Dragos Worldview

Custom integration designed to pull in reports from the Dragos Worldview API as incidents.

Category

Data Enrichment & Threat Intelligence

Pack

DragosWorldview

Configuration parameters

• url — Server URL (e.g. https://portal.dragos.com) (required)
• credential_token — API Token
• credential_key — API Key
• apitoken — API Token
• apikey — API Key
• first_fetch — First fetch time
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentFetchInterval — Incidents Fetch Interval
• tlp_color — Traffic Light Protocol Color
• isFetch — Fetch incidents
• incidentType — Incident type
• max_fetch — Fetch Limit

Commands (4)

• dragos-get-full-report — Get the report file from the given serial number.
• dragos-get-indicators — Get Indicators from the Dragos WorldView API, if no arguments are provided the command will retrieve all indicators from the last 48 hours.
• dragos-get-ioc-csv — Get csv file with indicators from a given report.
• dragos-get-stix2 — Get the stix2 json bundle of indicators from a given report.