 6.9.0 of ReliaquestTakedown.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure ReliaquestTakedown in Cortex

Parameter	Description	Required
DS SearchLight API URL	Enter the Digital Shadows SearchLight API URL.	True
Account ID	Account ID associated with this account.	True
API Key	Enter the API Key for this account.	True
API Secret	Enter the API Secret for this account.	True
Trust any certificate (not secure)	Verify certificate.	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in “%Y-%m-%d %H:%M:%S” format)	First fetch	False
Fetch Limit	The maximum number of takedown to fetch.	True
Takedown	This controls how often the integration will perform a fetch takwdown command.	False
Incident type		False
Fetch incidents		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rq-takedown-create

Create takedown command takes brand id, type, target and portal shortcode (optional) and returns the created takedown in response.

Base Command

rq-takedown-create

Input

Argument Name	Description	Required
brand_id	Brand Id.	Required
type	Takedown Type.	Required
target	Target URL.	Required
portal_id	Portal shortcode.	Optional

Context Output

There is no context output for this command.

rq-takedown-list-brand

Returns list of allowed brand details for takedown.

Base Command

rq-takedown-list-brand

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

rq-takedown-create-comment

Create comment for a takedown.

Base Command

rq-takedown-create-comment

Input

Argument Name	Description	Required
comment	Comment for takedown. Default is Investigate the tekedown.	Required
takedown_id	Takedown id. Default is UUID.	Required

Context Output

There is no context output for this command.

rq-takedown-upload-attachment

Uploads attachment for takedown.

Base Command

rq-takedown-upload-attachment

Input

Argument Name	Description	Required
file_id	No description provided.	Required
takedown_id	No description provided.	Required

Context Output

There is no context output for this command.

rq-takedown-download-attachment

Downloads attachment for takedown.

Base Command

rq-takedown-download-attachment

Input

Argument Name	Description	Required
attachment_id	No description provided.	Required

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and ReliaquestTakedown corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and ReliaquestTakedown.

Configuration parameters

searchLightUrl — DS SearchLight API URL (required)
accountId — Account ID (required)
apiKey — (required)
apiSecret — (required)
insecure — Trust any certificate (not secure)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in "%Y-%m-%d %H:%M:%S" format)
max_fetch — Fetch Limit (required)
incidentFetchInterval — Takedown
incidentType — Incident type
isFetch — Fetch incidents

Commands (5)

rq-takedown-create
Create takedown command takes brand id, type, target and portal shortcode (optional) and returns the created takedown in response.
rq-takedown-create-comment
Create comment for a takedown.
rq-takedown-download-attachment
Downloads attachment for takedown.
rq-takedown-list-brand
Returns list of allowed brand details for takedown.
rq-takedown-upload-attachment
Uploads attachment for takedown.

Source

ReliaquestTakedown.py ReliaquestTakedown_test.py ReliaquestTakedown.yml ReliaquestTakedown_description.md

Download History Raw

category: Vulnerability Management
provider: ReliaQuest
commonfields:
  id: ReliaquestTakedown
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: Enter the Digital Shadows SearchLight API URL.
  defaultvalue: https://api.searchlight.app
  display: DS SearchLight API URL
  name: searchLightUrl
  required: true
  type: 0
  section: Connect
- additionalinfo: Account ID associated with this account.
  display: Account ID
  name: accountId
  required: true
  type: 0
  section: Connect
- additionalinfo: Enter the API Key for this account.
  display: ""
  displaypassword: API Key
  hiddenusername: true
  name: apiKey
  required: true
  type: 9
  section: Connect
- additionalinfo: Enter the API Secret for this account.
  display: ""
  displaypassword: API Secret
  hiddenusername: true
  name: apiSecret
  required: true
  type: 9
  section: Connect
- additionalinfo: Verify certificate.
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- additionalinfo: First fetch
  defaultvalue: 2 years
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in "%Y-%m-%d %H:%M:%S" format)
  name: first_fetch
  required: false
  type: 0
  section: Connect
- additionalinfo: The maximum number of takedown to fetch.
  defaultvalue: "50"
  display: Fetch Limit
  name: max_fetch
  required: true
  type: 0
  section: Collect
- additionalinfo: This controls how often the integration will perform a fetch takwdown command.
  defaultvalue: "1"
  display: Takedown
  name: incidentFetchInterval
  required: false
  type: 19
  section: Connect
- display: Incident type
  name: incidentType
  required: false
  type: 13
  section: Connect
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Connect
description: This is Reliaquest DRP Takedown integration. It enables xsoar user to create and manage takedowns.
display: ReliaquestTakedown
name: ReliaquestTakedown
script:
  commands:
  - arguments:
    - description: Brand Id.
      name: brand_id
      required: true
    - description: Takedown Type.
      name: type
      required: true
    - description: Target URL.
      name: target
      required: true
    - description: Portal shortcode.
      name: portal_id
    description: Create takedown command takes brand id, type, target and portal shortcode (optional) and returns the created takedown in response.
    name: rq-takedown-create
  - arguments: []
    description: Returns list of allowed brand details for takedown.
    name: rq-takedown-list-brand
  - arguments:
    - defaultValue: Investigate the takedown
      description: Comment for takedown.
      name: comment
      required: true
    - defaultValue: UUID
      description: Takedown id.
      name: takedown_id
      required: true
    description: Create comment for a takedown.
    name: rq-takedown-create-comment
  - arguments:
    - name: file_id
      description: File id.
      required: true
    - name: takedown_id
      description: Takedown id.
      required: true
    description: Uploads attachment for takedown.
    name: rq-takedown-upload-attachment
  - arguments:
    - name: attachment_id
      description: Attachment id.
      required: true
    description: Downloads attachment for takedown.
    name: rq-takedown-download-attachment
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: ''
  subtype: python3
  type: python
  isfetch: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 6.9.0
defaultmapperin: Reliaquest Takedown Mapper
defaultclassifier: Reliaquest Takedown Classifier
tests:
- ReliaquestTakedown_test.py