Cyberint Takedowns

Use the Cyberint Takedowns integration to manage takedowns requests

Configure Cyberint Takedowns on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Cyberint Takedowns.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Cyberint API URL	Example: https://yourcompany.cyberint.io	True
   Company Name		True
   API access token		True
   Trust any certificate (not secure)		False
   Use system proxy settings		False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberint-retrieve-takedowns

Retrieve takedowns requests.

Base Command

cyberint-retrieve-takedowns

Input

Context Output

Command example

!cyberint-retrieve-takedowns customer_id=Cyberint reason=phishing url=http://hacking.enterprises original_url=https://cyberint.com brand=Cyberint

Context Example

{
    "Cyberint.takedowns": [
        {
          "data": {
            "takedown_requests": [
              {
                "reason": "phishing",
                "url": "string",
                "original_url": "string",
                "customer": "string",
                "status": "pending",
                "brand": "string",
                "alert_ref_id": "string",
                "alert_id": 0,
                "hosting_providers": [
                  "string"
                ],
                "name_servers": [
                  "string"
                ],
                "escalation_actions": [
                  "string"
                ],
                "last_escalation_date": "2019-08-24T14:15:22Z",
                "last_status_change_date": "2019-08-24T14:15:22Z",
                "last_seen_date": "2019-08-24T14:15:22Z",
                "created_date": "2019-08-24T14:15:22Z",
                "status_reason": "string",
                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
              }
            ]
          }
        }
    ]
}

Human Readable Output

Takedowns

cyberint-takedown-url

Submit takedown request.

Base Command

cyberint-takedown-url

Input

Context Output

Command example

!cyberint-takedown-url customer=Cyberint reason=Description url=http://hacking.enterprises

Context Example

{
    "Cyberint.takedowns": [
        {
          "customer": "string",
          "reason": "phishing",
          "url": "string",
          "brand": "string",
          "original_url": "string",
          "alert_id": 0,
          "note": "string"
        }
    ]
}

Human Readable Output

Takedown submit response