commonfields:
  id: Cofense Triage
  version: -1
name: Cofense Triage
description: Deprecated. Use the Cofense Triage v2 integration instead.
display: Cofense Triage (Deprecated)
deprecated: true
category: Data Enrichment & Threat Intelligence
provider: Cofense
configuration:
- display: Server URL (e.g., https://192.168.0.1)
  name: host
  defaultvalue: ""
  type: 0
  required: true
- display: User
  name: user
  defaultvalue: ""
  type: 0
  required: true
- display: API Token
  name: token
  defaultvalue: ""
  type: 4
  required: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: date_range
  defaultvalue: 3 days
  type: 0
  required: false
- display: Category ID to fetch - corresponds to the ranking that determines the Cofense Triage prioritization (1-5)
  name: category_id
  defaultvalue: ""
  type: 0
  required: false
- display: Match Priority - the highest match priority based on rule hits for the report
  name: match_priority
  defaultvalue: ""
  type: 0
  required: false
- display: 'Tags - CSV list of tags of processed reports by which to filter '
  name: tags
  defaultvalue: ""
  type: 0
  required: false
- display: Maximum number of incidents to fetch each time
  name: max_fetch
  defaultvalue: "30"
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: cofense-search-reports
    arguments:
    - name: file_hash
      description: File hash, MD5 or SHA256.
    - name: url
      description: The reported URLs.
    - name: subject
      description: Report's subject
    - name: reported_at
      description: 'Retrieve reports that were reported after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: created_at
      description: 'Retrieve reports that were created after this time, for example: "2 hours, 4 minutes, 6 month, 1 day".'
      defaultValue: 60 days
    - name: reporter
      description: Name or ID of the reporter.
    - name: max_matches
      default: true
      description: Maximum number of matches to fetch. Default is 30.
      defaultValue: "30"
    - name: verbose
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Returns all fields of a report.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report.
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: 'Runs a query for reports.'
  - name: cofense-get-attachment
    arguments:
    - name: attachment_id
      required: true
      description: ID of the attachment.
    outputs:
    - contextPath: Cofense.Attachment.ID
      description: The ID number of the report that contains the attachment.
      type: string
    - contextPath: Cofense.File.Size
      description: The date and time (in UTC) when the threat was found on the device.
      type: string
    - contextPath: Cofense.File.EntryID
      description: The file path where the threat was found on the device.
      type: string
    - contextPath: Cofense.File.Name
      description: The name of the threat.
      type: string
    - contextPath: Cofense.File.SHA1
      description: The SHA1 hash of the threat.
      type: string
    - contextPath: Cofense.File.SHA256
      description: The SHA256 hash of the threat.
      type: string
    - contextPath: Cofense.File.MD5
      description: The MD5 hash of the threat.
      type: string
    description: 'Retrieves an attachment by the attachment ID number. '
  - name: cofense-get-reporter
    arguments:
    - name: reporter_id
      required: true
      description: ID of the reporter.
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID of the reporter.
    - contextPath: Cofense.Report.Email
      description: Reporter email address.
    description: Retrieves Email address of the reporter by ID
  - name: cofense-get-report-by-id
    arguments:
    - name: report_id
      required: true
      description: ID of the report
    outputs:
    - contextPath: Cofense.Report.ID
      description: ID number of the report
    - contextPath: Cofense.Report.EmailAttachments
      description: Email attachments.
    - contextPath: Cofense.Report.EmailAttachments.id
      description: Email attachment ID.
    - contextPath: Cofense.Report.Tags
      description: Report tags.
      type: string
    - contextPath: Cofense.Report.ClusterId
      description: Cluster ID number.
      type: number
    - contextPath: Cofense.Report.CategoryId
      description: Report category.
      type: number
    - contextPath: Cofense.Report.CreatedAt
      description: Report creation date.
      type: date
    - contextPath: Cofense.Report.ReportedAt
      description: Reporting time.
      type: string
    - contextPath: Cofense.Report.MatchPriority
      description: The highest match priority based on rule hits for the report.
      type: number
    - contextPath: Cofense.Report.ReporterId
      description: Reporter ID.
      type: number
    - contextPath: Cofense.Report.Location
      description: Location of the report.
      type: string
    - contextPath: Cofense.Report.Reporter
      description: Reporter email address.
      type: string
    - contextPath: Cofense.Report.SuspectFromAddress
      description: Suspect from address.
      type: string
    - contextPath: Cofense.Report.ReportSubject
      description: Report subject.
      type: string
    - contextPath: Cofense.Report.ReportBody
      description: Report body.
      type: string
    - contextPath: Cofense.Report.Md5
      description: MD5 hash of the file.
      type: number
    - contextPath: Cofense.Report.Sha256
      description: SHA256 hash of the file.
    description: 'Retrieves a report by the report ID number. '
  dockerimage: demisto/python3:3.8.3.8715
  isfetch: true
tests:
- No test
fromversion: 5.0.0