Cofense Vision

The Cofense Vision integration provides commands to initiate advanced search jobs to hunt suspicious emails matching IOCs. It also contains commands to quarantine emails, download messages and their attachments, and aids to manage IOCs in the local repository to keep up with upcoming emerging threats.

Category

Data Enrichment & Threat Intelligence

Pack

CofenseVision

Configuration parameters

• url — Server URL (required)
• credentials — Client ID (required)
• threat_levels_good — Threat levels to be marked as Good
• threat_levels_suspicious — Threat levels to be marked as Suspicious
• threat_levels_bad — Threat levels to be marked as Bad
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (22)

• cofense-ioc-delete — Deletes a single active or expired IOC from the local IOC Repository.
• cofense-ioc-get — Retrieves the IOC identified by its unique MD5 ID.
• cofense-ioc-update — Updates the IOC identified by its unique MD5 ID.
• cofense-iocs-list — Lists the IOCs stored in the local IOC Repository.
• cofense-iocs-update — Updates one or more IOCs stored in the local IOC repository. To update multiple IOCs use iocs_json argument. Note: iocs_json parameter will take precedence over other parameters. threat_type, threat_value, threat_level, created_at and source_id are required parameters to update a single IOC.
• cofense-last-ioc-get — Synchronizes the update of data between the IOC source and the IOC repository. Retrieves the last updated IOC from the local IOC Repository. It may return an active or an expired IOC.
• cofense-message-attachment-get — Fetches the full content of an email and returns a zip file.
• cofense-message-get — Fetches full content of an email and returns it as a zip file using a token.
• cofense-message-metadata-get — Retrieves the full content of a message that matches the specified Internet message ID and recipient email address of an email.
• cofense-message-search-create — Creates a new search.
• cofense-message-search-get — Retrieves the result of the search identified by an ID.
• cofense-message-search-results-get — Retrieves the results for the search identified by the search ID.
• cofense-message-searches-list — Retrieves the list of searches.
• cofense-message-token-get — Retrieves a one-time token that can be used to get an email's content.
• cofense-quarantine-job-approve — Approves the quarantine job identified by its unique ID. When the "Auto Quarantine" feature is configured which requires manual approvals, this command can approve all the pending quarantine jobs.
• cofense-quarantine-job-create — Creates a new quarantine job.
• cofense-quarantine-job-delete — Deletes the quarantine job identified by its unique ID.
• cofense-quarantine-job-get — Retrieves quarantine job identified by its unique ID.
• cofense-quarantine-job-restore — Restores emails quarantined by the job identified by its unique ID.
• cofense-quarantine-job-stop — Issues a request to stop the quarantine job identified by its unique ID.
• cofense-quarantine-jobs-list — Filters and returns a paginated list of matching quarantine jobs.
• cofense-searchable-headers-list — Retrieves a list of configured header keys that can be used to create a message search.