ZeroFoxKeyIncidents

Details

ID	`ZeroFoxKeyIncidents`
Provider	Haveli Investments
Category	Data Enrichment & Threat Intelligence
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cloud-based SaaS to detect risks found on social media and digital channels.
This integration was integrated and tested with version 1.4.0 of ZeroFoxKey.

Configure ZeroFox Key Incidents in Cortex

Parameter	Required
URL (e.g., https://api.zerofox.com/)	True
Fetch incidents	False
Username	True
Password	True
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	False
Incident type	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zerofox-get-key-incident-attachment

Fetches a Key Incident Attachment by ID and uploads it to the current investigation War Room.

Base Command

zerofox-get-key-incident-attachment

Input

Argument Name	Description	Required
attachment_id	The ID of the Key Incident Attachment.	Required

Context Output

Path	Type	Description
File.Size	Number	The size of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Name	String	The name of the file.
File.SSDeep	String	The SSDeep hash of the file.
File.EntryID	String	The entry ID of the file.
File.Info	String	File information.
File.Type	String	The file type.
File.MD5	String	The MD5 hash of the file.
File.Extension	String	The file extension.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and ZeroFox Key Incidents corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and ZeroFox Key Incidents.

Configuration parameters

url — URL (e.g., https://api.zerofox.com/) (required)
isFetch — Fetch incidents
credentials — Username (required)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Maximum number of incidents per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

zerofox-get-key-incident-attachment
Fetches a Key Incident Attachment by ID and uploads it to the current investigation War Room.

Source

ZeroFoxKeyIncidents.py ZeroFoxKeyIncidents_test.py ZeroFoxKeyIncidents.yml ZeroFoxKeyIncidents_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Haveli Investments
sectionorder:
- Connect
- Collect
commonfields:
  id: ZeroFoxKeyIncidents
  version: -1
configuration:
- defaultvalue: 'https://api.zerofox.com/'
  display: 'URL (e.g., https://api.zerofox.com/)'
  name: url
  required: true
  section: Connect
  type: 0
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  defaultvalue: 'true'
- display: Username
  name: credentials
  required: true
  section: Connect
  type: 9
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  defaultvalue: '10'
  required: false
  hidden: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: Cloud-based SaaS to detect risks found on social media and digital channels.
display: ZeroFox Key Incidents
name: ZeroFoxKeyIncidents
script:
  commands:
  - name: zerofox-get-key-incident-attachment
    description: Fetches a Key Incident Attachment by ID and uploads it to the current investigation War Room.
    arguments:
    - name: attachment_id
      required: true
      description: The ID of the Key Incident Attachment.
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  script: '-'
  type: python
  subtype: python3
  longRunning: false
  longRunningPort: false
  runonce: false
  isfetch: true
  ismappable: false
  isremotesyncin: true
  isremotesyncout: false
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.1.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)