Cyberint Takedowns

Details

ID	`Cyberint Takedowns`
Provider	Check Point Software Technologies
Category	Data Enrichment & Threat Intelligence
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Use the Cyberint Takedowns integration to manage takedowns requests

Configure Cyberint Takedowns on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Cyberint Takedowns.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Cyberint API URL	Example: `https://yourcompany.cyberint.io`	True
Company Name		True
API access token		True
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberint-retrieve-takedowns

Retrieve takedowns requests.

Base Command

cyberint-retrieve-takedowns

Input

Argument Name	Description	Required
customer_id	Customer ID.	True
reason	Reason for the takedown request.	True
url	URL for the takedown request.	True
original_url	Original URL.	Optional
customer	Customer.	Optional
status	Status.	Optional
brand	Brand.	Optional
alert_ref_id	Alert reference ID.	Optional
alert_id	Alert ID.	Optional
hosting_providers	Hosting providers.	Optional
name_servers	Name servers.	Optional
escalation_actions	Escalation actions.	Optional
last_escalation_date	Last escalation date.	Optional
last_status_change_date	Last status change date.	Optional
last_seen_date	Last seen date.	Optional
created_date	Created date.	Optional
status_reason	Status reason.	Optional
id	Takedown request ID.	Optional

Context Output

Path	Type	Description
Cyberint.takedowns_list.reason	String	Reason for the takedown request.
Cyberint.takedowns_list.url	String	URL for the takedown request.
Cyberint.takedowns_list.original_url	String	Original URL.
Cyberint.takedowns_list.customer	String	Customer.
Cyberint.takedowns_list.status	String	Status.
Cyberint.takedowns_list.brand	String	Brand.
Cyberint.takedowns_list.alert_ref_id	String	Alert reference ID.
Cyberint.takedowns_list.alert_id	Number	Alert ID.
Cyberint.takedowns_list.hosting_providers	Array	List of hosting providers.
Cyberint.takedowns_list.name_servers	Array	List of name servers.
Cyberint.takedowns_list.escalation_actions	Array	List of escalation actions.
Cyberint.takedowns_list.last_escalation_date	String	Last escalation date (ISO 8601).
Cyberint.takedowns_list.last_status_change_date	String	Last status change date.
Cyberint.takedowns_list.last_seen_date	String	Last seen date.
Cyberint.takedowns_list.created_date	String	Created date.
Cyberint.takedowns_list.status_reason	String	Status reason.
Cyberint.takedowns_list.id	String	Takedown request ID (UUID).

Command example

!cyberint-retrieve-takedowns customer_id=Cyberint reason=phishing url=http://hacking.enterprises original_url=https://cyberint.com brand=Cyberint

Context Example

{
    "Cyberint.takedowns": [
        {
          "data": {
            "takedown_requests": [
              {
                "reason": "phishing",
                "url": "string",
                "original_url": "string",
                "customer": "string",
                "status": "pending",
                "brand": "string",
                "alert_ref_id": "string",
                "alert_id": 0,
                "hosting_providers": [
                  "string"
                ],
                "name_servers": [
                  "string"
                ],
                "escalation_actions": [
                  "string"
                ],
                "last_escalation_date": "2019-08-24T14:15:22Z",
                "last_status_change_date": "2019-08-24T14:15:22Z",
                "last_seen_date": "2019-08-24T14:15:22Z",
                "created_date": "2019-08-24T14:15:22Z",
                "status_reason": "string",
                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
              }
            ]
          }
        }
    ]
}

Human Readable Output

Takedowns

Name	Type	Description
reason	String	Reason for the takedown request.
url	String	URL for the takedown request.
original_url	String	Original URL.
customer	String	Customer.
status	String	Status.
brand	String	Brand.
alert_ref_id	String	Alert reference ID.
alert_id	Number	Alert ID.
hosting_providers	Array	List of hosting providers.
name_servers	Array	List of name servers.
escalation_actions	Array	List of escalation actions.
last_escalation_date	String	Last escalation date (ISO 8601).
last_status_change_date	String	Last status change date.
last_seen_date	String	Last seen date.
created_date	String	Created date.
status_reason	String	Status reason.
id	String	Takedown request ID (UUID).

cyberint-takedown-url

Submit takedown request.

Base Command

cyberint-takedown-url

Input

Argument Name	Description	Required
customer	Customer.	True
reason	Reason for the takedown request.	Required
url	URL for the takedown request.	Required
brand	Brand.	Optional
original_url	Original URL.	Optional
alert_id	Alert ID.	Optional
note	Note.	Optional

Context Output

Path	Type	Description
Cyberint.takedowns_submit.reason	String	Reason for the takedown request.
Cyberint.takedowns_submit.url	String	URL for the takedown request.
Cyberint.takedowns_submit.original_url	String	Original URL.
Cyberint.takedowns_submit.customer	String	Customer.
Cyberint.takedowns_submit.status	String	Status.
Cyberint.takedowns_submit.brand	String	Brand.
Cyberint.takedowns_submit.alert_ref_id	String	Alert reference ID.
Cyberint.takedowns_submit.alert_id	Number	Alert ID.
Cyberint.takedowns_submit.hosting_providers	Array	List of hosting providers.
Cyberint.takedowns_submit.name_servers	Array	List of name servers.
Cyberint.takedowns_submit.escalation_actions	Array	List of escalation actions.
Cyberint.takedowns_submit.last_escalation_date	String	Last escalation date (ISO 8601).
Cyberint.takedowns_submit.last_status_change_date	String	Last status change date.
Cyberint.takedowns_submit.last_seen_date	String	Last seen date.
Cyberint.takedowns_submit.created_date	String	Created date.
Cyberint.takedowns_submit.status_reason	String	Status reason.
Cyberint.takedowns_submit.id	String	Takedown request ID (UUID).

Command example

!cyberint-takedown-url customer=Cyberint reason=Description url=http://hacking.enterprises

Context Example

{
    "Cyberint.takedowns": [
        {
          "customer": "string",
          "reason": "phishing",
          "url": "string",
          "brand": "string",
          "original_url": "string",
          "alert_id": 0,
          "note": "string"
        }
    ]
}

Human Readable Output

Takedown submit response

Name	Type	Description
reason	String	Reason for the takedown request.
url	String	URL for the takedown request.
original_url	String	Original URL.
customer	String	Customer.
status	String	Status.
brand	String	Brand.
alert_ref_id	String	Alert reference ID.
alert_id	Number	Alert ID.
hosting_providers	Array	List of hosting providers.
name_servers	Array	List of name servers.
escalation_actions	Array	List of escalation actions.
last_escalation_date	String	Last escalation date (ISO 8601).
last_status_change_date	String	Last status change date (ISO 8601).
last_seen_date	String	Last seen date (ISO 8601).
created_date	String	Created date (ISO 8601).
status_reason	String	Status reason.
id	String	Takedown request ID (UUID).

Configuration parameters

url — Cyberint API URL (required)
client_name — Company Name (required)
access_token — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

cyberint-retrieve-takedowns
Retrieve takedowns requests.
cyberint-takedown-url
Submit takedown request.

Source

TakedownCyberint.py TakedownCyberint_test.py TakedownCyberint.yml TakedownCyberint_description.md command_examples.txt

Download History Raw

sectionorder:
- Connect
commonfields:
  id: Cyberint Takedowns
  version: -1
fromversion: 6.9.0
name: Cyberint Takedowns
display: Check Point EM Takedowns
category: Data Enrichment & Threat Intelligence
provider: Check Point Software Technologies
description: Use the Cyberint Takedowns integration to manage takedowns requests.
configuration:
- display: Cyberint API URL
  additionalinfo: Cyberint API URL on which the services run (i.e https://yourcompany.cyberint.io)
  name: url
  required: true
  type: 0
  section: Connect
- display: Company Name
  additionalinfo: Company (client) name associated with Cyberint instance.
  name: client_name
  required: true
  type: 0
  section: Connect
- displaypassword: API access token
  name: access_token
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: python
  commands:
  - name: cyberint-retrieve-takedowns
    description: Retrieve takedowns requests.
    arguments:
    - name: customer_id
      type: String
      description: Customer ID.
      required: true
    - name: action
      type: String
      description: Action taken.
    - name: alert_id
      type: Number
      description: Alert ID.
    - name: alert_ref_id
      type: String
      description: Alert reference ID.
    - name: blocked_date
      type: String
      description: Blocklist request blocked date.
    - name: sent_date
      type: String
      description: Blocklist request sent date.
    - name: brand
      type: String
      description: Brand.
    - name: created_date
      type: String
      description: Created date.
    - name: customer
      type: String
      description: Customer.
    - name: domain
      type: String
      description: Domain.
    - name: email_ticket_id
      type: String
      description: Email ticket ID.
    - name: hostname
      type: String
      description: Hostname.
    - name: id
      type: String
      description: Takedown request ID.
    - name: last_action_date
      type: String
      description: Last action date.
    - name: last_email_date
      type: String
      description: Last email date.
    - name: last_monitored_date
      type: String
      description: Last monitored date.
    - name: last_seen_date
      type: String
      description: Last seen date.
    - name: last_submit_date
      type: String
      description: Last submit date.
    - name: metadata_date
      type: String
      description: Metadata date.
    - name: reason
      type: String
      description: Reason for the takedown request.
      predefined:
        - phishing
        - brand_abuse
        - impersonating_application
        - unofficial_application_distribution
        - malicious_content
        - social_media_impersonation
        - social_media_employee_impersonation
        - fake_job_post
        - sensitive_file_on_antivirus_repository
        - instant_messaging_impersonation
        - other
    - name: requested_by
      type: String
      description: Requested by.
    - name: status
      type: String
      description: Status.
    - name: url
      type: String
      description: URL for the takedown request.
    outputs:
    - contextPath: Cyberint.takedowns_list.reason
      description: Reason.
      type: String
    - contextPath: Cyberint.takedowns_list.url
      description: URL.
      type: String
    - contextPath: Cyberint.takedowns_list.original_url
      description: Original URL.
      type: String
    - contextPath: Cyberint.takedowns_list.customer
      description: Customer.
      type: String
    - contextPath: Cyberint.takedowns_list.status
      description: Status.
      type: String
    - contextPath: Cyberint.takedowns_list.brand
      description: Brand.
      type: String
    - contextPath: Cyberint.takedowns_list.alert_ref_id
      description: Alert Ref ID.
      type: String
    - contextPath: Cyberint.takedowns_list.alert_id
      description: Alert ID.
      type: Number
    - contextPath: Cyberint.takedowns_list.hosting_providers
      description: Hosting Providers.
      type: String
    - contextPath: Cyberint.takedowns_list.name_servers
      description: Name Servers.
      type: String
    - contextPath: Cyberint.takedowns_list.escalation_actions
      description: Escalation Actions.
      type: String
    - contextPath: Cyberint.takedowns_list.last_escalation_date
      description: Last Escalation Date.
      type: String
    - contextPath: Cyberint.takedowns_list.last_status_change_date
      description: Last Status Change Date.
      type: String
    - contextPath: Cyberint.takedowns_list.last_seen_date
      description: Last Seen Date.
      type: String
    - contextPath: Cyberint.takedowns_list.created_date
      description: Created Date.
      type: String
    - contextPath: Cyberint.takedowns_list.status_reason
      description: Status Reason.
      type: String
    - contextPath: Cyberint.takedowns_list.id
      description: ID.
      type: String
  - name: cyberint-takedown-url
    description: Submit takedown request.
    arguments:
    - name: customer
      type: String
      description: Customer name (ID of the customer).
      required: true
    - name: reason
      type: String
      required: true
      description: Reason for takedown request.
      predefined:
        - phishing
        - brand_abuse
        - impersonating_application
        - unofficial_application_distribution
        - malicious_content
        - social_media_impersonation
        - social_media_employee_impersonation
        - fake_job_post
        - sensitive_file_on_antivirus_repository
        - instant_messaging_impersonation
        - other
    - name: url
      type: String
      description: URL for takedown request.
      required: true
    - name: brand
      type: String
      description: The brand the offending URL is targeting.
    - name: original_url
      type: String
      description: URL of the original copyrighted content.
    - name: alert_id
      type: Number
      description: Alert ID.
    - name: note
      type: String
      description: Comment.
    outputs:
    - contextPath: Cyberint.takedowns_submit.reason
      description: Reason.
      type: String
    - contextPath: Cyberint.takedowns_submit.url
      description: URL.
      type: String
    - contextPath: Cyberint.takedowns_submit.original_url
      description: Original URL.
      type: String
    - contextPath: Cyberint.takedowns_submit.customer
      description: Customer.
      type: String
    - contextPath: Cyberint.takedowns_submit.status
      description: Status.
      type: String
    - contextPath: Cyberint.takedowns_submit.brand
      description: Brand.
      type: String
    - contextPath: Cyberint.takedowns_submit.alert_ref_id
      description: Alert Ref ID.
      type: String
    - contextPath: Cyberint.takedowns_submit.alert_id
      description: Alert ID.
      type: Number
    - contextPath: Cyberint.takedowns_submit.hosting_providers
      description: Hosting Providers.
      type: String
    - contextPath: Cyberint.takedowns_submit.name_servers
      description: Name Servers.
      type: String
    - contextPath: Cyberint.takedowns_submit.escalation_actions
      description: Escalation Actions.
      type: String
    - contextPath: Cyberint.takedowns_submit.last_escalation_date
      description: Last Escalation Date.
      type: String
    - contextPath: Cyberint.takedowns_submit.last_status_change_date
      description: Last Status Change Date.
      type: String
    - contextPath: Cyberint.takedowns_submit.last_seen_date
      description: Last Seen Date.
      type: String
    - contextPath: Cyberint.takedowns_submit.created_date
      description: Created Date.
      type: String
    - contextPath: Cyberint.takedowns_submit.status_reason
      description: Status Reason.
      type: String
    - contextPath: Cyberint.takedowns_submit.id
      description: ID.
      type: String
  dockerimage: demisto/python3:3.12.13.10404775
  feed: false
  subtype: python3
tests:
- No tests