category: Data Enrichment & Threat Intelligence
provider: AnyRun
sectionorder:
- Connect
- Collect
commonfields:
  id: ANY.RUN TI Feed
  version: -1
configuration:
- display: Username.
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: 'Use system proxy settings'
  name: proxy
  type: 8
  required: false
  section: Connect
- display: 'Modified after.'
  name: modified_after
  defaultvalue: 2025-01-01
  type: 0
  required: false
  additionalinfo: Receive IOCs after specified date.
  section: Collect
- display: 'Fetch indicators'
  name: feed
  defaultvalue: 'true'
  type: 8
  required: false
  section: Collect
- display: 'Indicator Reputation'
  name: feedReputation
  defaultvalue: Bad
  type: 18
  required: false
  options:
  - 'None'
  - 'Good'
  - 'Suspicious'
  - 'Bad'
  section: Collect
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
- display: 'Source Reliability'
  name: feedReliability
  type: 15
  required: false
  section: Collect
  defaultvalue: A - Completely reliable
  options:
  - 'A - Completely reliable'
  - 'B - Usually reliable'
  - 'C - Fairly reliable'
  - 'D - Not usually reliable'
  - 'E - Unreliable'
  - 'F - Reliability cannot be judged'
  additionalinfo: 'Reliability of the source providing the intelligence data'
- display: ""
  name: feedExpirationPolicy
  defaultvalue: "never"
  type: 17
  required: false
  section: Collect
  options:
  - never
  - interval
  - indicatorType
- display: ""
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- name: feedFetchInterval
  display: 'Feed Fetch Interval'
  type: 19
  section: Collect
  defaultvalue: "120"
  required: false
- display: 'Bypass exclusion list'
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  additionalinfo: 'When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.'
  defaultvalue: 'false'
- name: feedTags
  display: Tags
  type: 0
  section: Collect
  additionalinfo: Supports CSV values.
- additionalinfo: Whether the feed should pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental Feed
  hidden: true
  name: feedIncremental
  type: 8
  section: Collect
  required: false
- display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
description: Threat Intelligence Feeds provide data on the known indicators of compromise such as malicious IPs, URLs, Domains.
display: ANY.RUN TI Feed
name: ANY.RUN TI Feed
script:
  dockerimage: demisto/anyrun-sdk:1.0.0.10440656
  subtype: python3
  runonce: false
  script: '-'
  type: python
  feed: true
tests:
- No tests
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam