Threatmon

Integration with Threatmon for vulnerability threat intelligence.

Data Enrichment & Threat Intelligence · ThreatMon

Details

ID	`Threatmon`
Provider	ThreatMon
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

ThreatMon Integration

Overview

The ThreatMon integration enables Cortex XSOAR to retrieve threat intelligence data from the ThreatMon API and update incidents automatically based on the incoming threat context.

This integration is designed to help security teams streamline incident enrichment and response by leveraging real-time intelligence from ThreatMon’s extensive threat database.

Use Cases

Enrich incidents in XSOAR with actionable threat intelligence from ThreatMon.
Automatically pull threat data and update incidents accordingly.
Support analyst decision-making with contextual threat data from an external source.

Key Features

Real-time threat data ingestion from the ThreatMon API.
Automated incident updates using custom playbooks or scheduled jobs.
Flexible command-based data retrieval (on-demand or automated).
Supports indicators such as IP addresses, domains, and file hashes.

Requirements

A valid ThreatMon API key (can be obtained from your ThreatMon dashboard).
IP based access permission to Threatmon API
Internet connectivity from your XSOAR instance to the ThreatMon API endpoint.

Configuration

Navigate to Settings > Integrations > Servers & Services.
Search for ThreatMon.
Click Add instance to create and configure a new integration instance:
- Name: ThreatMon
- API Key: Your ThreatMon API key
- Base URL: https://external.threatmonit.io (or your custom endpoint)
Click Test to validate the connection.
Click Save.

Commands

Command	Description
`fetch-incidents`	Retrieves threat intelligence data for a specified indicator or time range.
`threatmon_update_incident_status`	Updates the current incident with contextual threat intelligence.
`threatmon_request_takedown`	Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.
`threatmon_list_cves`	Retrieves a paginated list of all CVEs monitored by ThreatMon.
`threatmon_list_subscribed_cves`	Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.
`threatmon_request_data_removal`	Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits.

Note: Full command usage details and argument structures are available within the integration settings in XSOAR.

Troubleshooting

Make sure the API key is valid and not expired.
Ensure the integration instance has network access to https://external.threatmonit.io.
Review Cortex XSOAR logs for additional error context.

Support

This is a community-supported integration. For issues or feature requests:

Contact the ThreatMon team at integration@threatmonit.io.

Author

ThreatMon Security Intelligence Team
Website: https://www.threatmon.io
Support: integration@threatmonit.io

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

Fetch incidents

</~PLATFORM>

Configuration parameters

url — API URL (required)
credentials — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
lastIncidentId — Last Incident ID (for initial fetch)
incidentType — Incident type
isFetch — Fetch incidents
fetchInterval — Fetch Interval (minutes)
incidentFetchInterval — Incidents Fetch Interval

Commands (5)

threatmon_list_cves
Retrieves a paginated list of all CVEs monitored by ThreatMon.
threatmon_list_subscribed_cves
Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.
threatmon_request_data_removal
Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits. Returns 403 if the quota is exceeded or rights are insufficient.
threatmon_request_takedown
Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.
threatmon_update_incident_status
Update Incident Status endpoint allows you to change/update status. of specified Threatmon incidents.

Source

ThreatMon.py ThreatMon.yml ThreatMon_description.md

Download History Raw

commonfields:
  id: Threatmon
  version: -1
name: Threatmon
display: Threatmon
sectionorder:
- Connect
- Collect
category: Data Enrichment & Threat Intelligence
description: Integration with Threatmon for vulnerability threat intelligence.
provider: ThreatMon
configuration:
- display: API URL
  name: url
  type: 0
  required: true
  section: Connect
  defaultvalue: https://external.threatmonit.io/api/threatmon/external/v1
- displaypassword: API Key
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Last Incident ID (for initial fetch)
  name: lastIncidentId
  type: 0
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
- display: Incident type
  name: incidentType
  type: 13
  required: false
  supportedModules:
  - xsiam
  - agentix
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  supportedModules:
  - xsiam
  - agentix
  section: Collect
- display: Fetch Interval (minutes)
  name: fetchInterval
  defaultvalue: "5"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: threatmon_update_incident_status
    arguments:
    - name: alarmId
      required: true
      description: Threatmon Incident Code (ID).
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - Open
      - In Progress
      - False Positive
      - Ignore
      - Resolved
      description: 'Incident Status.'
    description: Update Incident Status endpoint allows you to change/update status. of specified Threatmon incidents.
  - name: threatmon_request_takedown
    arguments:
    - name: findingId
      required: true
      description: The ID of the finding (alarm row) to submit a takedown request for.
    - name: finding
      required: true
      description: Description of the finding that justifies the takedown request.
    description: Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.
  - name: threatmon_request_data_removal
    arguments:
    - name: findingId
      description: The ID of the finding (alarm row) to submit a data removal request for.
      required: true
    - name: finding
      description: The URL or content identifier of the finding to be removed from Black Market Monitoring results.
      required: true
    description: Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits. Returns 403 if the quota is exceeded or rights are insufficient.
  - name: threatmon_list_cves
    arguments:
    - name: page
      description: Page number to retrieve (0-based). Each page contains up to 100 CVEs, sorted by last update time (descending).
      defaultValue: "0"
    - name: cvss
      description: Filter CVEs by CVSS v3 severity.
      auto: PREDEFINED
      predefined:
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    outputs:
    - contextPath: ThreatMon.CVE.cve
      description: CVE identifier.
      type: String
    - contextPath: ThreatMon.CVE.summary
      description: CVE summary.
      type: String
    - contextPath: ThreatMon.CVE.cvssV2
      description: CVSS v2 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV2
      description: CVSS v2 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3
      description: CVSS v3 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3_1
      description: CVSS v3.1 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3_1
      description: CVSS v3.1 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV4
      description: CVSS v4 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV4
      description: CVSS v4 severity level.
      type: String
    - contextPath: ThreatMon.CVE.vendors
      description: Map of vendor names to affected product names.
      type: Unknown
    - contextPath: ThreatMon.CVE.exploit
      description: Whether a known exploit exists for this CVE.
      type: Boolean
    - contextPath: ThreatMon.CVE.knownRansomwareCampaignUse
      description: Known ransomware campaign associated with this CVE, if any.
      type: String
    - contextPath: ThreatMon.CVE.zeroday
      description: Whether this CVE was disclosed as a zero-day.
      type: Boolean
    - contextPath: ThreatMon.CVE.createdAt
      description: Date the CVE record was created in ThreatMon.
      type: Date
    - contextPath: ThreatMon.CVE.updatedAt
      description: Date the CVE record was last updated in ThreatMon.
      type: Date
    description: Retrieves a paginated list of all CVEs monitored by ThreatMon.
  - name: threatmon_list_subscribed_cves
    arguments:
    - name: page
      description: Page number to retrieve (0-based). Each page contains up to 100 CVEs, sorted by last update time (descending).
      defaultValue: "0"
    - name: cvss
      description: Filter CVEs by CVSS v3 severity.
      auto: PREDEFINED
      predefined:
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    - name: customer_name
      description: For MSSP accounts, retrieves subscribed CVEs on behalf of the specified child customer instead of the authenticated company.
    outputs:
    - contextPath: ThreatMon.CVE.cve
      description: CVE identifier.
      type: String
    - contextPath: ThreatMon.CVE.summary
      description: CVE summary.
      type: String
    - contextPath: ThreatMon.CVE.cvssV2
      description: CVSS v2 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV2
      description: CVSS v2 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3
      description: CVSS v3 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3_1
      description: CVSS v3.1 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3_1
      description: CVSS v3.1 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV4
      description: CVSS v4 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV4
      description: CVSS v4 severity level.
      type: String
    - contextPath: ThreatMon.CVE.vendors
      description: Map of vendor names to affected product names.
      type: Unknown
    - contextPath: ThreatMon.CVE.exploit
      description: Whether a known exploit exists for this CVE.
      type: Boolean
    - contextPath: ThreatMon.CVE.knownRansomwareCampaignUse
      description: Known ransomware campaign associated with this CVE, if any.
      type: String
    - contextPath: ThreatMon.CVE.zeroday
      description: Whether this CVE was disclosed as a zero-day.
      type: Boolean
    - contextPath: ThreatMon.CVE.createdAt
      description: Date the CVE record was created in ThreatMon.
      type: Date
    - contextPath: ThreatMon.CVE.updatedAt
      description: Date the CVE record was last updated in ThreatMon.
      type: Date
    description: Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.
  isfetch: true
  dockerimage: demisto/python3:3.12.13.10404775
fromversion: 5.0.0
tests:
- No tests