ZeroFox

Cloud-based SaaS to detect risks found on social media and digital channels.

Data Enrichment & Threat Intelligence · ZeroFox

Configuration parameters

  • url — URL (e.g., https://api.zerofox.com/) (required)
  • credentials — Username (required)
  • only_escalated — Fetch only escalated alerts
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetch_limit — Fetch Limit
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • incidentType — Incident type

Commands (22)

  • zerofox-alert-cancel-takedown

    Cancels a takedown of a specified alert.

  • zerofox-alert-request-takedown

    Requests a takedown of a specified alert.

  • zerofox-alert-user-assignment

    Assigns an alert to a user.

  • zerofox-close-alert

    Closes an alert.

  • zerofox-create-entity

    Creates a new entity associated with the company of the authorized user.

  • zerofox-get-alert

    Fetches an alert by ID.

  • zerofox-get-alert-attachments Deprecated

    Retrieves the attachments of a specified alert.

  • zerofox-get-compromised-credentials

    Gets compromised credentials data for a given ZeroFox alert and uploads it to the current investigation War Room.

  • zerofox-get-entity-types

    Shows a table of all entity type names and IDs in the War Room.

  • zerofox-get-policy-types

    Shows a table of all policy type names and IDs in the War Room.

  • zerofox-list-alerts

    Returns alerts that match user-defined or default filters and parameters. By default, no filters are applied and the results are sorted by timestamp.

  • zerofox-list-entities

    Lists all entities associated with the company of the authorized user.

  • zerofox-modify-alert-notes

    Modify the notes of a specified alert.

  • zerofox-modify-alert-tags

    Adds tags to and or removes tags from a specified alert.

  • zerofox-open-alert

    Opens an alert.

  • zerofox-search-compromised-domain

    Looks for a given domain in Zerofox's CTI feeds.

  • zerofox-search-compromised-email

    Looks for a given email in ZeroFox's CTI feeds.

  • zerofox-search-exploits

    Looks for registered exploits in ZeroFox's CTI feeds.

  • zerofox-search-malicious-hash

    Looks for registered hashes in ZeroFox's CTI feeds.

  • zerofox-search-malicious-ip

    Looks for malicious ips in ZeroFox's CTI feeds.

  • zerofox-send-alert-attachment

    Sends an attachment to a specified alert.

  • zerofox-submit-threat

    Submits potential threats into the ZF alert registry for disruption.