Cofense Triage v2

Use the Cofense Triage integration to ingest reported phishing indicators.

Category

Data Enrichment & Threat Intelligence

Pack

CofenseTriage

Configuration parameters

• host — Server URL (e.g., https://192.168.0.1) (required)
• user — User (required)
• token — API Token (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• mailbox_location — Mailbox Location (required)
• date_range — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• category_id — Category ID to fetch
• match_priority — Match Priority - the highest match priority based on rule hits for the report
• tags — Tags - CSV list of tags of processed reports by which to filter
• max_fetch — Maximum number of incidents to fetch each time
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (7)

• cofense-get-attachment — Retrieves an attachment by the attachment ID number.
• cofense-get-report-by-id — Retrieves a report by the report ID number.
• cofense-get-report-png-by-id — Retrieves a report by the report ID number and displays as PNG.
• cofense-get-reporter — Retrieves Email address of the reporter by ID.
• cofense-get-threat-indicators — Threat Indicators that are designated by analysts as malicious, suspicious or benign.
• cofense-search-inbox-reports — Runs a query for reports from the `inbox` mailbox.
• cofense-search-reports — Runs a query for reports.