SpyCloudEnterpriseProtectionFeed

Fetch SpyCloud watchlist data (breach, malware and access records) for daily monitoring, incident response, and mitigation.

Data Enrichment & Threat Intelligence · SpyCloud Enterprise Protection

Details

IDSpyCloudEnterpriseProtectionFeed
ProviderSpyCloud
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM Agentix

README

SpyCloud Enterprise Protection Feed

Create breach, malware and access incidents in Cortex® XSOAR™ using the SpyCloud Enterprise Protection API.
This integration was integrated and tested with version 3.5 of SpyCloud Enterprise Protection API

Configure SpyCloud Enterprise Protection Feed in Cortex

Parameter Description Required
API URL SpyCloud Enterprise Protection API Base URL True
API Key SpyCloud Enterprise Protection API Key True
Fetch incidents This is a required field by XSOAR to fetch new Watchlist events from SpyCloud watchlist API True
Since This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
Example: -1days, now, YYYY-MM-DD.		 False
Until This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
Example: -1days, now, YYYY-MM-DD.		 False
Since Modification Date This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date).
Example: -1days, now, YYYY-MM-DD.		 False
Until Modification Date This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date).
Example: -1days, now, YYYY-MM-DD.		 False
Severity This parameter allows you to filter based on the numeric severity code. The codes map to the following record types: 2 = email_only, 5 = informational, 20 = breach, 25 = malware, 30 = access data. Each selected code creates incidents of the matching SpyCloud incident type. False
Source ID This parameter allows you to filter based on a particular breach source.This parameter allows you to filter based on a particular breach source. False
Salt If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. False
Type This parameter lets you filter results by type. The allowed values are ‘corporate’ for corporate records, and ‘infected’ for infected user records (from botnet data). If no value has been provided the API function will, by default, return all record types. False
Watchlist Type This parameters lets you filter results for only emails or only domains on your watchlist. The allowed values are: [‘email’, ‘domain’, ‘subdomain’, ‘ip’]. If no value has been provided, the API will return all watchlist types. False
Trust any certificate (not secure) Trust any certificate (not secure) False
Use system proxy settings Use system proxy settings False
Incidents Fetch Interval Incidents Fetch Interval False
Incident type Incident type False
Domain Search Please enter the domains to search here, if left empty, your full watchlist will be pulled False
Fetch Limit Volume of incidents captured at a single time. By default this is set to 200 False

Configuration parameters

  • url — API URL (required)
  • apikey — API Key (required)
  • isFetch — Fetch incidents (required)
  • first_fetch — Since
  • until — Until
  • since_modification_date — Since Modification Date
  • until_modification_date — Until Modification Date
  • severity — Severity
  • source_id — Source ID
  • salt — Salt
  • type — Type
  • watchlist_type — Watchlist Type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • domain_search — Domain Search
  • fetch_limit — Fetch Limit

Commands (0)

This integration defines no commands.

Source

SpyCloudEnterpriseProtectionFeed.py SpyCloudEnterpriseProtectionFeed_test.py SpyCloudEnterpriseProtectionFeed.yml SpyCloudEnterpriseProtectionFeed_description.md command_examples.txt
Download History Raw 
!spycloud-list-breaches limit=2