Sixgill_DVE_Feed Deprecated

Deprecated. Use Cybersixgill DVE Feed Threat Intelligence v2 from the Cybersixgill-DVE pack instead.
Data Enrichment & Threat Intelligence · Sixgill Darkfeed - Annual Subscription · Feed
Details

ID	`Sixgill_DVE_Feed`
Provider	BitSight
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/sixgill:1.0.0.4887903`
Supported Modules	Agentix XSIAM
README

Deprecated. Use the Cybersixgill DVE Feed Threat Intelligence integration instead.
Powered by the broadest automated collection from the deep and dark web, Cybersixgill’s DVE Score is a feed of common known vulnerabilities, scored by their probability of getting exploited. The DVE Score feed enables Cortex XSOAR users to track threats from vulnerabilities that others define as irrelevant, but have a higher probability of being exploited. It is the only solution that predicts the immediate risks of a vulnerability based on threat actors’ intent.
DVE Score is also the most comprehensive CVE enrichment solution on the market: Cortex XSOAR users gain unparalleled context and can accelerate threat response and decision making, effectively giving security teams a head start on vulnerability management.
Anticipate the exploitation of a vulnerability up to 90 days in advance
Track threats from CVEs that most others define as irrelevant or obsolete, but a higher probability of being exploited by active cyber threat actors.
Gain visibility as well as the ability to prioritize and articulate the remediation process across the organization - straight from Cortex XSOAR
To obtain access to Cybersixgill DVE Score feed via Cortex XSOAR, please contact Cybersixgill at getstarted@cybersixgill.com.
Configure Sixgill_DVE_Feed in Cortex

Parameter	Description	Required
Client Id	Sixgill API client ID.	True
Client Secret	Sixgill API client secret.	True
Trust any certificate (not secure)	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp	False
Fetch indicators		False
Feed Fetch Interval		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed	False
Bypass exclusion list		False
Tags	Supports CSV values.	False
Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cybersixgill-get-indicators

Fetching Sixgill DVE Feed indicators
Base Command

cybersixgill-get-indicators
Input

Argument Name	Description	Required
limit	The number of records to display in War Room. Default is 5.	Optional
Context Output

There is no context output for this command.
Command Example

``````
Human Readable Output

Configuration parameters

client_id — Client Id (required)
client_secret — Client Secret (required)
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
maxIndicators — The maximum number of indicators to fetch.
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
feedIncremental — Incremental Feed
insecure — Trust any certificate (not secure)
feedTags — Tags
Commands (1)

cybersixgill-get-indicators
Fetching Sixgill DVE Feed indicators.
Source

SixgillDVEFeed.py SixgillDVEFeed_test.py SixgillDVEFeed.yml SixgillDVEFeed_description.md
Download History Raw
import requests
import pytest
import json

import demistomock as demisto

bundle_index = 0
submitted_indicators = 0
mocked_get_token_response = """{"access_token": "fababfafbh"}"""
iocs_bundle = [
    {
        "id": "bundle--f00374ec-429c-40cb-b7bb-61f920814775",
        "objects": [
            {
                "created": "2017-01-20T00:00:00.000Z",
                "definition": {"tlp": "amber"},
                "definition_type": "tlp",
                "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                "type": "marking-definition",
            },
            {
                "created": "2019-12-26T00:00:00Z",
                "definition": {"statement": "Copyright Sixgill 2020. All rights reserved."},
                "definition_type": "statement",
                "id": "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "type": "marking-definition",
            },
            {
                "created": "2020-09-06T20:33:33.538Z",
                "external_references": [{"external_id": "CVE-2020-15392", "source_name": "cve"}],
                "id": "cveevent--a26f4710-0d64-4a76-ae27-6ac038e7536b",
                "modified": "2020-09-06T20:33:33.538Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f1f17164731b1cef86c8aaf",
                        "action": "trend",
                        "description": "Trend of Github commits related to CVE-2020-15392",
                        "event_datetime": "2020-06-30T00:00Z",
                        "name": "trend_Github_commits",
                        "prev_level": "prev_level",
                        "type": "github_authoring",
                    },
                    "nvd": {
                        "base_score_v3": 5.3,
                        "base_severity_v3": "MEDIUM",
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-15392",
                        "modified": "2020-07-15T16:52Z",
                        "published": "2020-07-07T14:15Z",
                        "score_2_0": 5.0,
                        "severity_2_0": "MEDIUM",
                        "vector_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                        "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                    },
                    "score": {
                        "current": 0.02,
                        "highest": {"date": "2020-07-27T00:00Z", "value": 0.02},
                        "previouslyExploited": 0.07,
                    },
                },
            },
            {
                "created": "2020-08-19T23:08:05.709Z",
                "external_references": [{"external_id": "CVE-2020-2021", "source_name": "cve"}],
                "id": "cveevent--9c735811-6e08-44d8-a844-75acb10d79b9",
                "modified": "2020-08-19T23:08:05.709Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f3db0ec3ecfe5a6d70b6245",
                        "action": "trend",
                        "description": "CVE-2020-2021 is trending on Twitter.",
                        "event_datetime": "2020-06-30T00:00Z",
                        "name": "trend_Twitter",
                        "prev_level": "prev_level",
                        "type": "dark_mention",
                    },
                    "nvd": {
                        "base_score_v3": 10.0,
                        "base_severity_v3": "CRITICAL",
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-2021",
                        "modified": "2020-07-06T14:39Z",
                        "published": "2020-06-29T15:15Z",
                        "score_2_0": 9.3,
                        "severity_2_0": "HIGH",
                        "vector_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                        "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                    },
                    "score": {
                        "current": 9.13,
                        "highest": {"date": "2020-07-14T00:00Z", "value": 9.25},
                        "previouslyExploited": 5.32,
                    },
                },
            },
            {
                "created": "2020-08-19T23:08:05.709Z",
                "external_references": [{"external_id": "CVE-2020-12828", "source_name": "cve"}],
                "id": "cveevent--dffdcd6b-2157-4652-b7eb-4ce4bb9eebc5",
                "modified": "2020-08-19T23:08:05.709Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f3db0ec3ecfe5a6d70b6274",
                        "action": "trend",
                        "description": "CVE-2020-12828 is trending on Twitter.",
                        "event_datetime": "2020-06-30T00:00Z",
                        "name": "trend_Twitter",
                        "prev_level": "prev_level",
                        "type": "dark_mention",
                    },
                    "nvd": {
                        "base_score_v3": 9.8,
                        "base_severity_v3": "CRITICAL",
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-12828",
                        "modified": "2020-06-02T16:55Z",
                        "published": "2020-05-21T17:15Z",
                        "score_2_0": 10.0,
                        "severity_2_0": "HIGH",
                        "vector_v2": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                        "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    },
                    "score": {
                        "current": 8.33,
                        "highest": {"date": "2020-07-25T00:00Z", "value": 8.4},
                        "previouslyExploited": 5.07,
                    },
                },
            },
            {
                "created": "2020-08-19T23:08:05.709Z",
                "external_references": [{"external_id": "CVE-2020-9771", "source_name": "cve"}],
                "id": "cveevent--4b86077c-99f6-42ca-8b4d-953411fa17bd",
                "modified": "2020-08-19T23:08:05.709Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f3db0ec3ecfe5a6d70b627c",
                        "action": "trend",
                        "description": "CVE-2020-9771 is trending on Twitter.",
                        "event_datetime": "2020-06-30T00:00Z",
                        "name": "trend_Twitter",
                        "prev_level": "prev_level",
                        "type": "dark_mention",
                    },
                    "nvd": {
                        "base_score_v3": None,
                        "base_severity_v3": None,
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-9771",
                        "modified": None,
                        "published": None,
                        "score_2_0": None,
                        "severity_2_0": None,
                        "vector_v2": "None",
                        "vector_v3": "None",
                    },
                    "score": {"current": None, "highest": {"date": None, "value": None}, "previouslyExploited": None},
                },
            },
            {
                "created": "2020-08-25T17:16:52.536Z",
                "external_references": [{"external_id": "CVE-2015-6086", "source_name": "cve"}],
                "id": "cveevent--1d6320f1-8b22-48e2-876d-5e31b9d36288",
                "modified": "2020-08-25T17:16:52.536Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f454784ffebcfa91197c9d0",
                        "action": "modified",
                        "description": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
                        "event_datetime": "2020-06-30T00:00Z",
                        "level": "None",
                        "name": "Sixgill_score_level_change",
                        "prev_level": "prev_level",
                        "type": "score_level",
                    },
                    "nvd": {
                        "base_score_v3": None,
                        "base_severity_v3": None,
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
                        "modified": "2018-10-12T22:10Z",
                        "published": "2015-11-11T12:59Z",
                        "score_2_0": 4.3,
                        "severity_2_0": "MEDIUM",
                        "vector_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                        "vector_v3": "None",
                    },
                    "score": {
                        "current": None,
                        "highest": {"date": "2016-04-14T00:00Z", "value": 7.02},
                        "previouslyExploited": 1.51,
                    },
                },
            },
            {
                "created": "2020-08-25T17:16:52.536Z",
                "external_references": [{"external_id": "CVE-2015-6086", "source_name": "cve"}],
                "id": "cveevent--1d6320f1-8b22-48e2-876d-5e31b9d36288",
                "modified": "2020-08-25T17:16:52.536Z",
                "object_marking_refs": [
                    "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                    "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                ],
                "spec_version": "2.0",
                "type": "x-cybersixgill-com-cve-event",
                "x_sixgill_info": {
                    "event": {
                        "_id": "5f454784ffebcfa91197c9d0",
                        "action": "modified",
                        "description": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
                        "event_datetime": "2020-06-30T00:00Z",
                        "level": "None",
                        "name": "Sixgill_score_level_change",
                        "prev_level": "prev_level",
                        "type": "score_level",
                    },
                    "nvd": {
                        "base_score_v3": None,
                        "base_severity_v3": None,
                        "link": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
                        "modified": "2018-10-12T22:10Z",
                        "published": "2015-11-11T12:59Z",
                        "score_2_0": 4.3,
                        "severity_2_0": "MEDIUM",
                        "vector_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                        "vector_v3": "None",
                    },
                    "score": {
                        "current": None,
                        "highest": {"date": "2016-04-14T00:00Z", "value": 7.02},
                        "previouslyExploited": 1.51,
                    },
                },
            },
        ],
        "spec_version": "2.0",
        "type": "bundle",
    },
    {
        "id": "bundle--f00374ec-429c-40cb-b7bb-61f920814775",
        "objects": [
            {
                "created": "2017-01-20T00:00:00.000Z",
                "definition": {"tlp": "amber"},
                "definition_type": "tlp",
                "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
                "type": "marking-definition",
            },
            {
                "created": "2019-12-26T00:00:00Z",
                "definition": {"statement": "Copyright Sixgill 2020. All rights reserved."},
                "definition_type": "statement",
                "id": "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "type": "marking-definition",
            },
        ],
        "spec_version": "2.0",
        "type": "bundle",
    },
]

expected_ioc_output = [
    {
        "value": "CVE-2020-15392",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2020-15392",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-09-06T20:33:33.538Z",
            "external_references": [{"external_id": "CVE-2020-15392", "source_name": "cve"}],
            "id": "cveevent--a26f4710-0d64-4a76-ae27-6ac038e7536b",
            "modified": "2020-09-06T20:33:33.538Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f1f17164731b1cef86c8aaf",
                    "action": "trend",
                    "description": "Trend of Github commits related to CVE-2020-15392",
                    "event_datetime": "2020-06-30T00:00Z",
                    "name": "trend_Github_commits",
                    "prev_level": "prev_level",
                    "type": "github_authoring",
                },
                "nvd": {
                    "base_score_v3": 5.3,
                    "base_severity_v3": "MEDIUM",
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-15392",
                    "modified": "2020-07-15T16:52Z",
                    "published": "2020-07-07T14:15Z",
                    "score_2_0": 5.0,
                    "severity_2_0": "MEDIUM",
                    "vector_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                    "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                },
                "score": {
                    "current": 0.02,
                    "highest": {"date": "2020-07-27T00:00Z", "value": 0.02},
                    "previouslyExploited": 0.07,
                },
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: Trend of Github commits related to CVE-2020-15392
Created: 2020-09-06T20:33:33.538Z
Modified: 2020-09-06T20:33:33.538Z
External id: CVE-2020-15392
Sixgill DVE score - current: 0.02
Sixgill DVE score - highest ever date: 2020-07-27T00:00Z
Sixgill DVE score - highest ever: 0.02
Sixgill - Previously exploited probability: 0.07
Event Name: trend_Github_commits
Event Type: github_authoring
Event Action: trend
Previous level: prev_level
Event Description: Trend of Github commits related to CVE-2020-15392
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: 5.3
CVSS 3.1 severity: MEDIUM
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-15392
NVD - last modified date: 2020-07-15T16:52Z
NVD - publication date: 2020-07-07T14:15Z
CVSS 2.0 score: 5.0
CVSS 2.0 severity: MEDIUM
NVD Vector - V2.0: AV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Vector - V3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
""",
            "creationdate": "2020-09-06T20:33:33.538Z",
            "modified": "2020-09-06T20:33:33.538Z",
            "externalid": "CVE-2020-15392",
            "sixgilldvescorecurrent": 0.02,
            "sixgilldvescorehighesteverdate": "2020-07-27T00:00Z",
            "sixgilldvescorehighestever": 0.02,
            "sixgillpreviouslyexploitedprobability": 0.07,
            "eventname": "trend_Github_commits",
            "eventtype": "github_authoring",
            "eventaction": "trend",
            "previouslevel": "prev_level",
            "eventdescription": "Trend of Github commits related to CVE-2020-15392",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": 5.3,
            "cvss31severity": "MEDIUM",
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2020-15392",
            "nvdlastmodifieddate": "2020-07-15T16:52Z",
            "nvdpublicationdate": "2020-07-07T14:15Z",
            "cvss20score": 5.0,
            "cvss20severity": "MEDIUM",
            "nvdvectorv20": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "nvdvectorv31": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        },
    },
    {
        "value": "CVE-2020-2021",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2020-2021",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-08-19T23:08:05.709Z",
            "external_references": [{"external_id": "CVE-2020-2021", "source_name": "cve"}],
            "id": "cveevent--9c735811-6e08-44d8-a844-75acb10d79b9",
            "modified": "2020-08-19T23:08:05.709Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f3db0ec3ecfe5a6d70b6245",
                    "action": "trend",
                    "description": "CVE-2020-2021 is trending on Twitter.",
                    "event_datetime": "2020-06-30T00:00Z",
                    "name": "trend_Twitter",
                    "prev_level": "prev_level",
                    "type": "dark_mention",
                },
                "nvd": {
                    "base_score_v3": 10,
                    "base_severity_v3": "CRITICAL",
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-2021",
                    "modified": "2020-07-06T14:39Z",
                    "published": "2020-06-29T15:15Z",
                    "score_2_0": 9.3,
                    "severity_2_0": "HIGH",
                    "vector_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                    "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                },
                "score": {
                    "current": 9.13,
                    "highest": {"date": "2020-07-14T00:00Z", "value": 9.25},
                    "previouslyExploited": 5.32,
                },
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: CVE-2020-2021 is trending on Twitter.
Created: 2020-08-19T23:08:05.709Z
Modified: 2020-08-19T23:08:05.709Z
External id: CVE-2020-2021
Sixgill DVE score - current: 9.13
Sixgill DVE score - highest ever date: 2020-07-14T00:00Z
Sixgill DVE score - highest ever: 9.25
Sixgill - Previously exploited probability: 5.32
Event Name: trend_Twitter
Event Type: dark_mention
Event Action: trend
Previous level: prev_level
Event Description: CVE-2020-2021 is trending on Twitter.
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: 10.0
CVSS 3.1 severity: CRITICAL
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-2021
NVD - last modified date: 2020-07-06T14:39Z
NVD - publication date: 2020-06-29T15:15Z
CVSS 2.0 score: 9.3
CVSS 2.0 severity: HIGH
NVD Vector - V2.0: AV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Vector - V3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
""",
            "creationdate": "2020-08-19T23:08:05.709Z",
            "modified": "2020-08-19T23:08:05.709Z",
            "externalid": "CVE-2020-2021",
            "sixgilldvescorecurrent": 9.13,
            "sixgilldvescorehighesteverdate": "2020-07-14T00:00Z",
            "sixgilldvescorehighestever": 9.25,
            "sixgillpreviouslyexploitedprobability": 5.32,
            "eventname": "trend_Twitter",
            "eventtype": "dark_mention",
            "eventaction": "trend",
            "previouslevel": "prev_level",
            "eventdescription": "CVE-2020-2021 is trending on Twitter.",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": 10.0,
            "cvss31severity": "CRITICAL",
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2020-2021",
            "nvdlastmodifieddate": "2020-07-06T14:39Z",
            "nvdpublicationdate": "2020-06-29T15:15Z",
            "cvss20score": 9.3,
            "cvss20severity": "HIGH",
            "nvdvectorv20": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "nvdvectorv31": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        },
    },
    {
        "value": "CVE-2020-12828",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2020-12828",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-08-19T23:08:05.709Z",
            "external_references": [{"external_id": "CVE-2020-12828", "source_name": "cve"}],
            "id": "cveevent--dffdcd6b-2157-4652-b7eb-4ce4bb9eebc5",
            "modified": "2020-08-19T23:08:05.709Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f3db0ec3ecfe5a6d70b6274",
                    "action": "trend",
                    "description": "CVE-2020-12828 is trending on Twitter.",
                    "event_datetime": "2020-06-30T00:00Z",
                    "name": "trend_Twitter",
                    "prev_level": "prev_level",
                    "type": "dark_mention",
                },
                "nvd": {
                    "base_score_v3": 9.8,
                    "base_severity_v3": "CRITICAL",
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-12828",
                    "modified": "2020-06-02T16:55Z",
                    "published": "2020-05-21T17:15Z",
                    "score_2_0": 10.0,
                    "severity_2_0": "HIGH",
                    "vector_v2": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                    "vector_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                },
                "score": {
                    "current": 8.33,
                    "highest": {"date": "2020-07-25T00:00Z", "value": 8.4},
                    "previouslyExploited": 5.07,
                },
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: CVE-2020-12828 is trending on Twitter.
Created: 2020-08-19T23:08:05.709Z
Modified: 2020-08-19T23:08:05.709Z
External id: CVE-2020-12828
Sixgill DVE score - current: 8.33
Sixgill DVE score - highest ever date: 2020-07-25T00:00Z
Sixgill DVE score - highest ever: 8.4
Sixgill - Previously exploited probability: 5.07
Event Name: trend_Twitter
Event Type: dark_mention
Event Action: trend
Previous level: prev_level
Event Description: CVE-2020-12828 is trending on Twitter.
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: 9.8
CVSS 3.1 severity: CRITICAL
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-12828
NVD - last modified date: 2020-06-02T16:55Z
NVD - publication date: 2020-05-21T17:15Z
CVSS 2.0 score: 10.0
CVSS 2.0 severity: HIGH
NVD Vector - V2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C
NVD Vector - V3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
""",
            "creationdate": "2020-08-19T23:08:05.709Z",
            "modified": "2020-08-19T23:08:05.709Z",
            "externalid": "CVE-2020-12828",
            "sixgilldvescorecurrent": 8.33,
            "sixgilldvescorehighesteverdate": "2020-07-25T00:00Z",
            "sixgilldvescorehighestever": 8.4,
            "sixgillpreviouslyexploitedprobability": 5.07,
            "eventname": "trend_Twitter",
            "eventtype": "dark_mention",
            "eventaction": "trend",
            "previouslevel": "prev_level",
            "eventdescription": "CVE-2020-12828 is trending on Twitter.",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": 9.8,
            "cvss31severity": "CRITICAL",
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2020-12828",
            "nvdlastmodifieddate": "2020-06-02T16:55Z",
            "nvdpublicationdate": "2020-05-21T17:15Z",
            "cvss20score": 10.0,
            "cvss20severity": "HIGH",
            "nvdvectorv20": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "nvdvectorv31": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        },
    },
    {
        "value": "CVE-2020-9771",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2020-9771",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-08-19T23:08:05.709Z",
            "external_references": [{"external_id": "CVE-2020-9771", "source_name": "cve"}],
            "id": "cveevent--4b86077c-99f6-42ca-8b4d-953411fa17bd",
            "modified": "2020-08-19T23:08:05.709Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f3db0ec3ecfe5a6d70b627c",
                    "action": "trend",
                    "description": "CVE-2020-9771 is trending on Twitter.",
                    "event_datetime": "2020-06-30T00:00Z",
                    "name": "trend_Twitter",
                    "prev_level": "prev_level",
                    "type": "dark_mention",
                },
                "nvd": {
                    "base_score_v3": None,
                    "base_severity_v3": None,
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-9771",
                    "modified": None,
                    "published": None,
                    "score_2_0": None,
                    "severity_2_0": None,
                    "vector_v2": "None",
                    "vector_v3": "None",
                },
                "score": {"current": None, "highest": {"date": None, "value": None}, "previouslyExploited": None},
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: CVE-2020-9771 is trending on Twitter.
Created: 2020-08-19T23:08:05.709Z
Modified: 2020-08-19T23:08:05.709Z
External id: CVE-2020-9771
Sixgill DVE score - current: None
Sixgill DVE score - highest ever date: None
Sixgill DVE score - highest ever: None
Sixgill - Previously exploited probability: None
Event Name: trend_Twitter
Event Type: dark_mention
Event Action: trend
Previous level: prev_level
Event Description: CVE-2020-9771 is trending on Twitter.
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: None
CVSS 3.1 severity: None
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-9771
NVD - last modified date: None
NVD - publication date: None
CVSS 2.0 score: None
CVSS 2.0 severity: None
NVD Vector - V2.0: None
NVD Vector - V3.1: None
""",
            "creationdate": "2020-08-19T23:08:05.709Z",
            "modified": "2020-08-19T23:08:05.709Z",
            "externalid": "CVE-2020-9771",
            "sixgilldvescorecurrent": None,
            "sixgilldvescorehighesteverdate": None,
            "sixgilldvescorehighestever": None,
            "sixgillpreviouslyexploitedprobability": None,
            "eventname": "trend_Twitter",
            "eventtype": "dark_mention",
            "eventaction": "trend",
            "previouslevel": "prev_level",
            "eventdescription": "CVE-2020-9771 is trending on Twitter.",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": None,
            "cvss31severity": None,
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9771",
            "nvdlastmodifieddate": None,
            "nvdpublicationdate": None,
            "cvss20score": None,
            "cvss20severity": None,
            "nvdvectorv20": "None",
            "nvdvectorv31": "None",
        },
    },
    {
        "value": "CVE-2015-6086",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2015-6086",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-08-25T17:16:52.536Z",
            "external_references": [{"external_id": "CVE-2015-6086", "source_name": "cve"}],
            "id": "cveevent--1d6320f1-8b22-48e2-876d-5e31b9d36288",
            "modified": "2020-08-25T17:16:52.536Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f454784ffebcfa91197c9d0",
                    "action": "modified",
                    "description": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
                    "event_datetime": "2020-06-30T00:00Z",
                    "level": "None",
                    "name": "Sixgill_score_level_change",
                    "prev_level": "prev_level",
                    "type": "score_level",
                },
                "nvd": {
                    "base_score_v3": None,
                    "base_severity_v3": None,
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
                    "modified": "2018-10-12T22:10Z",
                    "published": "2015-11-11T12:59Z",
                    "score_2_0": 4.3,
                    "severity_2_0": "MEDIUM",
                    "vector_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                    "vector_v3": "None",
                },
                "score": {
                    "current": None,
                    "highest": {"date": "2016-04-14T00:00Z", "value": 7.02},
                    "previouslyExploited": 1.51,
                },
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: Sixgill Current score of CVE-2015-6086 changed from Low to None.
Created: 2020-08-25T17:16:52.536Z
Modified: 2020-08-25T17:16:52.536Z
External id: CVE-2015-6086
Sixgill DVE score - current: None
Sixgill DVE score - highest ever date: 2016-04-14T00:00Z
Sixgill DVE score - highest ever: 7.02
Sixgill - Previously exploited probability: 1.51
Event Name: Sixgill_score_level_change
Event Type: score_level
Event Action: modified
Previous level: prev_level
Event Description: Sixgill Current score of CVE-2015-6086 changed from Low to None.
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: None
CVSS 3.1 severity: None
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2015-6086
NVD - last modified date: 2018-10-12T22:10Z
NVD - publication date: 2015-11-11T12:59Z
CVSS 2.0 score: 4.3
CVSS 2.0 severity: MEDIUM
NVD Vector - V2.0: AV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Vector - V3.1: None
""",
            "creationdate": "2020-08-25T17:16:52.536Z",
            "modified": "2020-08-25T17:16:52.536Z",
            "externalid": "CVE-2015-6086",
            "sixgilldvescorecurrent": None,
            "sixgilldvescorehighesteverdate": "2016-04-14T00:00Z",
            "sixgilldvescorehighestever": 7.02,
            "sixgillpreviouslyexploitedprobability": 1.51,
            "eventname": "Sixgill_score_level_change",
            "eventtype": "score_level",
            "eventaction": "modified",
            "previouslevel": "prev_level",
            "eventdescription": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": None,
            "cvss31severity": None,
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
            "nvdlastmodifieddate": "2018-10-12T22:10Z",
            "nvdpublicationdate": "2015-11-11T12:59Z",
            "cvss20score": 4.3,
            "cvss20severity": "MEDIUM",
            "nvdvectorv20": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "nvdvectorv31": "None",
        },
    },
    {
        "value": "CVE-2015-6086",
        "type": "CVE",
        "rawJSON": {
            "value": "CVE-2015-6086",
            "type": "x-cybersixgill-com-cve-event",
            "created": "2020-08-25T17:16:52.536Z",
            "external_references": [{"external_id": "CVE-2015-6086", "source_name": "cve"}],
            "id": "cveevent--1d6320f1-8b22-48e2-876d-5e31b9d36288",
            "modified": "2020-08-25T17:16:52.536Z",
            "object_marking_refs": [
                "marking-definition--41eaaf7c-0bc0-4c56-abdf-d89a7f096ac4",
                "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
            ],
            "spec_version": "2.0",
            "x_sixgill_info": {
                "event": {
                    "_id": "5f454784ffebcfa91197c9d0",
                    "action": "modified",
                    "description": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
                    "event_datetime": "2020-06-30T00:00Z",
                    "level": "None",
                    "name": "Sixgill_score_level_change",
                    "prev_level": "prev_level",
                    "type": "score_level",
                },
                "nvd": {
                    "base_score_v3": None,
                    "base_severity_v3": None,
                    "link": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
                    "modified": "2018-10-12T22:10Z",
                    "published": "2015-11-11T12:59Z",
                    "score_2_0": 4.3,
                    "severity_2_0": "MEDIUM",
                    "vector_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                    "vector_v3": "None",
                },
                "score": {
                    "current": None,
                    "highest": {"date": "2016-04-14T00:00Z", "value": 7.02},
                    "previouslyExploited": 1.51,
                },
            },
        },
        "score": "3",
        "fields": {
            "description": """Description: Sixgill Current score of CVE-2015-6086 changed from Low to None.
Created: 2020-08-25T17:16:52.536Z
Modified: 2020-08-25T17:16:52.536Z
External id: CVE-2015-6086
Sixgill DVE score - current: None
Sixgill DVE score - highest ever date: 2016-04-14T00:00Z
Sixgill DVE score - highest ever: 7.02
Sixgill - Previously exploited probability: 1.51
Event Name: Sixgill_score_level_change
Event Type: score_level
Event Action: modified
Previous level: prev_level
Event Description: Sixgill Current score of CVE-2015-6086 changed from Low to None.
Event Datetime: 2020-06-30T00:00Z
CVSS 3.1 score: None
CVSS 3.1 severity: None
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2015-6086
NVD - last modified date: 2018-10-12T22:10Z
NVD - publication date: 2015-11-11T12:59Z
CVSS 2.0 score: 4.3
CVSS 2.0 severity: MEDIUM
NVD Vector - V2.0: AV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Vector - V3.1: None
""",
            "creationdate": "2020-08-25T17:16:52.536Z",
            "modified": "2020-08-25T17:16:52.536Z",
            "externalid": "CVE-2015-6086",
            "sixgilldvescorecurrent": None,
            "sixgilldvescorehighesteverdate": "2016-04-14T00:00Z",
            "sixgilldvescorehighestever": 7.02,
            "sixgillpreviouslyexploitedprobability": 1.51,
            "eventname": "Sixgill_score_level_change",
            "eventtype": "score_level",
            "eventaction": "modified",
            "previouslevel": "prev_level",
            "eventdescription": "Sixgill Current score of CVE-2015-6086 changed from Low to None.",
            "eventdatetime": "2020-06-30T00:00Z",
            "cvss31score": None,
            "cvss31severity": None,
            "nvdlink": "https://nvd.nist.gov/vuln/detail/CVE-2015-6086",
            "nvdlastmodifieddate": "2018-10-12T22:10Z",
            "nvdpublicationdate": "2015-11-11T12:59Z",
            "cvss20score": 4.3,
            "cvss20severity": "MEDIUM",
            "nvdvectorv20": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "nvdvectorv31": "None",
        },
    },
]


class MockedResponse(object):
    def __init__(
        self,
        status_code,
        text,
        reason=None,
        url=None,
        method=None,
    ):
        self.status_code = status_code
        self.text = text
        self.reason = reason
        self.url = url
        self.request = requests.Request("GET")
        self.ok = True if self.status_code == 200 else False

    def json(self):
        return json.loads(self.text)


def init_params():
    return {"client_id": "WRONG_CLIENT_ID_TEST", "client_secret": "CLIENT_SECRET_TEST"}


def mocked_request(*args, **kwargs):
    global bundle_index
    global submitted_indicators

    request = kwargs.get("request", {})
    end_point = request.path_url
    method = request.method
    response_dict = {
        "POST": {
            "/auth/token": MockedResponse(200, mocked_get_token_response),
            "/dvefeed/ioc/ack": MockedResponse(200, str(submitted_indicators)),
        },
        "GET": {"/dvefeed/ioc?limit=1000": MockedResponse(200, json.dumps(iocs_bundle[bundle_index]))},
    }

    response_dict = response_dict.get(method)
    response = response_dict.get(end_point)

    if method == "GET" and end_point == "/dvefeed/ioc?limit=1000":
        submitted_indicators = len(iocs_bundle[bundle_index].get("objects")) - 2
        bundle_index += 1
    return response


def test_test_module_command_raise_exception(mocker):
    mocker.patch.object(demisto, "params", return_value=init_params())
    mocker.patch("requests.sessions.Session.send", return_value=MockedResponse(400, "error"))

    from SixgillDVEFeed import module_command_test

    with pytest.raises(Exception):
        module_command_test()


def test_test_module_command(mocker):
    mocker.patch.object(demisto, "params", return_value=init_params())
    mocker.patch("requests.sessions.Session.send", return_value=MockedResponse(200, "ok"))

    from SixgillDVEFeed import module_command_test

    module_command_test()


def test_fetch_indicators_command(mocker):
    global bundle_index
    global submitted_indicators

    mocker.patch.object(demisto, "params", return_value=init_params())
    mocker.patch("requests.sessions.Session.send", new=mocked_request)

    from SixgillDVEFeed import fetch_indicators_command
    from sixgill.sixgill_feed_client import SixgillFeedClient
    from sixgill.sixgill_constants import FeedStream

    client = SixgillFeedClient(
        "client_id",
        "client_secret",
        "some_channel",
        FeedStream.DVEFEED,
        demisto,
        1000,
    )

    output = fetch_indicators_command(client)

    bundle_index = 0
    submitted_indicators = 0
    assert output == expected_ioc_output


def test_get_indicators_command(mocker):
    global bundle_index
    global submitted_indicators

    mocker.patch.object(demisto, "params", return_value=init_params())
    mocker.patch("requests.sessions.Session.send", new=mocked_request)

    from SixgillDVEFeed import get_indicators_command
    from sixgill.sixgill_feed_client import SixgillFeedClient
    from sixgill.sixgill_constants import FeedStream

    client = SixgillFeedClient(
        "client_id",
        "client_secret",
        "some_channel",
        FeedStream.DVEFEED,
        demisto,
        1000,
    )

    output = get_indicators_command(client, {"limit": 10})
    bundle_index = 0
    submitted_indicators = 0
    assert output[2] == expected_ioc_output


@pytest.mark.parametrize("tlp_color", ["", None, "AMBER"])
def test_feed_tags_and_tlp_color(mocker, tlp_color):
    """
    Given:
    - feedTags parameter
    When:
    - Executing fetch command on feed
    Then:
    - Validate the tags supplied are added to the tags list in addition to the tags that were there before
    """

    global bundle_index
    global submitted_indicators

    mocker.patch.object(demisto, "params", return_value=init_params())
    mocker.patch("requests.sessions.Session.send", new=mocked_request)

    from SixgillDVEFeed import fetch_indicators_command
    from sixgill.sixgill_feed_client import SixgillFeedClient
    from sixgill.sixgill_constants import FeedStream

    client = SixgillFeedClient(
        "client_id",
        "client_secret",
        "some_channel",
        FeedStream.DVEFEED,
        demisto,
        1000,
    )

    output = fetch_indicators_command(client, tags=["tag1", "tag2"], tlp_color=tlp_color)
    assert all(item in output[0]["fields"]["tags"] for item in ["tag1", "tag2"])
    if tlp_color:
        assert output[0]["fields"]["trafficlightprotocol"] == tlp_color
    else:
        assert not output[0]["fields"].get("trafficlightprotocol")
        bundle_index -= 1