Doppel
Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively. The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.
- Category
- Data Enrichment & Threat Intelligence
- Pack
- Doppel
Configuration parameters
- url — Doppel Tenant URL (required)
- credentials — (required)
- user_credentials —
- organization_code — Organization Code
- isFetch — Fetch incidents
- incidentFetchInterval — Incidents Fetch Interval (required)
- incidentType — Incident type
- mirror_direction — Mirror Direction
- first_fetch — First fetch
- fetch_timeout — Fetch incidents timeout
- max_fetch — Number of incidents for each fetch.
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (9)
- doppel-create-abuse-alert — Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.
- doppel-create-alert — Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.
- doppel-get-alert — Retrieves the alert details by ID or entity. Must include either ID or entity.
- doppel-get-alerts — Retrieves a list of alerts. The result can be filtered by provided parameters.
- doppel-update-alert — Updates an alert in the Doppel platform. Either 'alert_id' or 'entity' must be specified.
- get-mapping-fields — Returns the list of fields for an incident type.
- get-modified-remote-data — Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
- get-remote-data — Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
- update-remote-system — Pushes local changes to the remote system.