Flashpoint

Deprecated. Use Flashpoint Ignite instead.

Category

Data Enrichment & Threat Intelligence

Pack

Flashpoint

Configuration parameters

• isFetch — Fetch incidents
• incidentType — Incident type
• url — Server URL (required)
• api_key — API Key (required)
• max_fetch — Maximum number of incidents per fetch
• first_fetch — First fetch time interval
• fetch_type — Fetch Type
• is_fresh_compromised_credentials — Fetch fresh compromised credentials alerts
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• create_relationships — Create relationships
• integrationReliability — Source Reliability
• feedExpirationPolicy —
• feedExpirationInterval —

Commands (20)

• domain — Lookup the "Domain" type indicator details. The reputation of Domain is considered Malicious if there's at least one IOC event in Flashpoint database matching the Domain indicator.
• email — Lookup the "Email" type indicator details. The reputation of Email is considered Malicious if there's at least one IOC event in Flashpoint database matching the Email indicator.
• file — Lookup the "File" type indicator details. The reputation of File-hash is considered Malicious if there's at least one IOC event in Flashpoint database matching the File-hash indicator.
• filename — Lookup the "Filename" type indicator details. The reputation of Filename is considered Malicious if there's at least one IOC event in Flashpoint database matching the Filename indicator.
• flashpoint-alert-list — Retrieves an alert or a list of alerts based on the filter values provided in the command arguments. Yields the alerts from Flashpoint collected sources and the alerts from data exposure.
• flashpoint-common-lookup — Lookup any type of indicator.
• flashpoint-compromised-credentials-list — Retrieves the compromised credentials based on the filter values provided in the command arguments.
• flashpoint-get-events — Searches for events within the specified time-period, the report fpid, or attack IDs.
• flashpoint-get-forum-details — Retrieves forum details using the forum ID. To retrieve the forum ID run the flashpoint-search-forum-posts command and see the value under the following context paths, Flashpoint.Forum.ForumId or Flashpoint.Forum.Post.Forum.id.
• flashpoint-get-forum-post-details — Retrieves post details using the post-id. To retrieve the post ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.PostId context path. command or some other investigation.
• flashpoint-get-forum-room-details — Retrieves forum room details using the room ID. To retrieve the room ID run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.Room.id context path.
• flashpoint-get-forum-user-details — Retrieves user details using the user-id. To retrieve the user ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.User.id context path.
• flashpoint-get-related-reports — Get related reports for a particular report using the report-id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation.
• flashpoint-get-single-event — Retrieves the details of a single event using event UUID or FPID. To retrieve the event id, run the get-events command and see the value under the Flashpoint.Event.EventId context path. or indicator reputation command response or some other investigation.
• flashpoint-get-single-intelligence-report — Get single report details using the report id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation.
• flashpoint-search-forum-posts — Search forum posts using a keyword.
• flashpoint-search-forum-sites — Searches forum sites using a keyword. it will search in site content like name, title, descripion etc.
• flashpoint-search-intelligence-reports — Search for the Intelligence Reports using a keyword.
• ip — Looks up details of an IP indicator. The reputation of the IP address is considered malicious if there's at least one IOC event in the Flashpoint database that matches the IP indicator. Alternatively, the IP address is considered suspicious if it matches any one of the Torrent's Peer IP Address or Forum Visit's Peer IP Address.
• url — Lookup the "URL" type indicator details. The reputation of Url is considered Malicious if there's at least one IOC event in Flashpoint database matching the Url indicator.