EclecticIQ Intelligence Center v3

Threat Intelligence Platform that connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships .

Category

Data Enrichment & Threat Intelligence

Pack

EclecticIQ

Configuration parameters

• url — EclecticIQ Intelligence Center URL (e.g. https://eclecticiq-platform.local) (required)
• eiq_token — API user token to authenticate in EclecticIQ Intelligence Center (required)
• eiq_api_version — EclecticIQ Intelligence Center public API version (required)
• ip_threshold — IP threshold. Minimum maliciousness confidence level to consider the IP address malicious: High, Medium, Low, Safe, Unknown
• url_threshold — URL threshold. Minimum maliciousness confidence level to consider the URL malicious: High, Medium, Low, Safe, Unknown
• file_threshold — File threshold. Minimum maliciousness confidence level to consider the file malicious: High, Medium, Low, Safe, Unknown
• email_threshold — Email threshold. Minimum maliciousness confidence level to consider the email address malicious: High, Medium, Low, Safe, Unknown
• domain_threshold — Domain threshold. Minimum maliciousness confidence level to consider the domain malicious: High, Medium, Low, Safe, Unknown
• group_name — Group name in EclecticIQ Intelligence Center to use as entities source
• sightings_auto_creation — Create sightings automatically in EclecticIQ Intelligence Center when reputation check command executed.
• feed — Fetch indicators
• feedReputation — Indicator Reputation
• feedReliability — Source Reliability (required)
• feedExpirationPolicy —
• feedExpirationInterval —
• feedFetchInterval — Feed Fetch Interval
• feedBypassExclusionList — Bypass exclusion list
• feedId — Feed IDs to fetch
• feedIncremental —
• feedTags — Tags
• tlp_color — Traffic Light Protocol Color
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (15)

• domain — Gets the reputation of a domain observable.
• eclecticiq-create-indicator — Creates Indicator Entity in EclecticIQ IC.
• eclecticiq-create-sighting — Creates Sighting in EclecticIQ IC.
• eclecticiq-get-entity — Query EclecticIQ Intelligence Center for entities.
• eclecticiq-get-entity-by-id — Query EclecticIQ Intelligence Center for entity by its ID.
• eclecticiq-get-indicators — Get last block of Indicators from configured to fetch Outgoing feed.
• eclecticiq-request-delete — Make HTTP DELETE request to EclecticIQ Intelligence Center.
• eclecticiq-request-get — Make HTTP GET request to EclecticIQ Intelligence Center.
• eclecticiq-request-patch — Make HTTP PATCH request to EclecticIQ Intelligence Center.
• eclecticiq-request-post — Make HTTP POST request to EclecticIQ Intelligence Center.
• eclecticiq-request-put — Make HTTP PUT request to EclecticIQ Intelligence Center.
• email — Gets the reputation of an email address observable.
• file — Gets the reputation of a file hash observable.
• ip — Get reputation of IP address observable.
• url — Gets the reputation of a URL observable.