Cybersixgill_Actionable_Alerts

Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined organization assets, and automatically alerts users in real time of any relevant intelligence items.

Category

Data Enrichment & Threat Intelligence

Pack

Cybersixgill-ActionableAlerts

Configuration parameters

• client_id — Cybersixgill API client ID (required)
• client_secret — Cybersixgill API client secret (required)
• org_id — Cybersixgill Organization ID
• max_fetch — Maximum number of incidents to fetch - maximum is 25
• first_fetch_days — How many days back to fetch incidents on the first run - maximum is 30
• threat_level — Filter by alert threat level
• threat_type — Filter by alert threat type
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval

Commands (1)

• cybersixgill-update-alert-status — updates the existing actionable alert status.