category: Data Enrichment & Threat Intelligence
provider: Cyble
commonfields:
  id: CybleEvents
  version: -1
configuration:
- additionalinfo: Server URL (e.g. https://example.net)
  defaultvalue: https://example.net
  display: URL
  name: url
  required: true
  type: 0
- additionalinfo: Access Token
  display: Access Token
  name: token
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
- additionalinfo: Maximum incidents to be fetched every time. Upper limit is 50 incidents.
  defaultvalue: '1'
  display: Incident Fetch Limit
  name: max_fetch
  required: true
  type: 0
- display: Incident type
  name: incidentType
  type: 13
  required: false
- additionalinfo: Fetch the events based on chosen priority. If not chosen all priority events will be fetched.
  display: Priority
  name: priority
  options:
  - high
  - medium
  - low
  - informational
  type: 15
  required: false
description: Cyble Events for Vision Users. Must have Vision API access to use the threat intelligence.
display: Cyble Events
name: CybleEvents
script:
  commands:
  - arguments:
    - defaultValue: '0'
      description: Returns records started with given value.
      name: from
    - defaultValue: '1'
      description: Number of records to return (max 1000). Using a smaller limit will get faster responses.
      name: limit
    - description: Timeline start date in the format "YYYY-MM-DD". Need to used with end_date as timeline range.
      name: start_date
    - description: Timeline end date in the format "YYYY-MM-DD". Need to used with start_date as timeline range.
      name: end_date
    - description: Returns record by type like (CIDR, CVE, domain, email, FileHash-IMPHASH, FileHash-MD5, FileHash-PEHASH, FileHash-SHA1, FileHash-SHA256, FilePath, hostname, IPv4, IPv6, Mutex, NIDS, URI, URL, YARA, osquery, Ja3, Bitcoinaddress, Sslcertfingerprint).
      name: type
    - description: Returns records for the specified keyword.
      name: keyword
    description: Fetch the indicators for the given timeline.
    name: cyble-vision-fetch-iocs
    outputs:
    - contextPath: CybleEvents.IoCs.data
      description: Returns indicator inital creation date.
      type: String
  - arguments:
    - defaultValue: '0'
      description: Returns records for the timeline starting from given indice.
      name: from
      required: true
    - defaultValue: '5'
      description: Number of records to return (max 50). Using a smaller limit will get faster responses.
      name: limit
      required: true
    - description: Timeline start date in the format "YYYY/MM/DD".
      name: start_date
      required: true
    - description: Timeline end date in the format "YYYY/MM/DD".
      name: end_date
      required: true
    - auto: PREDEFINED
      defaultValue: Ascending
      description: Sorting order for alert fetch either Ascending or Descending.
      name: order_by
      predefined:
      - Ascending
      - Descending
      required: true
    - auto: PREDEFINED
      description: Fetch the events based on priority. All priorities will be considered by default.
      name: priority
      predefined:
      - high
      - medium
      - low
      - informational
    description: Fetch Incident event alerts based on the given parameters. Alerts would have multiple events grouped into one based on specific service type. So user would see in few cases more events than the limit provided.
    name: cyble-vision-fetch-alerts
    outputs:
    - contextPath: CybleEvents.Events.eventid
      description: Returns the event ID.
      type: String
    - contextPath: CybleEvents.Events.eventtype
      description: Returns the event type.
      type: String
    - contextPath: CybleEvents.Events.severity
      description: Returns the event severity.
      type: Number
    - contextPath: CybleEvents.Events.occurred
      description: Returns the event occurred timeline.
      type: Date
    - contextPath: CybleEvents.Events.name
      description: Returns the alert title.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsname
      description: Returns the event name.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsbucket
      description: Returns the event bucket name.
      type: String
    - contextPath: CybleEvents.Events.cybleeventskeyword
      description: Returns the event keyword.
      type: String
    - contextPath: CybleEvents.Events.cybleeventsalias
      description: Returns the event type alias name.
      type: String
  - arguments:
    - description: Event Type of the Incident.
      name: event_type
      required: true
    - description: Event ID of the incident.
      name: event_id
      required: true
    - defaultValue: '0'
      description: The value in the field represents the position of records that are retrieved.
      name: from
      required: true
    - defaultValue: '100'
      description: The value in the field represents the number of events that can be returned, maximum allowed is 1000.
      name: limit
      required: true
    description: Fetch Incident detail based on event type and event ID.
    name: cyble-vision-fetch-event-detail
    outputs:
    - contextPath: CybleEvents.Events.Details
      description: Returns details for given event of specific type.
      type: String
  dockerimage: demisto/python3:3.12.8.1983910
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0