decyfir

Details

ID	`decyfir`
Provider	CYFIRMA
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

DeCYFIR API’s provides External Threat Landscape Management insights.
This integration was integrated and tested with version v2 of decyfir

Configure DeCYFIR in Cortex

Parameter	Description	Required
Incident type		False
DeCYFIR Server URL (e.g. https://decyfir.cyfirma.com)		True
DeCYFIR API Key		True
Fetch incidents		False
Trust any certificate (not secure)		False
Use system proxy settings		False
How much time before the first fetch to retrieve incidents		False
Maximum number of incidents per fetch	The maximum number of incidents to fetch per sub-category.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

decyfir-takedown-initiate

Initiate a take down request.

Base Command

decyfir-takedown-initiate

Input

Argument Name	Description	Required
alert_id	The ID of the alert for which to initiate the take down request.	Required

Context Output

There is no context output for this command.

Command example

!decyfir-takedown-initiate alert_id=123

Human Readable Output

The take down request was initiated successfully.

decyfir-takedown-list

Get take down list.

Base Command

decyfir-takedown-list

Input

Argument Name	Description	Required
sub_category	The sub-category for which to retrieve the take down list. If not provided, the take down list for all sub-categories will be retrieved.	Optional
size	The number of records to retrieve. Default is 100.	Optional
page	The page number to retrieve. Default is 0.	Optional

Context Output

There is no context output for this command.

Command example

!decyfir-takedown-list

Human Readable Output

The take down list retrieved successfully..

Configuration parameters

incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
url — DeCYFIR Server URL (e.g. https://decyfir.cyfirma.com) (required)
api_key — (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — How much time before the first fetch to retrieve incidents
max_fetch — Maximum number of incidents per fetch

Commands (2)

decyfir-takedown-initiate
Initiate a take down request.
decyfir-takedown-list
Get take down list.

Source

decyfir.py decyfir_test.py decyfir.yml decyfir_description.md

Download History Raw

name: decyfir
description: DeCYFIR API's provides External Threat Landscape Management insights.
display: DeCYFIR
category: Data Enrichment & Threat Intelligence
provider: CYFIRMA
sectionorder:
- Connect
- Collect
commonfields:
  id: decyfir
  version: -1
configuration:
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: https://decyfir.cyfirma.com
  display: DeCYFIR Server URL (e.g. https://decyfir.cyfirma.com)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: DeCYFIR API Key
  name: api_key
  type: 9
  required: true
  hiddenusername: true
  display: ''
  section: Connect
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- defaultvalue: 30 days
  display: How much time before the first fetch to retrieve incidents
  name: first_fetch
  options:
  - 10 days
  - 15 days
  - 30 days
  - 60 days
  - 90 days
  required: false
  type: 15
  hidden: false
  section: Collect
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  required: false
  type: 0
  additionalinfo: The maximum number of incidents to fetch per sub-category.
  hidden: false
  section: Collect
script:
  commands:
  - deprecated: false
    description: Initiate a take down request.
    execution: false
    name: decyfir-takedown-initiate
    arguments:
    - name: alert_id
      required: true
      description: The ID of the alert for which to initiate the take down request.
    outputs:
  - deprecated: false
    description: Get take down list.
    execution: false
    name: decyfir-takedown-list
    arguments:
    - name: sub_category
      required: false
      description: The sub-category for which to retrieve the take down list. If not provided, the take down list for all sub-categories will be retrieved.
    - name: size
      required: false
      defaultValue: '100'
      description: The number of records to retrieve. If not provided, the default value is 100.
    - name: page
      required: false
      defaultValue: '0'
      description: The page number to retrieve. If not provided, the default value is 0.
    outputs:
    - contextPath: DeCYFIR.Takedown.Category
      description: Takedown category.
      type: String

    - contextPath: DeCYFIR.Takedown.SubCategory
      description: Takedown sub-category.
      type: String

    - contextPath: DeCYFIR.Takedown.Domain
      description: Associated domain.
      type: String

    - contextPath: DeCYFIR.Takedown.Status
      description: Current takedown request status.
      type: String

    - contextPath: DeCYFIR.Takedown.TicketName
      description: Takedown ticket identifier.
      type: String

    - contextPath: DeCYFIR.Takedown.TicketDetails
      description: Takedown request details.
      type: String

    - contextPath: DeCYFIR.Takedown.CreatedBy
      description: User who created the request.
      type: String

    - contextPath: DeCYFIR.Takedown.CreatedDate
      description: Request creation date.
      type: Date

    - contextPath: DeCYFIR.Takedown.ModifiedBy
      description: User who last modified the request.
      type: String

    - contextPath: DeCYFIR.Takedown.ModifiedDate
      description: Last modification date.
      type: Date

    - contextPath: DeCYFIR.Takedown.OnHoldByClient
      description: Whether the request is on hold by the client.
      type: Boolean

    - contextPath: DeCYFIR.Takedown.OnHoldByExternal
      description: Whether the request is on hold externally.
      type: Boolean

    - contextPath: DeCYFIR.Takedown.URLStatus
      description: URL takedown status.
      type: String

    - contextPath: DeCYFIR.Takedown.URLStatusUpdatedBy
      description: User who updated the URL status.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.5.0
tests:
- No tests (auto formatted)