category: Vulnerability Management
sectionorder:
- Connect
- Collect
provider: IONIX
commonfields:
  id: Cyberpion
  version: -1
configuration:
- display: Server URL (e.g. https://portal.cyberpion.com/portal/api/)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- additionalinfo: Allowed values are integers between 1 to 500.
  defaultvalue: '200'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: 'Allowed values: "Network", "Web", "Cloud", "DNS", "PKI", "Vulnerabilities", "TLS", "Email Server", "Mobile".'
  defaultvalue: Network,Web,Cloud,DNS,PKI,Vulnerabilities,TLS,Email Server,Mobile
  display: Action items category to fetch as incidents.
  name: categories
  options:
  - Network
  - Web
  - Cloud
  - DNS
  - PKI
  - Vulnerabilities
  - TLS
  - Email Server
  - Mobile
  required: true
  type: 16
  section: Collect
- additionalinfo: |-
    Allowed values are integers between 1 to 10.
    1 will fetch all incidents.
  defaultvalue: '7'
  display: Minimum Action items severity level to fetch incidents from.
  name: minSeverity
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  required: true
  type: 15
  section: Collect
- display: First fetch timestamp (in months)- Optional. If not set, all incidents will be fetched
  name: first_fetch
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  - '11'
  - '12'
  - '13'
  - '14'
  - '15'
  - '16'
  - '17'
  - '18'
  - '19'
  - '20'
  - '21'
  - '22'
  - '23'
  - '24'
  type: 15
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- defaultvalue: 'true'
  display: Show only open issues
  name: ShowOnlyOpen
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: The Cyberpion integration allows you to seamlessly receive all your Cyberpion security solution Action Items and supportive information to your Cortex XSOAR.
display: Cyberpion
name: Cyberpion
script:
  commands:
  - arguments:
    - description: Get action items for this domain.
      name: domain
      required: true
    description: Retrieves domain's action items.
    name: cyberpion-get-domain-action-items
    outputs:
    - contextPath: Cyberpion.DomainData.Vulnerabilities.id
      description: Action item ID.
      type: String
    - contextPath: Cyberpion.DomainData.Domain
      description: Domain to get action items that are related to.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.category
      description: Category of action item. can be DNS, PKI, Cloud, Vulnerability.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.urgency
      description: Action item urgency.
      type: Number
    - contextPath: Cyberpion.DomainData.Vulnerabilities.is_open
      description: Is action item still relevant (open).
      type: Boolean
    - contextPath: Cyberpion.DomainData.Vulnerabilities.creation_time
      description: Action item's creation time.
      type: Date
    - contextPath: Cyberpion.DomainData.Vulnerabilities.link
      description: Link to the action item in Cyberpion's portal.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.title
      description: Action item's title.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.impact
      description: Action item's potential impact from a security perspective.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.summary
      description: Action item summary.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.solution
      description: The necessary course of action needed to remediate the threat.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.description
      description: Description of the source of the issue that was detected.
      type: String
    - contextPath: Cyberpion.DomainData.Vulnerabilities.technical_details
      description: Technical details of the issue.
      type: String
  - arguments:
    - description: Get info and current state of this domain.
      name: domain
      required: true
    description: Retrieves domain's info and current state.
    name: cyberpion-get-domain-state
    outputs:
    - contextPath: Cyberpion.DomainState.id
      description: Domain State ID.
      type: String
    - contextPath: Cyberpion.DomainState.domain
      description: The Domain.
      type: String
    - contextPath: Cyberpion.DomainState.ips
      description: Reverse Ip's of domain's ips.
      type: String
    - contextPath: Cyberpion.DomainState.risk_rank
      description: Domain's risk rank.
      type: Number
    - contextPath: Cyberpion.DomainState.vuln_count
      description: Number of vulnerabilities associated with domain.
      type: Number
    - contextPath: Cyberpion.DomainState.cname_chain
      description: "Domain's CName chain (DNS record)."
      type: String
    - contextPath: Cyberpion.DomainState.domain_types
      description: Domain's infrastructure info (provider etc.).
      type: String
    - contextPath: Cyberpion.DomainState.discovery_date
      description: The Date domain was discovered.
      type: Date
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
defaultmapperin: Cyberpion-Mapper
defaultclassifier: Cyberpion-Classifier
fromversion: 6.0.0