category: Analytics & SIEM
provider: CTM360
sectionorder:
- Connect
- Collect
commonfields:
  id: CTM360_CyberBlindspot
  version: -1
configuration:
- additionalinfo: "Choose the direction to mirror the incident: Incoming (from CyberBlindspot to Cortex XSOAR), Outgoing (from Cortex XSOAR to CyberBlindspot), or Incoming and Outgoing (from/to Cortex XSOAR and CyberBlindspot)."
  defaultvalue: Incoming And Outgoing
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- defaultvalue: Incidents
  display: Module To Use
  additionalinfo: "The module to use: Incidents, Compromised Cards, Breached Credentials, Malware Logs, Domain/Subdomain Infringements, Social Media Fraud, Gambling Sites, or Money Mules."
  name: module_to_use
  required: false
  type: 15
  options:
  - Incidents
  - Compromised Cards
  - Breached Credentials
  - Malware Logs
  - Domain Infringement
  - Subdomain Infringement
  - Social Media Fraud
  - Gambling Sites
  - Money Mules
  section: Collect
- name: retrieve_screenshots
  required: false
  type: 8
  defaultvalue: 'true'
  display: Retrieve Screenshots
  section: Collect
  advanced: true
- name: first_fetch
  type: 0
  required: false
  additionalinfo: The time the incidents should be fetched starting from.
  section: Collect
  defaultvalue: 7 days
  display: First fetch (<number> <time unit>, e.g., 12 hours. Default is `7 days`)
  advanced: true
- name: api_key
  type: 9
  required: true
  additionalinfo: The CTM360 CyberBlindspot API Key to use for fetching data.
  section: Connect
  displaypassword: API Key
  hiddenusername: true
- display: Maximum Number of Incidents per Fetch
  name: max_fetch
  type: 0
  required: true
  section: Collect
  defaultvalue: "25"
  additionalinfo: Default is 25. Maximum is 200.
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Incident type
  defaultvalue: CyberBlindspot Incident
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultmapperin: 'CTM360-CyberBlindspot - Incoming Mapper'
description: 'Take action on incidents derived from CTM360 CBS threat intelligence that is directly linked to your organization.'
display: CTM360 CyberBlindspot
name: CTM360_CyberBlindspot
script:
  commands:
  - name: ctm360-cbs-incident-list
    description: Get the list of incidents from CBS.
    arguments:
    - description: Select "From" date to fetch incidents starting from it.
      name: dateFrom
      required: false
    - description: Select "To" date to fetch incidents up to it.
      name: dateTo
      required: false
    - description: Set number of results to fetch.
      name: maxHits
      required: false
    - description: Set the order of the results.
      name: order
      required: false
    outputs:
    - contextPath: CyberBlindspot.IncidentList
      description: List of all CBS incidents.
  - name: ctm360-cbs-incident-close
    description: Close a CBS incident.
    arguments:
    - name: ticketId
      description: '"Ticket ID" of the incident to close.'
      required: true
  - name: ctm360-cbs-incident-request-takedown
    description: Request a takedown of the asset where the incident was found.
    arguments:
    - name: ticketId
      description: '"Ticket ID" of the incident to request takedown.'
      required: true
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type.
    arguments: []
  - name: ctm360-cbs-incident-details
    description: Fetch details of a single incident from the CyberBlindspot platform.
    arguments:
    - description: '"Ticket ID" of the incident to close.'
      name: ticketId
      required: true
    outputs:
    - contextPath: CyberBlindspot.RemoteIncident.id
      description: The unique ID for the incident record.
    - contextPath: CyberBlindspot.RemoteIncident.brand
      description: The organization the incident is associated with.
    - contextPath: CyberBlindspot.RemoteIncident.coa
      description: The course of action to take.
    - contextPath: CyberBlindspot.RemoteIncident.class
      description: The classification of the incident on remote server.
    - contextPath: CyberBlindspot.RemoteIncident.status
      description: The current status of the incident on remote server.
    - contextPath: CyberBlindspot.RemoteIncident.severity
      description: The severity of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.subject
      description: The asset or title of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.type
      description: The incident type on the remote server.
    - contextPath: CyberBlindspot.RemoteIncident.remarks
      description: The remarks about the incident.
    - contextPath: CyberBlindspot.RemoteIncident.created_date
      description: The creation date of the incident (legacy).
    - contextPath: CyberBlindspot.RemoteIncident.updated_date
      description: The date the incident last got updated (legacy).
    - contextPath: CyberBlindspot.RemoteIncident.first_seen
      description: The creation date of the incident.
    - contextPath: CyberBlindspot.RemoteIncident.last_seen
      description: The date the incident last got updated.
    - contextPath: CyberBlindspot.RemoteIncident.timestamp
      description: The timestamp of when the record was created.
    - contextPath: CyberBlindspot.RemoteIncident.card_number
      description: The compromised card's number.
    - contextPath: CyberBlindspot.RemoteIncident.cvv
      description: The compromised card's Card Verification Value (CVV).
    - contextPath: CyberBlindspot.RemoteIncident.expiry_month
      description: The compromised card's expiration month.
    - contextPath: CyberBlindspot.RemoteIncident.expiry_year
      description: The compromised card's expiration year.
    - contextPath: CyberBlindspot.RemoteIncident.breach_source
      description: The source of the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.domain
      description: The domain related to the breached data or compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.email
      description: The email found in the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.username
      description: The username found in the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.password
      description: The password found in the breached data or compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.executive_name
      description: The executive member's name related to the breached data.
    - contextPath: CyberBlindspot.RemoteIncident.confirmation_time
      description: The time of infringement confirmation.
    - contextPath: CyberBlindspot.RemoteIncident.risks
      description: The potential difficulties carried by the infringement.
    - contextPath: CyberBlindspot.RemoteIncident.incident_status
      description: The status of the infringement incident.
    - contextPath: CyberBlindspot.RemoteIncident.screenshots
      description: The screenshot evidence if available.
    - contextPath: CyberBlindspot.RemoteIncident.date_compromised
      description: The date of the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.computer_name
      description: The name of the computer that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.operating_system
      description: The operating system of the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.malware_path
      description: The path in which the malware was installed on the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.url_path
      description: The path of the URL.
    - contextPath: CyberBlindspot.RemoteIncident.masked_password
      description: The masked password of the compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.software
      description: The software that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.user
      description: The user of the compromised account.
    - contextPath: CyberBlindspot.RemoteIncident.user_domain
      description: The domain of the compromised user.
    - contextPath: CyberBlindspot.RemoteIncident.website
      description: The website that was compromised.
    - contextPath: CyberBlindspot.RemoteIncident.sources
      description: The sources reporting the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.source_uri
      description: The source URI of the compromise report.
    - contextPath: CyberBlindspot.RemoteIncident.hostname
      description: The hostname of the compromised device.
    - contextPath: CyberBlindspot.RemoteIncident.stealer_family
      description: The family of the malware.
    - contextPath: CyberBlindspot.RemoteIncident.external_link
      description: The external link to the remote platform.
    - contextPath: CyberBlindspot.RemoteIncident.compromise_details
      description: The details of the compromise.
    - contextPath: CyberBlindspot.RemoteIncident.platform
      description: The social network platform for social media fraud findings.
    - contextPath: CyberBlindspot.RemoteIncident.risk_score
      description: The numeric risk score from CBS.
    - contextPath: CyberBlindspot.RemoteIncident.money_mule_id
      description: The CBS money mule finding ID.
    - contextPath: CyberBlindspot.RemoteIncident.account_identifier
      description: The account identifier tied to the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_names
      description: The names associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_emails
      description: The email addresses associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.suspect_phones
      description: The phone numbers associated with the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.transfer_amount
      description: The transfer amount when present.
    - contextPath: CyberBlindspot.RemoteIncident.transfer_currency
      description: The currency code for the transfer.
    - contextPath: CyberBlindspot.RemoteIncident.bank_account_holder_name
      description: The name on the bank account.
    - contextPath: CyberBlindspot.RemoteIncident.bank_name
      description: The bank name tied to the money mule.
    - contextPath: CyberBlindspot.RemoteIncident.bank_account_country
      description: The country of the bank account.
    - contextPath: CyberBlindspot.RemoteIncident.bic
      description: The Bank Identifier Code.
    - contextPath: CyberBlindspot.RemoteIncident.finding_id
      description: The CBS gambling-site finding ID.
    - contextPath: CyberBlindspot.RemoteIncident.url
      description: The primary gambling site URL.
    - contextPath: CyberBlindspot.RemoteIncident.submitted_url
      description: The URL submitted to CBS for scanning.
    - contextPath: CyberBlindspot.RemoteIncident.landing_url
      description: The landing page URL observed for the site.
    - contextPath: CyberBlindspot.RemoteIncident.title
      description: The page title observed during scan.
    - contextPath: CyberBlindspot.RemoteIncident.resolving_ip
      description: The resolved IP for the gambling site.
    - contextPath: CyberBlindspot.RemoteIncident.tags
      description: The tags applied to the gambling site finding.
    - contextPath: CyberBlindspot.RemoteIncident.status_code
      description: The HTTP status code from scan.
    - contextPath: CyberBlindspot.RemoteIncident.url_status
      description: The URL reachability status.
    - contextPath: CyberBlindspot.RemoteIncident.scan_status
      description: The scan completion status.
    - contextPath: CyberBlindspot.RemoteIncident.enrichment
      description: The DNS enrichment payload.
    - contextPath: CyberBlindspot.RemoteIncident.external_links
      description: The external links discovered on the gambling site.
    - contextPath: CyberBlindspot.RemoteIncident.internal_links
      description: The internal links discovered on the gambling site.
  - name: ctm360-cbs-incident-retrieve-screenshots
    arguments:
    - description: The files to retrieve.
      name: files
      required: true
      isArray: true
    description: Retrieves screenshot evidence if available.
    outputs:
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
  - name: get-remote-data
    arguments:
    - description: The incident ID.
      name: id
      required: true
    - description: Retrieves entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: get-modified-remote-data
    arguments:
    - description: A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
  - name: update-remote-system
    arguments:
    - description: Remote ID of incident to update in the remote system.
      name: remoteId
      required: true
    description: Updates the remote system with local changes.
  isfetch: true
  runonce: false
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)