SpyCloudEnterpriseProtectionFeed

Fetch SpyCloud watchlist data (breach, malware and access records) for daily monitoring, incident response, and mitigation.

Data Enrichment & Threat Intelligence · SpyCloud Enterprise Protection

Details

ID	`SpyCloudEnterpriseProtectionFeed`
Provider	SpyCloud
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM Agentix

README

SpyCloud Enterprise Protection Feed

Create breach, malware and access incidents in Cortex® XSOAR™ using the SpyCloud Enterprise Protection API.
This integration was integrated and tested with version 3.5 of SpyCloud Enterprise Protection API

Configure SpyCloud Enterprise Protection Feed in Cortex

Parameter	Description	Required
API URL	SpyCloud Enterprise Protection API Base URL	True
API Key	SpyCloud Enterprise Protection API Key	True
Fetch incidents	This is a required field by XSOAR to fetch new Watchlist events from SpyCloud watchlist API	True
Since	This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. Example: -1days, now, YYYY-MM-DD.	False
Until	This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. Example: -1days, now, YYYY-MM-DD.	False
Since Modification Date	This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date). Example: -1days, now, YYYY-MM-DD.	False
Until Modification Date	This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). Example: -1days, now, YYYY-MM-DD.	False
Severity	This parameter allows you to filter based on the numeric severity code. The codes map to the following record types: 2 = email_only, 5 = informational, 20 = breach, 25 = malware, 30 = access data. Each selected code creates incidents of the matching SpyCloud incident type.	False
Source ID	This parameter allows you to filter based on a particular breach source.This parameter allows you to filter based on a particular breach source.	False
Salt	If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.	False
Type	This parameter lets you filter results by type. The allowed values are ‘corporate’ for corporate records, and ‘infected’ for infected user records (from botnet data). If no value has been provided the API function will, by default, return all record types.	False
Watchlist Type	This parameters lets you filter results for only emails or only domains on your watchlist. The allowed values are: [‘email’, ‘domain’, ‘subdomain’, ‘ip’]. If no value has been provided, the API will return all watchlist types.	False
Trust any certificate (not secure)	Trust any certificate (not secure)	False
Use system proxy settings	Use system proxy settings	False
Incidents Fetch Interval	Incidents Fetch Interval	False
Incident type	Incident type	False
Domain Search	Please enter the domains to search here, if left empty, your full watchlist will be pulled	False
Fetch Limit	Volume of incidents captured at a single time. By default this is set to 200	False

Configuration parameters

url — API URL (required)
apikey — API Key (required)
isFetch — Fetch incidents (required)
first_fetch — Since
until — Until
since_modification_date — Since Modification Date
until_modification_date — Until Modification Date
severity — Severity
source_id — Source ID
salt — Salt
type — Type
watchlist_type — Watchlist Type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
domain_search — Domain Search
fetch_limit — Fetch Limit

Commands (0)

This integration defines no commands.

Source

SpyCloudEnterpriseProtectionFeed.py SpyCloudEnterpriseProtectionFeed_test.py SpyCloudEnterpriseProtectionFeed.yml SpyCloudEnterpriseProtectionFeed_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: SpyCloud
sectionorder:
  - Connect
  - Collect
  - Optimize
  - Result
commonfields:
  id: SpyCloudEnterpriseProtectionFeed
  version: -1
configuration:
- defaultvalue: https://api.spycloud.io/enterprise-v2/
  display: API URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  hidden: false
  name: apikey
  required: true
  type: 4
  section: Connect
- defaultvalue: 'true'
  display: Fetch incidents
  name: isFetch
  required: true
  type: 8
  section: Collect
- additionalinfo: |-
    This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
    Example: -1days, now, YYYY-MM-DD.
  defaultvalue: -1days
  display: Since
  hidden: false
  name: first_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: |-
    This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
    Example: -1days, now, YYYY-MM-DD.
  display: Until
  hidden: false
  name: until
  required: false
  type: 0
  section: Collect
- additionalinfo: |-
    This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date).
    Example: -1days, now, YYYY-MM-DD.
  defaultvalue: -1days
  display: Since Modification Date
  hidden: false
  name: since_modification_date
  required: false
  type: 0
  section: Collect
- additionalinfo: |-
    This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date).
    Example: -1days, now, YYYY-MM-DD.
  defaultvalue: -1days
  display: Until Modification Date
  hidden: false
  name: until_modification_date
  required: false
  type: 0
  section: Collect
- additionalinfo: 'This parameter allows you to filter based on the numeric severity code. The codes map to the following record types: 2 = email_only, 5 = informational, 20 = breach, 25 = malware, 30 = access data. Each selected code creates incidents of the matching SpyCloud incident type.'
  defaultvalue: 20,25,30
  display: Severity
  hidden: false
  name: severity
  options:
  - '30'
  - '25'
  - '20'
  - '5'
  - '2'
  required: false
  type: 16
  section: Optimize
- additionalinfo: This parameter allows you to filter based on a particular breach source.This parameter allows you to filter based on a particular breach source.
  display: Source ID
  hidden: false
  name: source_id
  required: false
  type: 0
  section: Optimize
- additionalinfo: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
  display: Salt
  hidden: false
  name: salt
  required: false
  type: 0
  section: Optimize
- additionalinfo: This parameter lets you filter results by type. The allowed values are 'corporate' for corporate records, and 'infected' for infected user records (from botnet data). If no value has been provided the API function will, by default, return all record types.
  display: Type
  hidden: false
  name: type
  options:
  - corporate
  - infected
  - email_domain
  - target_domain
  required: false
  type: 15
  section: Optimize
- additionalinfo: 'This parameters lets you filter results for only emails or only domains on your watchlist. The allowed values are: [''email'', ''domain'', ''subdomain'', ''ip'']. If no value has been provided, the API will return all watchlist types.'
  display: Watchlist Type
  hidden: false
  name: watchlist_type
  options:
  - email
  - domain
  - subdomain
  - ip
  required: false
  type: 15
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  hidden: false
  name: proxy
  required: false
  type: 8
  section: Connect
- defaultvalue: '2'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Optimize
- display: Incident type
  name: incidentType
  required: false
  type: 13
  section: Optimize
- additionalinfo: please enter the domains to search here, if left empty, your full watchlist will be pulled
  display: Domain Search
  name: domain_search
  required: false
  type: 12
  section: Collect
- additionalinfo: Volume of incidents captured at a single time. By default this is set to 200.
  display: Fetch Limit
  name: fetch_limit
  defaultvalue: "200"
  required: false
  type: 0
  section: Collect
description: Fetch SpyCloud watchlist data (breach, malware and access records) for daily monitoring, incident response, and mitigation.
display: SpyCloud Enterprise Protection Feed
name: SpyCloudEnterpriseProtectionFeed
script:
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetch: true
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)
defaultclassifier: SpyCloud - Classifier
defaultmapperin: SpyCloud - Incoming Mapper