ThreatMon Threat Feed

Details

ID	`ThreatMon Threat Feed`
Provider	ThreatMon
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Fetches Indicators of Compromise (IOCs) from the ThreatMon IOC platform and ingests them into Cortex as indicators.
This integration was integrated and tested with the ThreatMon IOC API.

Configure ThreatMon Threat Feed in Cortex

Parameter	Description	Required
Server URL	The ThreatMon IOC API base URL.	True
API Token	The ThreatMon API token used to authenticate against the IOC API.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Data Type to Fetch	The type of IOC data to fetch from ThreatMon.	False
Maximum number of indicators per fetch	The maximum number of indicators to fetch in a single run.	False
Collection IDs	A comma-separated list of ThreatMon collection IDs to filter the fetch by. Leave empty to fetch from all collections.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Feed Fetch Interval		False
Tags	Supports CSV values.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False

Fetched Indicators

The feed maps the ThreatMon ioc_type field to Cortex indicator types as follows.

ThreatMon ioc_type	Cortex indicator type
Contains `ip`	IP
Contains `domain`	Domain
Contains `url`	URL
Contains `file` or `hash`	File

For IP indicators, the extracted_ip field is preferred over ioc_value, and any port suffix is stripped, so that 1.2.3.4:8080 is ingested as 1.2.3.4.

The following indicator fields are populated from the ThreatMon response.

Indicator field	ThreatMon field
description	A summary built from source, confidence level, severity, status, ISP, resolved IPs, categories, tags, timestamp and score
tags	`tags`, `categories` and `source`, merged with the `ThreatMon` tag
modified	`updated_at`, falling back to `timestamp` and then `created_at`
confidence	`confidence_level`
threatseverity	`severity`
status	`status`
isp	`isp`
resolvedips	`resolved_ips`
geolocation	`geo_location`
trafficlightprotocol	The Traffic Light Protocol Color parameter

The feed is incremental. On every run it stores the newest indicator timestamp it has seen, and on subsequent runs it skips indicators that are not newer than that timestamp.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

threatmon-get-indicators

Gets a sample of indicators from the ThreatMon feed. This command is used mainly for testing and debugging, and does not create indicators in the system.

Base Command

threatmon-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of indicators to return. Default is 10.	Optional

Context Output

There is no context output for this command.

Indicators are also ingested automatically according to the Feed Fetch Interval parameter.

Troubleshooting

Test failed - Verify the API token and that the Server URL is reachable from the Cortex engine.
No indicators fetched - Verify that the configured Collection IDs contain data, and that Data Type to Fetch is not filtering out the indicators you expect. Because the feed is incremental, a run returns nothing when the API has not published indicators newer than the previous run.

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

Fetch indicators
Incremental Feed
Bypass exclusion list

</~PLATFORM>

Configuration parameters

url — Server URL (required)
credentials — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
data_type — Data Type to Fetch
limit — Maximum number of indicators per fetch
collection_ids — Collection IDs
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedIncremental — Incremental Feed
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags

Commands (1)

threatmon-get-indicators
Gets a sample of indicators from the ThreatMon feed. This command is used mainly for testing and debugging, and does not create indicators in the system.

Source

ThreatMonThreatFeed.py ThreatMonThreatFeed_test.py ThreatMonThreatFeed.yml ThreatMonThreatFeed_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
commonfields:
  id: ThreatMon Threat Feed
  version: -1
name: ThreatMon Threat Feed
display: ThreatMon Threat Feed
provider: ThreatMon
description: Fetches Indicators of Compromise (IOCs) from the ThreatMon IOC platform and ingests them into Cortex as indicators.
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL
  name: url
  defaultvalue: https://ioc.threatmonit.io
  type: 0
  required: true
  section: Connect
- displaypassword: API Token
  additionalinfo: The ThreatMon API token used to authenticate against the IOC API.
  name: credentials
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch indicators
  name: feed
  defaultvalue: 'true'
  type: 8
  required: false
  section: Connect
  supportedModules:
  - agentix
  - xsiam
- display: Data Type to Fetch
  additionalinfo: The type of IOC data to fetch from ThreatMon.
  name: data_type
  defaultvalue: all
  type: 15
  options:
  - all
  - ip
  - domain
  - url
  required: false
  section: Collect
- display: Maximum number of indicators per fetch
  additionalinfo: The maximum number of indicators to fetch in a single run.
  name: limit
  defaultvalue: '500'
  type: 0
  required: false
  section: Collect
- display: Collection IDs
  additionalinfo: A comma-separated list of ThreatMon collection IDs to filter the fetch by. Leave empty to fetch from all collections.
  name: collection_ids
  type: 0
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  display: Indicator Reputation
  name: feedReputation
  defaultvalue: Bad
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Reliability of the source providing the intelligence data.
  display: Source Reliability
  name: feedReliability
  defaultvalue: A - Completely reliable
  type: 15
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex, all indicators coming from these feeds are labeled new or modified.
  display: Incremental Feed
  name: feedIncremental
  defaultvalue: 'true'
  type: 8
  hidden: true
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: ''
  name: feedExpirationPolicy
  defaultvalue: indicatorType
  type: 17
  options:
  - never
  - interval
  - indicatorType
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: ''
  name: feedExpirationInterval
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '240'
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- name: feedTags
  display: Tags
  type: 0
  additionalinfo: Supports CSV values.
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10404775
  feed: true
  runonce: false
  commands:
  - name: threatmon-get-indicators
    description: Gets a sample of indicators from the ThreatMon feed. This command is used mainly for testing and debugging, and does not create indicators in the system.
    arguments:
    - name: limit
      description: The maximum number of indicators to return.
      defaultValue: '10'
    outputs: []
fromversion: 6.10.0
tests:
- No tests (auto formatted)