Add IOCs - Cofense Vision

Add or update IOCs in Cofense Vision.

Cofense Vision · 12 tasks · 8 inputs · 0 outputs

Inputs

  • source — A single IOC source value, to fetch the IOCs added or modified by that particular source. The value for source can contain uppercase letters, lowercase letters, numbers, and certain special characters ("." , "-" , "_" , "~"). Example: "Traige-1" or "IOC_Source-2".
  • threat_type — Type of the IOC. Supported values: Domain, MD5, Sender, SHA256, Subject, or URL.
  • threat_value — The actual value of the IOC match in the email.
  • threat_level — The severity of the IOC.
  • created_at — The UTC date and time, the IOC source included the IOC for the first time.
  • updated_at — The UTC date and time, the IOC source last updated the IOC.
  • source_id — The unique identifier assigned by the IOC source.
  • requested_expiration — The expected UTC expiration date and time. The IOC repository calculates an expiration date and time for the new IOC by default 14 days after the IOC is delivered to the IOC repository.

Commands used

cofense-iocs-update

Flowchart

true Start Start Set Threat Type Field - Set Set Threat Type Field Set Add IOCs - cofense-iocs-update Add IOCs cofense-iocs-update Set Threat Value Field - Set Set Threat Value Field Set Set Threat Level Field - Set Set Threat Level Field Set Set Created At Field - Set Set Created At Field Set Set Updated At Field - Set Set Updated At Field Set Set Source Id Field - Set Set Source Id Field Set Set Requested Expiration Field - Set Set Requested Expiration ... Set Done Done Get IOC Details - Set Get IOC Details Set Is Cofense Vision Integration Enable? Is Cofense Vision Integra...