commonfields:
  id: CybleThreatIntel
  version: -1
name: CybleThreatIntel
display: Cyble Threat Intel
category: Data Enrichment & Threat Intelligence
provider: Cyble
description: Cyble Threat Intelligence for Vision Users. Must have access to Cyble TAXII Feed to access the threat intelligence.
configuration:
  - display: Traffic Light Protocol Color
    additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
    name: tlp_color
    type: 15
    options:
      - RED
      - AMBER
      - GREEN
      - WHITE
    required: false
    section: Collect
  - display: Feed Fetch Interval
    name: feedFetchInterval
    type: 19
    section: Collect
    defaultvalue: '1440'
    required: false
  - display: Fetch indicators
    name: feed
    type: 8
    section: Collect
    defaultvalue: 'true'
    required: false
  - display: Source Reliability
    name: feedReliability
    type: 15
    required: true
    defaultvalue: A - Completely reliable
    additionalinfo: Reliability of the source providing the intelligence data.
    options:
      - A - Completely reliable
      - B - Usually reliable
      - C - Fairly reliable
      - D - Not usually reliable
      - E - Unreliable
      - F - Reliability cannot be judged
    section: Collect
  - display: Indicator Reputation
    name: feedReputation
    type: 18
    defaultvalue: None
    options:
      - None
      - Good
      - Suspicious
      - Bad
    required: false
    additionalinfo: Indicators from this integration instance will be marked with
      this reputation.
    section: Collect
  - display: Tags
    name: feedTags
    type: 0
    required: false
    additionalinfo: Supports CSV values.
    section: Collect
  - display: ''
    name: feedExpirationPolicy
    type: 17
    options:
      - never
      - interval
      - indicatorType
      - suddenDeath
    required: false
    section: Collect
  - display: ''
    name: feedExpirationInterval
    type: 1
    required: false
    section: Collect
  - display: Bypass exclusion list
    name: feedBypassExclusionList
    type: 8
    required: false
    section: Collect
    additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  - display: Base URL
    name: base_url
    type: 0
    required: false
    section: Connect
  - display: Access Token
    name: credentials
    type: 9
    hiddenusername: true
    required: false
    section: Connect
  - display: Trust any certificate (not secure)
    name: insecure
    defaultvalue: 'false'
    type: 8
    section: Connect
    additionalinfo:
    required: false
  - display: Use system proxy settings
    name: proxy
    section: Connect
    defaultvalue: 'false'
    type: 8
    required: false
  - display: Collection Name
    name: collection
    type: 0
    required: false
    hidden: true
    section: Collect
    additionalinfo: Deprecated. TAXII-based ingestion is no longer supported.
  - display: Discovery Service
    name: discovery_service
    type: 0
    required: false
    section: Collect
    hidden: true
    additionalinfo: Collection name to fetch indicators from.
  - display: First fetch time (by days)
    name: initial_interval
    type: 0
    defaultvalue: 1
    required: true
    additionalinfo: How many hours back to fetch IOCs on first run. Max 3 hours.
    section: Collect
    hidden: true
  - display: Indicator Fetch Limit
    name: limit
    type: 0
    defaultvalue: '100'
    section: Collect
    additionalinfo: Maximum number of indicators to fetch per execution.
    hidden: true
script:
  type: python
  subtype: python3
  script: "-"
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  commands:
    - name: cyble-vision-ioc-lookup
      description: Lookup a single IOC using the Cyble Vision API.
      arguments:
        - name: ioc
          required: true
          description: IOC value.
      outputs:
        - contextPath: CybleIntel.IOCLookup
          description: IOC lookup response.
          type: String

    # --------------------------
    # Deprecated commands — must retain outputs for BC
    # --------------------------
    - name: cyble-vision-fetch-taxii
      deprecated: true
      description: Deprecated command. Do not use.
      arguments: []
      outputs:
        - contextPath: CybleIntel.Threat.details
          description: Backward compatibility placeholder.
          type: String
    - name: cyble-vision-get-collection-names
      deprecated: true
      description: Deprecated command. Do not use.
      arguments: []
      outputs:
        - contextPath: CybleIntel.collection.names
          description: Backward compatibility placeholder.
          type: String
fromversion: 6.2.0
tests:
- No tests (auto formatted)
sectionorder:
  - Connect
  - Collect