SecurityIntelligenceServicesFeed

A PassiveTotal with Security Intelligence Services Feed provides you with newly observed Domain, Malware, Phishing, Content and Scam Blacklist with Hourly ingestion available.

Data Enrichment & Threat Intelligence · Security Intelligence Services Feed · Feed

Details

IDSecurityIntelligenceServicesFeed
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/boto3py3:1.0.0.10221838
Supported ModulesAgentix XSIAM

README

A PassiveTotal with Security Intelligence Services Feed provides you with newly observed Domain, Malware, Phishing, Content, and Scam Blacklist with Hourly ingestion available.
This integration was integrated and tested with version 1.0 of Security Intelligence Services Feed.

The XSOAR instance with ElasticSearch is required as this integration would ingest large amount of indicators from SIS to XSOAR.

For that same reason, in case this integration fails to fetch indicators with timeout error, the feedIntegrationScript.timeout configuration should be configured with value 45 or more.

Configure Security Intelligence Services Feed in Cortex

Parameter Description Required
accessKey S3 Access Key True
secretKey S3 Secret Key True
feedType Feed Type True
feed Fetch indicators False
feedReputation Indicator Reputation False
feedReliability Source Reliability True
tlp_color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp False
feedExpirationPolicy   False
feedExpirationInterval   False
feedFetchInterval Feed Fetch Interval False
feedTags Tags False
MaxIndicators Max Indicators Per Interval True
firstFetchInterval First Fetch Time Range (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) True
feedBypassExclusionList Bypass exclusion list False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

sis-get-indicators

Gets indicators from Security Intelligence Services feed. Note- Indicators will fetch from the latest found object.

Base Command

sis-get-indicators

Input

Argument Name Description Required
limit The maximum number of indicators to return from S3. Note- The maximum limit supported is 1000. Optional
feed_type Indicators will be fetched based on feed_type. Optional
search Indicators that match the given search pattern will be fetched. Optional

Context Output

There is no context output for this command.

Command Example

!sis-get-indicators limit=2 type=Domain

Human Readable Output

Total indicators fetched: 2

Indicators from Security Intelligence Services feed

Value Type
0363059571.online Domain
0363059571.xyz Domain

Configuration parameters

  • accessKey — S3 Access Key (required)
  • secretKey — S3 Secret Key (required)
  • feedType — Feed Type (required)
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedTags — Tags
  • firstFetchInterval — First Fetch Time Range (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) (required)
  • feedBypassExclusionList — Bypass exclusion list
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • sis-get-indicators

    Gets indicators from Security Intelligence Services feed. Note- Indicators will fetch from the latest found object.

Source

SecurityIntelligenceServicesFeed.py SecurityIntelligenceServicesFeed_test.py SecurityIntelligenceServicesFeed.yml SecurityIntelligenceServicesFeed_description.md
Download History Raw 
### Get access to RiskIQ Security Intelligence Services Feed

* RiskIQ Security Intelligence Services requires an existing enterprise contract in order to function. More specifically, clients need to be licensed for at least one or all of the Attack Analytics modules.
* Existing clients can use their API keys in order to enable the functionality within XSOAR. If API keys are unknown or have been misplaced, clients can contact their account representative directly or send an email to **support@riskiq.com**.


### Fetch Indicators
* The XSOAR instance with **ElasticSearch** is required as this integration would ingest large amount of indicators from SIS to XSOAR.
* Every interval one S3 file will be ingested if found for each given feed type.
* Set Feed Fetch Interval based on the total number of selected Feed Type.
* If you face error related to **Docker Timeout**,  Set or increase **feedintregrationscript.timeout** parameter in configuration (Settings > About > Troubleshooting  > Server Configuration).