Salesforce Indicators

Pull any Salesforce Object as an indicator.

Data Enrichment & Threat Intelligence · Salesforce Indicators · Feed

Details

ID	`Salesforce Indicators`
Provider	Salesforce
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

Configuration parameters

InstanceURL — Instance URL (required)
credentials — Credentials (required)
clientID — Consumer Key (required)
clientSecret — Consumer Secret (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
object — Object Name (required)
date_field — Date Field
key_field — Value Field (required)
filter — Filter
fields — Fields
indicator_history — Indicator History (in days)
feed — Fetch indicators
feedTags — Tags
tlp_color — Traffic Light Protocol Color

Commands (1)

salesforce-get-indicators
Executes the fetch-indicators command

Source

SalesforceIndicators.py SalesforceIndicators.yml SalesforceIndicators_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Salesforce
commonfields:
  id: Salesforce Indicators
  version: -1
configuration:
- defaultvalue: https://login.salesforce.com
  display: Instance URL
  name: InstanceURL
  required: true
  type: 0
- display: Credentials
  name: credentials
  required: true
  type: 9
- display: Consumer Key
  name: clientID
  required: true
  type: 0
- display: Consumer Secret
  name: clientSecret
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: None
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- defaultvalue: never
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- additionalinfo: 'The name of the object type in SFDC to query (example: User)'
  display: Object Name
  name: object
  required: true
  type: 0
- additionalinfo: Whether to use the LastModifiedDate or CreatedDate to find new or changed objects. If nothing is provided, the LastModifiedDate field will be used.
  display: Date Field
  name: date_field
  type: 0
  defaultvalue: LastModifiedDate
  options:
  - LastModifiedDate
  - CreatedDate
  required: false
- additionalinfo: 'The name of the field to use as the value of the indicator (example: Id)'
  display: Value Field
  name: key_field
  required: true
  type: 0
- additionalinfo: 'The SOQL filter to use (example: Id = ''123'' AND Name = ''Test'')'
  display: Filter
  name: filter
  type: 12
  required: false
- additionalinfo: CSV of fields to collect (if not provided, all fields will return)
  display: Fields
  name: fields
  type: 12
  required: false
- defaultvalue: '365'
  display: Indicator History (in days)
  name: indicator_history
  type: 0
  additionalinfo: Specify how far to go back to find created objects, in days. This will only be used if there is no Filter provided above.
  required: false
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
description: Pull any Salesforce Object as an indicator.
display: Salesforce Indicators
name: Salesforce Indicators
script:
  commands:
  - arguments: []
    name: salesforce-get-indicators
    description: Executes the fetch-indicators command
  dockerimage: demisto/python3:3.12.8.3296088
  feed: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)