category: Data Enrichment & Threat Intelligence provider: Cofense commonfields: id: Cofense Triage v3 version: -1 sectionorder: - Connect - Collect configuration: - additionalinfo: Server URL to connect to Cofense Triage. display: Server URL name: url required: true type: 0 section: Connect - additionalinfo: Client ID and Client Secret associated with the Server URL to connect to Cofense Triage. display: Client ID displaypassword: Client Secret name: credentials required: true type: 9 section: Connect - additionalinfo: The maximum limit is 200. defaultvalue: '15' display: Maximum number of incidents per fetch name: max_fetch type: 0 required: false section: Collect - additionalinfo: 'Date or relative timestamp to start fetching incidents from. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc)' defaultvalue: 3 days display: First fetch time interval name: first_fetch type: 0 required: false section: Collect - additionalinfo: Fetches the report based on the location within Cofense Triage. If not specified, it fetches all the reports. display: Report Location name: mailbox_location options: - Inbox - Reconnaissance - Processed type: 16 required: false section: Collect - additionalinfo: Fetches reports based on the priority of the rules that match the reports. If not specified, it fetches all the reports. display: Match Priority name: match_priority options: - '0' - '1' - '2' - '3' - '4' - '5' type: 16 required: false section: Collect - additionalinfo: |- Fetches reports based on the unique identifier of the category. If not specified, it fetches all the reports. Note: Only the reports that have been processed will be retrieved. display: Category ID name: category_id type: 0 required: false section: Collect - additionalinfo: "Fetches reports based on the tags associated with the reports. If not specified, it fetches all the reports.\nSupports comma separated values. \nNote: Tags are associated with reports which are in Reconnaissance." display: Tags name: tags type: 0 required: false section: Collect - additionalinfo: |- Fetches reports based on the tags assigned when the reported email was processed. If not specified, it fetches all the reports. Supports comma separated values. Note: Categorization tags are associated with the reports which are processed. display: Categorization Tags name: categorization_tags type: 0 required: false section: Collect - additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Cofense Triage to XSOAR).' defaultvalue: None display: Incident Mirroring Direction hidden: - marketplacev2 - platform name: mirror_direction options: - None - Incoming type: 15 required: false section: Collect - additionalinfo: |- Fetches incidents based on the advanced filters and type of the incident to be fetched. Specify the filters to filter the incidents by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Format accepted: {"attribute1_operator": "value1, value2", "attribute2_operator" : "value3, value4"} For example: {"updated_at_gt":"2020-10-26T10:48:16.834Z","categorization_tags_any":"test, snow"} display: Advanced Filters name: filter_by type: 12 required: false section: Collect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Incident type name: incidentType type: 13 section: Collect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Fetch incidents name: isFetch type: 8 required: false section: Collect description: The integration uses the Cofense Triage v2 API that allows users to ingest phishing reports as incident alerts and execute commands such as threat indicators, reporters, categorize reports, and more. display: Cofense Triage v3 name: Cofense Triage v3 script: commands: - arguments: - description: |- Specify the ID of the threat indicator to retrieve a specific threat indicator. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of threat indicators to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the threat indicators. name: page_number - description: 'Specify the attributes to sort the threat indicators. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: threat_level, -created_at.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of threat indicators by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"threat_level_eq\":\"Malicious,Benign\", \"updated_at_gt\":\"2020-10-26T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: threat_level, threat_type, threat_value.' isArray: true name: fields_to_retrieve - description: 'Specify the level of the threat to retrieve the threat indicators. Some possible values are: Malicious, Suspicious, Benign.' isArray: true name: threat_level - description: 'Specify the type of the threat to retrieve the threat indicators. Some possible values are: Sender, Subject, Domain, URL, MD5, SHA256, Hostname, or Header.' isArray: true name: threat_type - description: Specify the value corresponding to the type of threat indicated in threat_type to retrieve the threat indicators. isArray: true name: threat_value - description: Specify the value corresponding to the source of the threat indicator. isArray: true name: threat_source - description: 'Specify the date and time of creation, from when to retrieve the threat indicators. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the threat indicators. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: "Retrieves the list of threat indicators based on the provided parameters. \nThreat indicators identify the threat level of an email's subject, sender, domains, URLs, and MD5 and SHA256 attachment hash signatures." name: cofense-threat-indicator-list outputs: - contextPath: Cofense.ThreatIndicator.id description: Unique identifier of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.ThreatIndicator.links.self description: Link of the resource. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_level description: The level of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_type description: The type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_value description: Value corresponding to the type of threat indicated in the type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_source description: Value corresponding to the source of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.ThreatIndicator.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.ThreatIndicator.relationships.owner.links.self description: Link to retrieve the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.links.related description: Link to retrieve the detailed information of the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.type description: Type of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.id description: Unique identifier of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.self description: Link to retrieve the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.related description: Link to retrieve the detailed information of the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.self description: Link to retrieve the comments containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.related description: Link to retrieve the detailed information of the comments containing the threat indicator. type: String - arguments: - description: "Specify the ID of the report to retrieve a specific report. \nNote: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected." name: id - defaultValue: '20' description: 'Specify the number of reports to retrieve per page. Note: Possible values are between 1 and 200. ' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the reports. name: page_number - description: 'Specify the attributes to sort the reports. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -received_at, match_priority.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of reports by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"updated_at_gt\":\"2020-10-26T10:48:16.834Z\",\"categorization_tags_any\":\"test, snow\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: location, from_address.' name: fields_to_retrieve - description: 'Specify the priority to retrieve the reports based on the priority of the rules that match the reports. Possible values are: 0, 1, 2, 3, 4, 5.' isArray: true name: match_priority - description: Specify the tags to retrieve the reports based on the tags associated with the reports. isArray: true name: tags - description: Specify the categorization tags to retrieve the reports based on the tags assigned when the reported email was processed. isArray: true name: categorization_tags - description: 'Specify the location to retrieve the reports based on the location of the reported email within Cofense Triage. Some possible values are: inbox, reconnaissance, processed.' isArray: true name: report_location - description: |- Specify the ID of the category to retrieve the reports based on the category of the reports. Note: When both category_id and cluster_id are provided, higher priority will be given to category_id. Note: To retrieve category_id, execute cofense-category-list command. name: category_id - description: 'Specify the date and time of creation, from when to retrieve the reports. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the reports. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at - description: "Specify the ID of the cluster to retrieve the reports present in the specific cluster. Note: When both category_id and cluster_id are provided, higher priority will be given to category_id. \nNote: To retrieve cluster_id, execute cofense-cluster-list command." name: cluster_id description: Retrieves a report or a list of reports based on the filter values provided in the command arguments. name: cofense-report-list outputs: - contextPath: Cofense.Report.id description: Unique identifier of the report. type: String - contextPath: Cofense.Report.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Report.links.self description: Link of the resource. type: String - contextPath: Cofense.Report.attributes.location description: | Location of the reported email within Triage. (Inbox, Reconnaissance, or Processed). type: String - contextPath: Cofense.Report.attributes.risk_score description: Risk score of the report. type: Number - contextPath: Cofense.Report.attributes.from_address description: Sender email address of the reported email. type: String - contextPath: Cofense.Report.attributes.subject description: Subject of the reported email. type: String - contextPath: Cofense.Report.attributes.received_at description: Date and time, in ISO 8601 format, when the reporter received the email. type: Date - contextPath: Cofense.Report.attributes.reported_at description: Date and time, in ISO 8601 format, when the reporter reported the email. type: Date - contextPath: Cofense.Report.attributes.raw_headers description: Headers of the reported email. type: String - contextPath: Cofense.Report.attributes.text_body description: Text body of the reported email. type: String - contextPath: Cofense.Report.attributes.html_body description: HTML body of the reported email. type: String - contextPath: Cofense.Report.attributes.md5 description: MD5 hash signature of the reported email. type: String - contextPath: Cofense.Report.attributes.sha256 description: SHA256 hash signature of the reported email. type: String - contextPath: Cofense.Report.attributes.match_priority description: Highest priority of a rule matching the reported email. type: Number - contextPath: Cofense.Report.attributes.tags description: Tags associated with the report. type: Unknown - contextPath: Cofense.Report.attributes.categorization_tags description: Tags assigned when the reported email was processed. type: Unknown - contextPath: Cofense.Report.attributes.processed_at description: Date and time, in ISO 8601 format, when the reported email was processed. If the reported email is still in Inbox or Recon, the response contains a null value. type: Date - contextPath: Cofense.Report.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Report.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Report.relationships.assignee.links.self description: Link to retrieve the operator assigned to the report. type: String - contextPath: Cofense.Report.relationships.assignee.links.related description: Link to retrieve the detailed information of the operator assigned to the report. type: String - contextPath: Cofense.Report.relationships.assignee.data.type description: Type of the assignee associated with the report. type: String - contextPath: Cofense.Report.relationships.assignee.data.id description: Unique identifier of the assignee associated with the report. type: String - contextPath: Cofense.Report.relationships.category.links.self description: Link to retrieve the category assigned to the report. type: String - contextPath: Cofense.Report.relationships.category.links.related description: Link to retrieve the detailed information of the category assigned to the report. type: String - contextPath: Cofense.Report.relationships.category.data.type description: Type of the category associated with the report. type: String - contextPath: Cofense.Report.relationships.category.data.id description: Unique identifier of the category associated with the report. type: String - contextPath: Cofense.Report.relationships.cluster.links.self description: Link to retrieve the cluster of the report. type: String - contextPath: Cofense.Report.relationships.cluster.links.related description: Link to retrieve the detailed information of the cluster of the report. type: String - contextPath: Cofense.Report.relationships.cluster.data.type description: Type of the cluster context associated with the report. type: String - contextPath: Cofense.Report.relationships.cluster.data.id description: Unique identifier of the cluster context associated with the report. type: String - contextPath: Cofense.Report.relationships.reporter.links.self description: Link to retrieve the reporter of the report. type: String - contextPath: Cofense.Report.relationships.reporter.links.related description: Link to retrieve the detailed information of the reporter of the report. type: String - contextPath: Cofense.Report.relationships.reporter.data.type description: Type of the reporter associated with the report. type: String - contextPath: Cofense.Report.relationships.reporter.data.id description: Unique identifier of the reporter associated with the report. type: String - contextPath: Cofense.Report.relationships.attachment_payloads.links.self description: Link to retrieve the payloads of attachments associated with the report. type: String - contextPath: Cofense.Report.relationships.attachment_payloads.links.related description: Link to retrieve the detailed information of the payloads of attachments associated with the report. type: String - contextPath: Cofense.Report.relationships.attachments.links.self description: Link to retrieve the attachments to the reported email. type: String - contextPath: Cofense.Report.relationships.attachments.links.related description: Link to retrieve the detailed information of the attachments to the reported email. type: String - contextPath: Cofense.Report.relationships.domains.links.self description: Link to retrieve the domain of the report. type: String - contextPath: Cofense.Report.relationships.domains.links.related description: Link to retrieve the detailed information of the domain of the report. type: String - contextPath: Cofense.Report.relationships.headers.links.self description: Link to retrieve the headers of the report. type: String - contextPath: Cofense.Report.relationships.headers.links.related description: Link to retrieve the detailed information of the headers of the report. type: String - contextPath: Cofense.Report.relationships.hostnames.links.self description: Link to retrieve the hostnames of URLs associated with the report. type: String - contextPath: Cofense.Report.relationships.hostnames.links.related description: Link to retrieve the detailed information of the hostnames of URLs associated with the report. type: String - contextPath: Cofense.Report.relationships.urls.links.self description: Link to retrieve the URLs associated with the report. type: String - contextPath: Cofense.Report.relationships.urls.links.related description: Link to retrieve the detailed information of the URLs associated with the report. type: String - contextPath: Cofense.Report.relationships.rules.links.self description: Link to retrieve the rules matching the report. type: String - contextPath: Cofense.Report.relationships.rules.links.related description: Link to retrieve the detailed information of the rules matching the report. type: String - contextPath: Cofense.Report.relationships.threat_indicators.links.self description: Link to retrieve the threat indicators identified the report. type: String - contextPath: Cofense.Report.relationships.threat_indicators.links.related description: Link to retrieve the detailed information of the threat indicators identified the report. type: String - contextPath: Cofense.Report.relationships.comments.links.self description: Link to retrieve the comments of the report. type: String - contextPath: Cofense.Report.relationships.comments.links.related description: Link to retrieve the detailed information of the comments of the report. type: String - contextPath: Cofense.Report.meta.risk_score_summary.integrations description: Number of integrations associated with the report. type: Number - contextPath: Cofense.Report.meta.risk_score_summary.vip description: Number of VIP reporters of the report. type: Number - contextPath: Cofense.Report.meta.risk_score_summary.reporter description: Number of reporters of the report. type: Number - contextPath: Cofense.Report.meta.risk_score_summary.rules description: Number of the rules associated with the report. type: Number - arguments: - description: |- Specify the ID of the report to download the email file. Note: To retrieve id, execute cofense-report-list command. name: id required: true description: Downloads the raw email for the report that matches the specified report ID. name: cofense-report-download outputs: - contextPath: File.Size description: File size in bytes. type: String - contextPath: File.SHA1 description: SHA1 hash of file. type: String - contextPath: File.SHA256 description: SHA256 hash of file. type: String - contextPath: File.SHA512 description: SHA512 hash of file. type: String - contextPath: File.Name description: File name. type: String - contextPath: File.SSDeep description: SSDeep hash of the file. type: String - contextPath: File.EntryID description: The entry ID of the file. type: Unknown - contextPath: File.Info description: File information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - arguments: - description: |- Specify the ID of the report to be categorized. Note: To retrieve id, execute cofense-report-list command. name: id required: true - description: |- Specify the ID of the category in which report is to be categorized. Note: To retrieve category_id, execute cofense-category-list command. name: category_id required: true - description: Specify the tags that are to be assigned to the report. name: categorization_tags description: Categorizes a report into a specific category provided by the user. name: cofense-report-categorize - arguments: - description: |- Specify the ID of the category to retrieve a specific category. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of categories to retrieve per page. Note: Possible values are between 1 and 200. ' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the categories. name: page_number - description: 'Specify the attributes to sort the categories. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: score, -name.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of categories by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"score_gteq\":\"2,10\", \"updated_at_gt\":\"2020-10-26T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: name, score.' isArray: true name: fields_to_retrieve - description: Specify the name of the category to retrieve the category accordingly. isArray: true name: name - auto: PREDEFINED description: 'Specify that the categories to be retrieved should be malicious or not. Possible values are: true, false.' name: is_malicious predefined: - 'true' - 'false' - description: Specify the score of the categories to be retrieved. isArray: true name: score - description: 'Specify the date and time of creation, from when to retrieve the categories. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the categories. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: |- Retrieves categories based on the provided parameters. Categories are applied while processing the email to indicate the type of threat (or non-threat) that reports and clusters pose to the organization. name: cofense-category-list outputs: - contextPath: Cofense.Category.id description: Unique identifier of the category. type: String - contextPath: Cofense.Category.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Category.links.self description: Link of the resource. type: String - contextPath: Cofense.Category.attributes.name description: Display name of the category. type: String - contextPath: Cofense.Category.attributes.score description: Value to add to a reporter's reputation score when a report is processed with the category. type: Number - contextPath: Cofense.Category.attributes.malicious description: Whether the category is used to classify malicious reports (true) or not (false). The default is true. type: Boolean - contextPath: Cofense.Category.attributes.color description: Color, represented as a hexadecimal value, to assign to the category. type: String - contextPath: Cofense.Category.attributes.archived description: Whether the category is archived (true) or not (false). The default is false. type: Boolean - contextPath: Cofense.Category.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Category.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Category.relationships.one_clicks.links.self description: Link to retrieve the one-click categorizations that process reports with the category. type: String - contextPath: Cofense.Category.relationships.one_clicks.links.related description: Link to retrieve the detailed information of the one-click categorizations that process reports with the category. type: String - contextPath: Cofense.Category.relationships.reports.links.self description: Link to retrieve the reports processed with the category. type: String - contextPath: Cofense.Category.relationships.reports.links.related description: Link to retrieve the detailed information of the reports processed with the category. type: String - arguments: - description: |- Specify the ID of the rule to retrieve a specific rule. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of rules to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the rules. name: page_number - description: 'Specify the attributes to sort the rules. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -name, priority.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of rules by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"priority_eq\":\"2,3\", \"name_cont\":\"Test\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: name, description.' isArray: true name: fields_to_retrieve - description: Specify the name of the rule to retrieve the rule. isArray: true name: name - description: 'Specify the priority of the rule to retrieve the rule. Some possible values are: 1, 2, 3, 4, 5.' isArray: true name: priority - description: Specify the tags associated with the rule to retrieve the rule. isArray: true name: tags - description: 'Specify the scope of the rule to retrieve the rule. Some possible values are: email, attachment, header, reporter email.' isArray: true name: scope - auto: PREDEFINED description: 'Specify if the rule is active or not. Possible values are: true, false.' name: active predefined: - 'true' - 'false' - description: Specify the author name of the rule to retrieve the rule. isArray: true name: author_name - description: 'Specify the rule context of the rule to retrieve the rule. Some possible values are: internal safe, unwanted, threat hunting, phishing tactic, cleanup, unknown. ' isArray: true name: rule_context - description: 'Specify the date and time of creation, from when to retrieve the rules. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the rules. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: |- Retrieves rules based on the filter values provided in the command arguments. Rules identify specific characteristics for categorizing the reported emails. name: cofense-rule-list outputs: - contextPath: Cofense.Rule.id description: Unique identifier of the rule. type: String - contextPath: Cofense.Rule.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Rule.links.self description: Link of the resource. type: String - contextPath: Cofense.Rule.attributes.name description: Short display name of the rule. type: String - contextPath: Cofense.Rule.attributes.description description: Expanded name or description of the rule. type: String - contextPath: Cofense.Rule.attributes.priority description: Priority of the rule. Priorities in Cofense Triage go from 1 to 5. Priority 5 is the highest, or most critical. type: Number - contextPath: Cofense.Rule.attributes.tags description: Tags assigned to the rule. type: Unknown - contextPath: Cofense.Rule.attributes.scope description: Scope to determine which part of a report to apply the rule to (Email, Attachment, Header, or Reporter Email). type: String - contextPath: Cofense.Rule.attributes.author_name description: Name of the author of the rule. type: String - contextPath: Cofense.Rule.attributes.rule_context description: Description that best represents what the user wants the rule to do (Internal Safe, Unwanted, Threat Hunting, Phishing Tactic, or Cleanup). type: String - contextPath: Cofense.Rule.attributes.active description: Whether the rule is active (true) or not active (false). type: Boolean - contextPath: Cofense.Rule.attributes.content description: YARA-compliant meta, strings, and conditions that define the contents of the rule. type: String - contextPath: Cofense.Rule.attributes.time_to_live description: Time period that best represents the useful lifespan of the rule (Forever, 1 Week, 1 Month, 1 Year). type: String - contextPath: Cofense.Rule.attributes.share_with_cofense description: Whether to share the rule content with the Cofense Triage Community Exchange (true) or not (false). type: Boolean - contextPath: Cofense.Rule.attributes.reports_count description: Number of reports the rule matched. type: Number - contextPath: Cofense.Rule.attributes.imported_at description: Date and time, in ISO 8601 format, when the rule was imported. If the rule was not imported, the response contains a null value. type: Date - contextPath: Cofense.Rule.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Rule.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Rule.relationships.cluster_context.links.self description: Link to retrieve the cluster from which the rule was created. type: String - contextPath: Cofense.Rule.relationships.cluster_context.links.related description: Link to retrieve the detailed information of the cluster from which the rule was created. type: String - contextPath: Cofense.Rule.relationships.cluster_context.data.type description: Type of the cluster context associated with the rule. type: String - contextPath: Cofense.Rule.relationships.cluster_context.data.id description: Unique identifier of the cluster context associated with the rule. type: String - contextPath: Cofense.Rule.relationships.report_context.links.self description: Link to retrieve the report from which the rule was created. type: String - contextPath: Cofense.Rule.relationships.report_context.links.related description: Link to retrieve the detailed information of the report from which the rule was created. type: String - contextPath: Cofense.Rule.relationships.report_context.data.type description: Type of the report context associated with the rule. type: String - contextPath: Cofense.Rule.relationships.report_context.data.id description: Unique identifier of the report context associated with the rule. type: String - contextPath: Cofense.Rule.relationships.owner.links.self description: Link to retrieve the owner who created the rule. type: String - contextPath: Cofense.Rule.relationships.owner.links.related description: Link to retrieve the detailed information of the owner who created the rule. type: String - contextPath: Cofense.Rule.relationships.owner.data.type description: Type of the owner associated with the rule. type: String - contextPath: Cofense.Rule.relationships.owner.data.id description: Unique identifier of the owner associated with the rule. type: String - contextPath: Cofense.Rule.relationships.clusters.links.self description: Link to retrieve the clusters that match the rule. type: String - contextPath: Cofense.Rule.relationships.clusters.links.related description: Link to retrieve the detailed information of the clusters that match the rule. type: String - contextPath: Cofense.Rule.relationships.reports.links.self description: Link to retrieve the reports that match the rule. type: String - contextPath: Cofense.Rule.relationships.reports.links.related description: Link to retrieve the detailed information of the reports that match the rule. type: String - arguments: - description: |- Specify the ID of the URL to retrieve a specific URL. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of URLs to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the URLs. name: page_number - description: 'Specify the attributes to sort the URLs. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -created_at, -updated_at.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of urls by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"risk_score_eq\":\"1,2\", \"updated_at_gt\":\"2020-10-26T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: url, risk_score.' name: fields_to_retrieve - description: Specify the risk scores to retrieve the urls. isArray: true name: risk_score - description: 'Specify the date and time of creation, from when to retrieve the URLs. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the URLs. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: "Retrieves URLs based on the filter values provided in the command arguments. \nURLs are the threats (or non-threat) that are detected in the reported emails." name: cofense-url-list outputs: - contextPath: Cofense.Url.id description: Unique identifier of the URL. type: String - contextPath: Cofense.Url.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Url.links.self description: Link of the resource. type: String - contextPath: Cofense.Url.attributes.url description: Value of the URL. type: String - contextPath: Cofense.Url.attributes.risk_score description: Risk score of the URL. type: Unknown - contextPath: Cofense.Url.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Url.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource details were last updated. type: Date - contextPath: Cofense.Url.relationships.domain.links.self description: Link to retrieve the domain of the URL. type: String - contextPath: Cofense.Url.relationships.domain.links.related description: Link to retrieve the detailed information of the domain of the URL. type: String - contextPath: Cofense.Url.relationships.hostname.links.self description: Link to retrieve the hostname of the URL. type: String - contextPath: Cofense.Url.relationships.hostname.links.related description: Link to retrieve the detailed information of the hostname of the URL. type: String - contextPath: Cofense.Url.relationships.hostname.data.type description: Type of the hostname associated with the URL. type: String - contextPath: Cofense.Url.relationships.hostname.data.id description: Unique identifier of the hostname associated with the URL. type: String - contextPath: Cofense.Url.relationships.clusters.links.self description: Link to retrieve the clusters containing the reports with the URL. type: String - contextPath: Cofense.Url.relationships.clusters.links.related description: Link to retrieve the detailed information of the clusters containing the reports with the URL. type: String - contextPath: Cofense.Url.relationships.integration_submissions.links.self description: Link to retrieve the integration submissions containing the URL. type: String - contextPath: Cofense.Url.relationships.integration_submissions.links.related description: Link to retrieve the detailed information of the integration submissions containing the URL. type: String - contextPath: Cofense.Url.relationships.reports.links.self description: Link to retrieve the reports containing the URL. type: String - contextPath: Cofense.Url.relationships.reports.links.related description: Link to retrieve the detailed information of the reports containing the URL. type: String - arguments: - auto: PREDEFINED description: 'Specify the level of the threat indicator that is to be created. Some possible values are: Malicious, Suspicious, Benign.' name: threat_level predefined: - Malicious - Suspicious - Benign required: true - auto: PREDEFINED description: 'Specify the type of the threat indicator that is to be created. Some possible values are: Sender, Subject, Domain, URL, MD5, SHA256, Hostname, or Header.' name: threat_type predefined: - Sender - Subject - Domain - URL - MD5 - SHA256 - Hostname - Header required: true - description: |- Specify the value corresponding to the type of threat indicated in threat_type that is to be created. Note: It should have at least 3 characters. It must be unique and valid. name: threat_value required: true - defaultValue: XSOAR-UI description: "Specify the value corresponding to the source of the threat indicator that is to be created. \nNote: This attribute supports only one threat_type/threat_value pair per source." name: threat_source description: Creates a threat indicator based on the values provided in the command arguments. name: cofense-threat-indicator-create outputs: - contextPath: Cofense.ThreatIndicator.id description: Unique identifier of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.ThreatIndicator.links.self description: Link of the resource. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_level description: The level of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_type description: The type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_value description: Value corresponding to the type of threat indicated in the type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_source description: Value corresponding to the source of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.ThreatIndicator.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.ThreatIndicator.relationships.owner.links.self description: Link to retrieve the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.links.related description: Link to retrieve the detailed information of the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.type description: Type of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.id description: Unique identifier of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.self description: Link to retrieve the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.related description: Link to retrieve the detailed information of the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.self description: Link to retrieve the comments containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.related description: Link to retrieve the detailed information of the comments containing the threat indicator. type: String - arguments: - description: |- Specify the ID of the reporter to retrieve a specific reporter. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of reporters to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the reporters. name: page_number - description: 'Specify the attributes to sort the reporters. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: reports_count, -email.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of reporters by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"reputation_score_eq\":\"1,2\", \"reports_count_gt\":\"3\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: email, reports_count.' isArray: true name: fields_to_retrieve - description: Specify reputation score to retrieve the reporters. isArray: true name: reputation_score - auto: PREDEFINED description: 'Specify that the reporter to be retrieved is VIP or non-VIP. Possible values are: true, false.' name: vip predefined: - 'true' - 'false' - description: Specify emails of the reporter to retrieve the reporter. isArray: true name: email - description: 'Specify the date and time of creation, from when to retrieve the reporters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the reporters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: "Retrieves the reporters that match the provided parameters. \nReporters are employees of an organization who send, or report, suspicious emails to Cofense Triage." name: cofense-reporter-list outputs: - contextPath: Cofense.Reporter.id description: Unique identifier of the reporter. type: String - contextPath: Cofense.Reporter.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Reporter.links.self description: Link of the resource. type: String - contextPath: Cofense.Reporter.attributes.email description: Email address of the reporter. type: String - contextPath: Cofense.Reporter.attributes.reports_count description: Number of emails reported by the reporter. type: Number - contextPath: Cofense.Reporter.attributes.last_reported_at description: Date and time, in ISO 8601 format, when the reporter last reported an email. type: Date - contextPath: Cofense.Reporter.attributes.reputation_score description: Reputation score of the reporter. type: Number - contextPath: Cofense.Reporter.attributes.vip description: Whether the reporter is a VIP (true) or not (false). The default is true. type: Boolean - contextPath: Cofense.Reporter.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Reporter.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Reporter.relationships.clusters.links.self description: Link to retrieve the clusters containing reports the individual reported. type: String - contextPath: Cofense.Reporter.relationships.clusters.links.related description: Link to retrieve the detailed information of the clusters containing reports the individual reported. type: String - contextPath: Cofense.Reporter.relationships.reports.links.self description: Link to retrieve the reports the individual reported. type: String - contextPath: Cofense.Reporter.relationships.reports.links.related description: Link to retrieve the detailed information of the reports the individual reported. type: String - arguments: - description: |- Specify URL ID or attachment payload ID to retrieve an integration submission. Note: To retrieve URL ID, execute cofense-url-list command. To retrieve attachment ID, execute cofense-attachment-payload-list command. name: id required: true - auto: PREDEFINED defaultValue: urls description: 'Type of the integration submission the user wants to retrieve. Possible values are: urls, attachment_payloads.' name: type predefined: - urls - attachment_payloads - defaultValue: '20' description: 'Specify the number of integration submissions to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - description: Specify a page number to retrieve the integration submissions. name: page_number - description: 'Specify the attributes to sort the integration submissions. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: status, -id.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of integration submissions by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"status_eq\":\"complete\", \"risk_score_eq\":\"0,1\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: status, kind.' isArray: true name: fields_to_retrieve - description: 'Specify the status to retrieve the integration submission. Some possible values are: ending, complete, target_not_found, error, running, or hash_not_found.' isArray: true name: status - description: 'Specify the kind to retrieve the integration submission. Some possible values are: File, Hash, URL.' isArray: true name: kind - description: Specify the risk scores to retrieve the attachment payloads. isArray: true name: risk_score - description: 'Specify the date and time of creation, from when to retrieve the integration submissions. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the integration submissions. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: Retrieves integration submission based on the filter values provided in the command arguments. name: cofense-integration-submission-get outputs: - contextPath: Cofense.IntegrationSubmission.id description: Unique identifier of the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.IntegrationSubmission.links.self description: Link of the resource. type: String - contextPath: Cofense.IntegrationSubmission.attributes.status description: Status of the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.attributes.result description: Result of the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.attributes.kind description: Kind of the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.attributes.risk_score description: Risk score of the integration submission. type: Number - contextPath: Cofense.IntegrationSubmission.attributes.created_at description: |- Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.IntegrationSubmission.attributes.updated_at description: |- Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.IntegrationSubmission.relationships.integration.links.self description: Link to retrieve the integration associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.integration.links.related description: Link to retrieve the detailed information of integration associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.integration.data.type description: Type of the integration associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.integration.data.id description: Unique Identifier of the integration associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.target.links.self description: Link to retrieve the target associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.target.links.related description: Link to retrieve the detailed information of the target associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.target.data.type description: Type of the target associated with the integration submission. type: String - contextPath: Cofense.IntegrationSubmission.relationships.target.data.id description: Unique Identifier of the target associated with the integration submission. type: String - arguments: - description: |- Specify ID of the attachment payload to retrieve a specific attachment payload. Note: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected. name: id - defaultValue: '20' description: 'Specify the number of attachment payloads to retrieve per page. Note: Possible values are between 1 and 200. ' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the attachment payloads. name: page_number - description: 'Specify the attributes to sort the attachment payloads. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: risk_score, -id.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of attachment payloads by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"risk_score\":\"0,1\", \"created_at_gteq\":\"2020-04-13T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: md5, risk_score.' isArray: true name: fields_to_retrieve - description: Specify the risk scores to retrieve the attachment payloads. isArray: true name: risk_score - description: 'Specify the date and time of creation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: |- Retrieves attachment payloads based on the filter values provided in the command arguments. Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email. name: cofense-attachment-payload-list outputs: - contextPath: Cofense.AttachmentPayload.id description: Unique identifier of the attachment payload. type: String - contextPath: Cofense.AttachmentPayload.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.AttachmentPayload.links.self description: Link of the resource. type: String - contextPath: Cofense.AttachmentPayload.attributes.mime_type description: MIME type of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.md5 description: MD5 hash of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.sha256 description: SHA256 hash of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.risk_score description: Risk score of the payload. type: Number - contextPath: Cofense.AttachmentPayload.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.AttachmentPayload.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.AttachmentPayload.relationships.attachments.links.self description: Link to retrieve the attachment containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.attachments.links.related description: Link to retrieve the detailed information of the attachment containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.clusters.links.self description: Link to retrieve the cluster of reports containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.clusters.links.related description: Link to retrieve the detailed information of the cluster of reports containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.integration_submissions.links.self description: Link to retrieve the integration submissions related to attachment. type: String - contextPath: Cofense.AttachmentPayload.relationships.integration_submissions.links.related description: Link to retrieve the detailed information of the integration submissions related to attachment. type: String - contextPath: Cofense.AttachmentPayload.relationships.reports.links.self description: Link to retrieve the report with attachments containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.reports.links.related description: Link to retrieve the detailed information of the report with attachments containing the payload. type: String - arguments: - description: 'Specify the ID of the comment to retrieve a specific comment. Note: If ''id'' argument is provided, then apart from ''fields_to_retrieve'', all arguments will be neglected.' name: id - defaultValue: '20' description: 'Specify the number of comments to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the comments. name: page_number - description: 'Specify the attributes to sort the comments. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: -created_at, body.' name: sort_by - description: |- Specify the filters to filter the list of comments by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"body_format_eq\":\"json\", \"created_at_gteq\":\"2021-04-13T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: body, body_format.' isArray: true name: fields_to_retrieve - auto: PREDEFINED description: 'Specify the format of the comment body to retrieve the comments. Possible values are: text, json.' name: body_format predefined: - text - json - description: Specify the tags to retrieve the comments based on the tags associated with the comments. isArray: true name: tags - description: |- Specify the ID of the report to retrieve the comments specific to the report. Note: When both report_id and threat_indicator_id are provided, higher priority will be given to report_id. Note: To retrieve report_id, execute cofense-report-list command. name: report_id - description: |- Specify the ID of the threat indicator to retrieve the comments specific to the threat indicator. Note: When both report_id and threat_indicator_id are provided, higher priority will be given to report_id. Note: To retrieve threat_indicator_id, execute cofense-threat-indicator-list command. name: threat_indicator_id - description: 'Specify the date and time of creation, from when to retrieve the comments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the comments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: Retrieves comments based on the filter values provided in the command arguments. name: cofense-comment-list outputs: - contextPath: Cofense.Comment.id description: Unique identifier of the comment. type: String - contextPath: Cofense.Comment.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Comment.links.self description: Link of the resource. type: String - contextPath: Cofense.Comment.attributes.body_format description: Format of the comment body. type: String - contextPath: Cofense.Comment.attributes.body description: Body of the comment. type: String - contextPath: Cofense.Comment.attributes.tags description: Tags assigned to the comment. type: Unknown - contextPath: Cofense.Comment.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Comment.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Comment.attributes.body.type description: Type of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.reported_time.type description: Reported time of the comment. type: Date - contextPath: Cofense.Comment.attributes.body.properties.srctag.type description: Source tags associated with the comments. type: Unknown - contextPath: Cofense.Comment.attributes.body.properties.received_time.type description: Received time for the comments. type: Date - contextPath: Cofense.Comment.attributes.body.properties.from.type description: Email ID of the user who added the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.reported_by.type description: Email ID of the reporter who reported the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.notes.type description: Notes of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.summary.type description: Summary of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.malware_families.type description: Malware families for the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.phenotypes.type description: Phenotypes of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.message_id.type description: Message ID for the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.reply_to.type description: Replied to email ID for the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.report_url.type description: Report URL for the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.escalation_type.type description: Escalation type of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.type description: Type of the stage 1 IOCs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.files.type description: File ioc available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_ips.type description: Type of the infection IPs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_ips.items.type description: Type of the infection IP available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_urls.items.type description: Infection URL available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_1_iocs.properties.infection_urls.type description: Type of the infection URL. type: String - contextPath: Cofense.Comment.attributes.body.properties.brands.type description: Type of the brands. type: String - contextPath: Cofense.Comment.attributes.body.properties.brands.items.type description: Brands of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.vision_results.type description: Type of the vision result. type: String - contextPath: Cofense.Comment.attributes.body.properties.vision_results.properties.results_id description: Result ID of the vision result. type: String - contextPath: Cofense.Comment.attributes.body.properties.vision_results.properties.query_created.type description: Query created date for the vision result. type: Date - contextPath: Cofense.Comment.attributes.body.properties.vision_results.properties.messages_removed description: Number of messages removed from the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.vision_results.properties.messages_found description: Number of messages found from the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.subject.type description: Subject of the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.sent_to.type description: Receiver email ID. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.type description: Type of the stage 2 IOCs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.files.type description: File IOCs available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.md5.type description: MD5 IOCs available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.size.type description: Size of the stage 2 IOCs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_ips.type description: Type of the payload IPs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_ips.items.type description: Payload IPs available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_urls.type description: Type of the payload URLs. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.payload_urls.items.type description: Payload URLs available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.c2_ips.type description: C2 IPs available in the comment. type: String - contextPath: Cofense.Comment.attributes.body.properties.stage_2_iocs.properties.c2_urls.type description: C2 URLs available in the comment. type: Unknown - contextPath: Cofense.Comment.attributes.body.properties.report_id.type description: 'ID of the report associated with the comment. ' type: String - contextPath: Cofense.Comment.relationships.commentable.links.self description: Link to retrieve the commentable comments. type: String - contextPath: Cofense.Comment.relationships.commentable.links.related description: Link to retrieve the detailed information of the commentable comments. type: String - contextPath: Cofense.Comment.relationships.commentable.data.type description: Type of the commentable comment associated with the comment. type: String - contextPath: Cofense.Comment.relationships.commentable.data.id description: Unique identifier of the commentable comment associated with the comment. type: String - contextPath: Cofense.Comment.relationships.owner.links.self description: Link to retrieve the owner of the comment. type: String - contextPath: Cofense.Comment.relationships.owner.links.related description: Link to retrieve the detailed information of the owner of the comment. type: String - contextPath: Cofense.Comment.relationships.owner.data.type description: Type of the owner associated with the comment. type: String - contextPath: Cofense.Comment.relationships.owner.data.id description: Unique identifier of the owner associated with the comment. type: String - arguments: - description: The report ID. name: id required: true - description: Date string representing the local time.The incident is only returned if it was modified after the last update time. name: lastUpdate required: true description: Get remote data from a remote incident. Please note that this method will not update the current incident, it's here for debugging purposes. name: get-remote-data - arguments: - description: "Specify the ID of the cluster to retrieve a specific cluster. \nNote: If 'id' argument is provided, then apart from 'fields_to_retrieve', all arguments will be neglected." name: id - defaultValue: '20' description: 'Specify the number of clusters to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: Specify a page number to retrieve the clusters. name: page_number - description: 'Specify the attributes to sort the clusters. Note: The default sort order for an attribute is ascending. Prefix the attributes with a hyphen to sort in descending order. For example: created_at, -updated_at.' isArray: true name: sort_by - description: |- Specify the filters to filter the list of clusters by attribute values. Note: Enter values in key-value JSON format. To separate multiple values of a single attribute, use commas. Add backslash(\) before quotes. Format accepted: {\"attribute1_operator \": \"value1, value2\", \"attribute2_operator\" : \"value3, value4\"} For example: {\"risk_score_eq\":\"1,2\", \"updated_at_gt\":\"2020-10-26T10:48:16.834Z\"}. name: filter_by - description: 'Specify the fields to retrieve the mentioned attributes only. For example: unprocessed_reports_count, processed_reports_count.' isArray: true name: fields_to_retrieve - description: Specify the tags to retrieve the cluster. isArray: true name: tags - description: 'Specify the priority to retrieve the cluster based on the priority of the rules that match the reports in the cluster. Possible values are: 0, 1, 2, 3, 4, 5.' isArray: true name: match_priority - description: Specify the number of reports to be present in the cluster. isArray: true name: total_reports_count - description: 'Specify the date and time of creation, from when to retrieve the clusters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the clusters. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: Retrieves clusters based on the filter values provided in the command arguments. name: cofense-cluster-list outputs: - contextPath: Cofense.Cluster.id description: Unique identifier of the cluster. type: String - contextPath: Cofense.Cluster.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Cluster.links.self description: Link of the resource. type: String - contextPath: Cofense.Cluster.attributes.risk_score description: Risk score of the cluster. type: Number - contextPath: Cofense.Cluster.attributes.first_reported_at description: Date and time, in ISO 8601 format, when the first report in the cluster was reported. type: Date - contextPath: Cofense.Cluster.attributes.oldest_unprocessed_reported_at description: Date and time, in ISO 8601 format, when the oldest unprocessed report in the cluster was reported. type: Date - contextPath: Cofense.Cluster.attributes.last_received_at description: Date and time, in ISO 8601 format, when the suspect email associated with the last report in the cluster was received. type: Date - contextPath: Cofense.Cluster.attributes.last_reported_at description: Date and time, in ISO 8601 format, when the last report in the cluster was reported to Triage. type: Date - contextPath: Cofense.Cluster.attributes.last_from_address description: Sender email address for the suspect email associated with the last report added to the cluster. type: String - contextPath: Cofense.Cluster.attributes.last_subject description: Subject of the last received report. type: String - contextPath: Cofense.Cluster.attributes.average_reporter_reputation description: Average reporter reputation score across all reports in the cluster. type: String - contextPath: Cofense.Cluster.attributes.match_priority description: Highest priority of the rules that match the reports in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.host_source description: Semicolon-separated list of URL domains in the cluster. type: String - contextPath: Cofense.Cluster.attributes.tags description: Tags assigned to the cluster. type: Unknown - contextPath: Cofense.Cluster.attributes.attachments_count description: Count of attachments in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.unprocessed_reports_count description: Count of unprocessed reports in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.processed_reports_count description: Count of processed reports in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.total_reports_count description: Count of all reports in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.rules_count description: Count of unique rules that match one or more reports in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.urls_count description: Count of URLs in the cluster. type: Number - contextPath: Cofense.Cluster.attributes.vip_reporters_count description: Count of VIP reporters. type: Number - contextPath: Cofense.Cluster.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Cluster.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Cluster.relationships.attachment_payloads.links.self description: Link to retrieve the payloads of attachments associated with the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.attachment_payloads.links.related description: Link to retrieve the detailed information of the payloads of attachments associated with the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.domains.links.self description: Link to retrieve the domain of the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.domains.links.related description: Link to retrieve the detailed information of the domain of the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.hostnames.links.self description: Link to retrieve the hostnames of URLs associated with the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.hostnames.links.related description: Link to retrieve the detailed information of the hostnames of URLs associated with the report in the cluster. type: String - contextPath: Cofense.Cluster.relationships.reports.links.self description: Link to retrieve reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.reports.links.related description: Link to retrieve the detailed information of the reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.reporters.links.self description: Link to retrieve the reporters of reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.reporters.links.related description: Link to retrieve the detailed information of the reporters of reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.rules.links.self description: Link to retrieve the rules matching the cluster. type: String - contextPath: Cofense.Cluster.relationships.rules.links.related description: Link to retrieve the detailed information of the rules matching the cluster. type: String - contextPath: Cofense.Cluster.relationships.urls.links.self description: Link to retrieve the URLs associated with reports in the cluster. type: String - contextPath: Cofense.Cluster.relationships.urls.links.related description: Link to retrieve the detailed information of the URLs associated with reports in the cluster. type: String - arguments: - description: 'Specify ID of the threat indicator that is to be updated. Note: To retrieve id, execute cofense-threat-indicator-list command.' name: id required: true - auto: PREDEFINED description: 'Specify the level of the threat indicator that is to be updated. Some possible values are: Malicious, Suspicious, Benign.' name: threat_level predefined: - Malicious - Suspicious - Benign required: true - description: Specify the value corresponding to the source of the threat indicator that is to be updated. name: threat_source description: Updates a threat indicator based on the values provided in the command arguments. name: cofense-threat-indicator-update outputs: - contextPath: Cofense.ThreatIndicator.id description: Unique identifier of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.ThreatIndicator.links.self description: Link of the resource. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_level description: The level of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_type description: The type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_value description: Value corresponding to the type of threat indicated in the type of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.threat_source description: Value corresponding to the source of the threat. type: String - contextPath: Cofense.ThreatIndicator.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.ThreatIndicator.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.ThreatIndicator.relationships.owner.links.self description: Link to retrieve the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.links.related description: Link to retrieve the detailed information of the owner of the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.type description: Type of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.owner.data.id description: Unique identifier of the owner associated with the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.self description: Link to retrieve the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.reports.links.related description: Link to retrieve the detailed information of the reports containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.self description: Link to retrieve the comments containing the threat indicator. type: String - contextPath: Cofense.ThreatIndicator.relationships.comments.links.related description: Link to retrieve the detailed information of the comments containing the threat indicator. type: String - arguments: - description: Date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time. name: lastUpdate required: true description: |- Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a mirroring feature, which is available from Cortex XSOAR version 6.1. name: get-modified-remote-data - arguments: - description: |- Specify the ID of the report to download the image file. Note: To retrieve id, execute cofense-report-list command. name: id required: true - auto: PREDEFINED defaultValue: png description: 'The image type of the report the user wants to download. Some possible values are: jpg, png.' name: type predefined: - jpg - png description: Downloads the image of the report that matches the specified report ID. name: cofense-report-image-download outputs: - contextPath: InfoFile.Name description: File name. type: String - contextPath: InfoFile.EntryID description: The entry ID of the file. type: String - contextPath: InfoFile.Size description: File size in bytes. type: Number - contextPath: InfoFile.Type description: The file type. type: String - contextPath: InfoFile.Info description: File information. type: String - contextPath: InfoFile.Extension description: File extension. type: String - arguments: - description: 'Specify ID of the report to retrieve the attachment payloads.' name: id required: true - defaultValue: '20' description: 'Specify the number of attachment payloads to retrieve per page. Note: Possible values are between 1 and 200. ' name: page_size - defaultValue: '1' description: 'Specify a page number to retrieve the attachment payloads.' name: page_number - description: 'Specify the date and time of creation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the attachment payloads. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: |- Retrieves attachment payloads based on provided report id in the command arguments. Attachment payloads identify the MIME type and MD5 and SHA256 hash signatures of a reported email attachment. name: cofense-report-attachment-payload-list outputs: - contextPath: Cofense.AttachmentPayload.id description: Unique identifier of the attachment payload. type: String - contextPath: Cofense.AttachmentPayload.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.AttachmentPayload.links.self description: Link of the resource. type: String - contextPath: Cofense.AttachmentPayload.attributes.mime_type description: MIME type of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.md5 description: MD5 hash of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.sha256 description: SHA256 hash of the payload. type: String - contextPath: Cofense.AttachmentPayload.attributes.risk_score description: Risk score of the payload. type: Number - contextPath: Cofense.AttachmentPayload.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.AttachmentPayload.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.AttachmentPayload.relationships.attachments.links.self description: Link to retrieve the attachment containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.attachments.links.related description: Link to retrieve the detailed information of the attachment containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.clusters.links.self description: Link to retrieve the cluster of reports containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.clusters.links.related description: Link to retrieve the detailed information of the cluster of reports containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.integration_submissions.links.self description: Link to retrieve the integration submissions related to attachment. type: String - contextPath: Cofense.AttachmentPayload.relationships.integration_submissions.links.related description: Link to retrieve the detailed information of the integration submissions related to attachment. type: String - contextPath: Cofense.AttachmentPayload.relationships.reports.links.self description: Link to retrieve the report with attachments containing the payload. type: String - contextPath: Cofense.AttachmentPayload.relationships.reports.links.related description: Link to retrieve the detailed information of the report with attachments containing the payload. type: String - arguments: - description: 'Specify ID of the report to retrieve the attachments.' name: id required: true - defaultValue: '20' description: 'Specify the number of attachments to retrieve per page. Note: Possible values are between 1 and 200.' name: page_size - defaultValue: '1' description: 'Specify a page number to retrieve the attachments.' name: page_number - description: 'Specify the date and time of creation, from when to retrieve the attachments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: created_at - description: 'Specify the date and time of updation, from when to retrieve the attachments. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.' name: updated_at description: |- Retrieves attachments based on provided report id in the command arguments. For reported emails that contain attachments, Cofense Triage captures the attachment's filename and size. name: cofense-report-attachment-list outputs: - contextPath: Cofense.Attachment.id description: Unique identifier of the attachment. type: String - contextPath: Cofense.Attachment.type description: Type of the resource of Cofense Triage. type: String - contextPath: Cofense.Attachment.links.self description: Link of the resource. type: String - contextPath: Cofense.Attachment.attributes.filename description: Name of the attachment file. type: String - contextPath: Cofense.Attachment.attributes.size description: Attachment size in bytes. type: Number - contextPath: Cofense.Attachment.attributes.is_child description: Boolean value indicating that attachment is child or not. type: Boolean - contextPath: Cofense.Attachment.attributes.created_at description: Date and time, in ISO 8601 format, when the resource was created. type: Date - contextPath: Cofense.Attachment.attributes.updated_at description: Date and time, in ISO 8601 format, when the resource was last updated. type: Date - contextPath: Cofense.Attachment.relationships.attachment_payload.links.self description: Link to retrieve the attachment payload associated with the attachment. type: String - contextPath: Cofense.Attachment.relationships.attachment_payload.links.related description: Link to retrieve the detailed information of the attachment payload associated with the attachment. type: String - contextPath: Cofense.Attachment.relationships.attachment_payload.data.type description: Type indicating attachment payload. type: String - contextPath: Cofense.Attachment.relationships.attachment_payload.data.id description: Unique identifier of the attachment payload associated with the attachment. type: String - contextPath: Cofense.Attachment.relationships.parent.links.self description: Link to retrieve the parent of the attachment. type: String - contextPath: Cofense.Attachment.relationships.parent.links.related description: Link to retrieve the detailed information of the parent of the attachment. type: String - contextPath: Cofense.Attachment.relationships.parent.data.type description: Type indicating the parent of the attachment. type: String - contextPath: Cofense.Attachment.relationships.parent.data.id description: Unique identifier of the parent of the attachment. type: String - contextPath: Cofense.Attachment.relationships.reports.links.self description: Link to retrieve the report associated with the attachment. type: String - contextPath: Cofense.Attachment.relationships.reports.links.related description: Link to retrieve the detailed information of the report associated with the attachment. type: String - contextPath: Cofense.Attachment.relationships.reports.data.type description: Type indicating report. type: String - contextPath: Cofense.Attachment.relationships.reports.data.id description: Unique identifier of the report associated with the attachment. type: String - arguments: - description: |- Specify the ID of the attachment to download the attachment file. Note: To retrieve id, execute cofense-report-attachment-list command. name: id required: true description: Downloads the attachment for the specified attachment ID. name: cofense-report-attachment-download outputs: - contextPath: File.Size description: File size in bytes. type: String - contextPath: File.SHA1 description: SHA1 hash of file. type: String - contextPath: File.SHA256 description: SHA256 hash of file. type: String - contextPath: File.SHA512 description: SHA512 hash of file. type: String - contextPath: File.Name description: File name. type: String - contextPath: File.SSDeep description: SSDeep hash of the file. type: String - contextPath: File.EntryID description: The entry ID of the file. type: Unknown - contextPath: File.Info description: File information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String dockerimage: demisto/python3:3.12.13.10116658 isfetch: true isremotesyncin: true runonce: false script: '-' subtype: python3 type: python tests: - No tests (auto formatted) defaultmapperin: Cofense Triage Report - Incoming Mapper defaultclassifier: Cofense Triage - Classifier fromversion: 6.0.0