category: Data Enrichment & Threat Intelligence
provider: Bitsight
sectionorder:
- Connect
- Collect
commonfields:
  id: Cybersixgill_Actionable_Alerts
  version: -1
configuration:
- display: Cybersixgill API client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- display: Cybersixgill API client secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Cybersixgill Organization ID
  name: org_id
  type: 0
  defaultvalue: ''
  section: Connect
  required: false
- defaultvalue: '25'
  display: Maximum number of incidents to fetch - maximum is 25
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '1'
  display: How many days back to fetch incidents on the first run - maximum is 30
  name: first_fetch_days
  type: 0
  section: Collect
  required: false
- display: Filter by alert threat level
  name: threat_level
  options:
  - imminent
  - emerging
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Filter by alert threat type
  name: threat_type
  options:
  - Brand Protection
  - Data Leak
  - Malware
  - Phishing
  - Fraud
  - Vulnerability Exploit
  - Insider Threat
  - Defacement
  - Compromised Accounts
  - DDoS Attack
  - Web Attack
  - Trend Anomaly
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: Cybersixgill Actionable Alerts
  display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- defaultvalue: '5'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
description: Cybersixgill automatically collects intelligence in real-time on all items that appear in the underground sources which we monitor. By using various rules and machine learning models, Cybersixgill automatically correlates these intelligence items with pre defined organization assets, and automatically alerts users in real time of any relevant intelligence items.
display: Cybersixgill Actionable Alerts
name: Cybersixgill_Actionable_Alerts
script:
  commands:
  - description: updates the existing actionable alert status.
    name: cybersixgill-update-alert-status
    arguments:
    - required: true
      description: The alert id to update.
      name: alert_id
    - required: true
      description: The new status.
      name: alert_status
    - description: The aggregate alert id.
      name: aggregate_alert_id
  dockerimage: demisto/sixgill:1.0.0.10120494
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0
defaultmapperin: Cybersixgill Actionable Alerts - Incoming Mapper