Accenture CTI v2 (v2.2.49)
Accenture CTI provides intelligence regarding security threats and vulnerabilities.
- Author
- Accenture
- Support
- partner
- URL
- https://www.accenture.com/us-en/services/security/cyber-defense
- Categories
- Data Enrichment & Threat Intelligence
Indicator fields (12)
- ACTI Abstract
- ACTI Analysis
- ACTI Attachment Links
- ACTI Conclusion
- ACTI Index Timestamp
- ACTI Last Modified
- ACTI Last Published
- ACTI Mitigation
- ACTI Report Title
- ACTI Severity
- ACTI Threat Types
- ACTI UUID
Indicator types (6)
- ACTI Intelligence Alert
- ACTI Intelligence Report
- ACTI Malware Family
- ACTI Threat Actor
- ACTI Threat Campaign
- ACTI Threat Group
Integrations (2)
- ACTI Indicator Query
- ACTI Vulnerability Query
Layouts (6)
- ACTI Intelligence Alert
- ACTI Intelligence Report
- ACTI Malware Family
- ACTI Threat Actor
- ACTI Threat Campaign
- ACTI Threat Group
Playbooks (7)
- ACTI Block High Severity Indicators
- ACTI Block Indicators from an Incident
- ACTI Create Report-Indicator Associations
- ACTI Incident Enrichment
- ACTI Indicator Enrichment
- ACTI Report Enrichment
- ACTI Vulnerability Enrichment
Scripts (1)
- FormatACTIURL
README
Accenture CTI v2
This pack has 2 sub-pack/integration namely:
- ACTI Indicator Query
- ACTI Vulnerability Query
This pack automates the detection of threats and the triage/investigation of incidents by importing Accenture CTI (ACTI) data and intelligence reports into the XSOAR platform. The incident-enrichment functionality not only alleviates tedious research tasks traditionally performed by analysts, but also automatically folds ACTI intelligence reports associated with a given incident into the incident. The result is a complete picture of what ACTI knows about any given threat the moment the analyst opens the XSOAR incident.
_____
What to expect from the Accenture Cyber Threat Intelligence (Accenture CTI v2) pack?
- A playbook that automatically queries Accenture’s IntelGraph API to pull context for IOC and associated intelligence reports into XSOAR incidents.
- Reputation Commands to query for network-level indicators (IP, Domain, and URL).
- Command to query for ACTI intelligence reports.
- Command to query ACTI Vulnerability database.
- The pack also includes a playbook which helps to enrich indicators present in incident with related ACTI Intelligence Alert, ACTI Intelligence Report, ACTI Malware Family, ACTI Threat Actor, ACTI Threat Campaign, ACTI Threat Group if present in Accenture IntelGraph.