Analyst1

This integration utilizes Analyst1's system to enrich XSOAR indicators with data provided by the Analyst1 REST API, such as actor and malware information, activity and reported dates, evidence and hit counts, and more.

Category

Data Enrichment & Threat Intelligence

Pack

illuminate

Configuration parameters

• auth_method — Authentication Method (required)
• credentials — Client ID/Username (required)
• server — Domain of Analyst1 server to use (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• integrationReliability — Source Reliability
• riskScoreLowest — Risk Score Mapping: Lowest
• riskScoreLow — Risk Score Mapping: Low
• riskScoreModerate — Risk Score Mapping: Moderate
• riskScoreHigh — Risk Score Mapping: High
• riskScoreCritical — Risk Score Mapping: Critical
• riskScoreUnknown — Risk Score Mapping: Unknown
• applyTags — Apply Analyst1 entity-type tags to indicators
• feedExpirationPolicy —
• feedExpirationInterval —

Commands (20)

• analyst1-batch-check — Queries the Analyst1 REST API for indicator enrichment data based on a CSV input of multiple indicator values.
• analyst1-batch-check-post — Similar to analyst1-batch-check, however the inputs can be more complex. The 'values' input accepts comma or newline delimited text. This allows for more complex Indicators or larger Indicator sets to be searched. The 'values_array' allows for preformed array inputs or array-like inputs to be submitted. Output is the same.
• analyst1-enrich-http-request — Queries the Analyst1 REST API and enriches the given HTTP request with Analyst1 indicator data.
• analyst1-enrich-ipv6 — Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data.
• analyst1-enrich-mutex — Queries the Analyst1 REST API and enriches the given mutex with Analyst1 indicator data.
• analyst1-enrich-string — Queries the Analyst1 REST API and enriches the given string with Analyst1 indicator data.
• analyst1-evidence-file-fetch — Download an evidence file from Analyst1 by its ID.
• analyst1-evidence-search — Search for evidence in Analyst1 using filters and search terms.
• analyst1-evidence-status — Check on the status of the analyst1-evidence-submit action by using its output UUID.
• analyst1-evidence-submit — Submits an 'Evidence' to Analyst1. Submission can be any text or attachment (PDF, JSON,DOCX...). The a1Bot will extract all relevant context. The 'Evidence' can from an external source (email attachment, secure download) or constructed text/JSON within XSOAR to communicate intelligence results back to Analyst1.
• analyst1-get-sensor-config — Queries the Analyst1 REST API for the current sensor config given a valid Sensor ID. This config file is meant to be directly provided to a device (IDS, IPS, Firewall, SNORT...) for configuration replacements.
• analyst1-get-sensor-diff — Gets the 'difference' from the last known Analyst1 Sensor version against the current. Returns all differences on the Sensor since the 'version' provided and includes the current version in the reply. Current version should be preserved to be used on next scheduled invocation.
• analyst1-get-sensor-taskings — Queries the Analyst1 REST API for the current sensor taskings given a valid Sensor ID. This can be used to start subscription to an Sensor ID. The result gives the version (which can later be used to invoke 'diff') and all current taskings. Note: This operation may trigger XSOAR to "oversize" the task built on this automation. If so, you may need to turn off quiet mode explicitly. The analyst1-get-sensor-config can alternatively be used to get a simple text file of current indicators or signatures.
• analyst1-get-sensors — Queries the Analyst1 REST API to retrieve a list of registered sensors.
• analyst1-indicator-by-id — Gets the full JSON for an Analyst1 Indicator given the internal Analyst1 Indicator ID. Use this when full Indicator context is required for additional processing. This always includes all sources, enrichments, and every piece of information available in the Analyst1 platform, including integrated system's original enrichment JSON or results.
• domain — Queries the Analyst1 REST API and enriches the given domain with Analyst1 Indicator data.
• email — Queries the Analyst1 REST API and enriches the given email with Analyst1 indicator data.
• file — Queries the Analyst1 REST API and enriches the given file with Analyst1 indicator data.
• ip — Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data.
• url — Queries the Analyst1 REST API and enriches the given URL with Analyst1 indicator data.