category: Data Enrichment & Threat Intelligence
provider: Doppel
sectionorder:
- Connect
- Collect
commonfields:
  id: Doppel
  version: -1
configuration:
- additionalinfo: The Doppel server URL that will be used for calling the APIs.
  defaultvalue: https://api.doppel.com/
  display: Doppel Tenant URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The API Key to use for connection with Doppel.
  display: ""
  displaypassword: API Key
  hiddenusername: true
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: The User API Key (Optional) to use for connection with Doppel.
  display: ""
  displaypassword: User API Key
  hiddenusername: true
  name: user_credentials
  required: false
  type: 9
  section: Connect
- display: Organization Code
  name: organization_code
  required: false
  type: 0
  section: Connect
  additionalinfo: The Organization Code to use for connection with Doppel.
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: true
  type: 19
  section: Connect
  additionalinfo: The interval specifies the cadence with which the Doppel alerts be fetched.
  defaultvalue: "1"
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  required: false
  type: 13
  section: Connect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'Choose the direction to mirror the incident: None (No mirroring), Incoming (from Doppel to Cortex XSOAR), Outgoing (from Cortex XSOAR to Doppel), Incoming and Outgoing (from/to Cortex XSOAR and Doppel). Cortex XSOAR only parameter.'
  display: Mirror Direction
  name: mirror_direction
  required: false
  type: 15
  section: Collect
  options:
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  - None
  hidden:
  - marketplacev2
  - platform
- additionalinfo: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  defaultvalue: "1 day"
  display: First fetch
  name: first_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: The time limit in seconds for fetch incidents to run. Leave this empty to cancel the timeout limit.
  defaultvalue: "30"
  display: Fetch incidents timeout
  name: fetch_timeout
  required: false
  type: 0
  section: Collect
- display: Number of incidents for each fetch.
  name: max_fetch
  type: 0
  required: false
  section: Collect
  additionalinfo: Due to API limitations, the maximum is 100.
  defaultvalue: "10"
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: |-
  Doppel is a Modern Digital Risk Protection Solution, that detects the phishing and brand cyber attacks on the emerging channels. Doppel scans millions of channels online which includes, social media, domains, paid ads, dark web, emerging channels, etc. Doppel can identify the malicious content and cyber threats, and enables their customers to take down the digital risks proactively.
  The Cortex XSOAR pack for Doppel mirrors the alerts created by Doppel as Cortex XSOAR incidents. The pack also contains the commands to perform different operations on Doppel alerts.
display: Doppel
name: Doppel
script:
  commands:
  - arguments:
    - description: The ID of the alert to retrieve details for.
      name: id
    - description: The alerted entity to retrieve details for.
      name: entity
    description: Retrieves the alert details by ID or entity. Must include either ID or entity.
    name: doppel-get-alert
    outputs:
    - contextPath: Doppel.Alert.id
      description: 'The unique identifier of the alert (e.g., TET-1953421).'
      type: String
    - contextPath: Doppel.Alert.entity
      description: 'The URL or profile link related to the alert.'
      type: String
    - contextPath: Doppel.Alert.brand
      description: 'The brand associated with the alert.'
      type: String
    - contextPath: Doppel.Alert.queue_state
      description: 'The current state of the alert in the queue.'
      type: String
    - contextPath: Doppel.Alert.entity_state
      description: 'The current state of the alert entity (e.g., active, inactive).'
      type: String
    - contextPath: Doppel.Alert.severity
      description: 'The severity level of the alert (e.g., low, medium, high).'
      type: String
    - contextPath: Doppel.Alert.product
      description: 'The product category associated with the alert (e.g., social media).'
      type: String
    - contextPath: Doppel.Alert.platform
      description: 'The platform on which the alert was generated (e.g., Bluesky).'
      type: String
    - contextPath: Doppel.Alert.source
      description: 'The source from which the alert was generated (e.g., Analyst Upload).'
      type: String
    - contextPath: Doppel.Alert.notes
      description: 'Additional notes related to the alert, if any.'
      type: Unknown
    - contextPath: Doppel.Alert.created_at
      description: 'The timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.Alert.doppel_link
      description: 'The link to the alert on the Doppel platform.'
      type: String
    - contextPath: Doppel.Alert.entity_content
      description: 'Additional content related to the alert entity.'
      type: Unknown
    - contextPath: Doppel.Alert.audit_logs.timestamp
      description: 'Timestamp when the audit log entry was created.'
      type: Date
    - contextPath: Doppel.Alert.audit_logs.type
      description: 'The type of audit log entry (e.g., alert_create).'
      type: String
    - contextPath: Doppel.Alert.audit_logs.value
      description: 'The value of the audit log entry (e.g., needs_review).'
      type: String
    - contextPath: Doppel.Alert.audit_logs.changed_by
      description: 'The user who made the change, if available.'
      type: String
    - contextPath: Doppel.Alert.audit_logs.metadata
      description: 'Additional metadata related to the audit log.'
      type: Unknown
    - contextPath: Doppel.Alert.tags
      description: 'Tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.Alert.uploaded_by
      description: 'The user or source who uploaded the alert (e.g., Doppel).'
      type: String
  - arguments:
    - description: The entity for which the alert should be created.
      name: entity
      required: true
    description: Creates an alert for a specified entity. This command requires the entity to be provided in the arguments.
    name: doppel-create-alert
    outputs:
    - contextPath: Doppel.CreatedAlert.id
      description: 'The unique ID of the alert.'
      type: String
    - contextPath: Doppel.CreatedAlert.entity
      description: 'The entity URL associated with the alert.'
      type: String
    - contextPath: Doppel.CreatedAlert.doppel_link
      description: 'The link to view the alert in the Doppel platform.'
      type: String
  - arguments:
    - description: The ID of the alert to update. Either 'alert_id' or 'entity' should be specified, not both.
      name: alert_id
    - description: A new comment to be added to the alert.
      name: comment
    - description: The entity of the alert to update. Either 'alert_id' or 'entity' should be specified, not both.
      name: entity
    - auto: PREDEFINED
      description: Status of which queue the alert is in.
      name: queue_state
      predefined:
      - doppel_review
      - actioned
      - needs_confirmation
      - monitoring
      - taken_down
      - archived
    - auto: PREDEFINED
      description: State of the alert.
      name: entity_state
      predefined:
      - active
      - down
      - parked
    description: Updates an alert in the Doppel platform. Either 'alert_id' or 'entity' must be specified.
    name: doppel-update-alert
    outputs:
    - contextPath: Doppel.UpdatedAlert.id
      description: 'Unique identifier for the alert (e.g., TET-1953421).'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity
      description: 'The URL or identifier associated with the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.brand
      description: 'The brand associated with the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.queue_state
      description: 'The current state of the alert in the queue.'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity_state
      description: 'The current state of the alert entity.'
      type: String
    - contextPath: Doppel.UpdatedAlert.severity
      description: 'The severity of the alert (e.g., Low, Medium, High).'
      type: String
    - contextPath: Doppel.UpdatedAlert.product
      description: 'The product category related to the alert.'
      type: String
    - contextPath: Doppel.UpdatedAlert.platform
      description: 'The platform associated with the alert (e.g., Bluesky).'
      type: String
    - contextPath: Doppel.UpdatedAlert.source
      description: 'The source of the alert (e.g., Analyst Upload).'
      type: String
    - contextPath: Doppel.UpdatedAlert.notes
      description: 'Additional notes regarding the alert.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.created_at
      description: 'Timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.UpdatedAlert.doppel_link
      description: 'URL link to the alert in Doppel Vision.'
      type: String
    - contextPath: Doppel.UpdatedAlert.entity_content
      description: 'Content details of the alert entity.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.audit_logs.timestamp
      description: 'Timestamp of the audit log entry.'
      type: Date
    - contextPath: Doppel.UpdatedAlert.audit_logs.type
      description: 'The type of audit log entry.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.value
      description: 'The value associated with the audit log entry.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.changed_by
      description: 'The user who changed the alert, or null if system-generated.'
      type: String
    - contextPath: Doppel.UpdatedAlert.audit_logs.metadata
      description: 'Additional metadata related to the audit log entry.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.tags
      description: 'List of tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.UpdatedAlert.uploaded_by
      description: 'The user or system that uploaded the alert (e.g., Doppel).'
      type: String
  - arguments:
    - description: The entity for which the abuse alert should be created.
      name: entity
      required: true
    description: Create an alert for the provided value to abuse box. Will fail if the alert value is invalid or is protected.
    name: doppel-create-abuse-alert
    outputs:
    - contextPath: Doppel.AbuseAlert.message
      description: 'Message indicating the status of the submission process.'
      type: String
  - arguments:
    - description: Currently only supports search by URL.
      name: search_key
    - auto: PREDEFINED
      description: New queue status to update alert with (ID required).
      name: queue_state
      predefined:
      - actioned
      - needs_confirmation
      - doppel_review
      - monitoring
      - taken_down
      - archived
    - auto: PREDEFINED
      description: Product category the report belongs to.
      name: product
      predefined:
      - domains
      - social_media
      - mobile_apps
      - ecommerce
      - crypto
      - email
      - paid_ads
      - telco
      - darkweb
    - description: Filter alerts created before a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like '12 hours' or '7 days'.
      name: created_before
    - description: Filter alerts created after a specific time. Use the ISO 8601 format, such as 2020-01-01T00:11:22Z. For durations, enter values like '12 hours' or '7 days'.
      name: created_after
    - auto: PREDEFINED
      description: The field to sort the reports by.
      defaultValue: date_sourced
      name: sort_type
      predefined:
      - date_sourced
      - date_last_actioned
    - auto: PREDEFINED
      description: The order to sort the reports by.
      defaultValue: desc
      name: sort_order
      predefined:
      - asc
      - desc
    - description: Page number for pagination.
      defaultValue: '0'
      name: page
    - description: List of tags to filter alerts.
      isArray: true
      name: tags
    description: Retrieves a list of alerts. The result can be filtered by provided parameters.
    name: doppel-get-alerts
    outputs:
    - contextPath: Doppel.GetAlerts.alerts.id
      description: 'The unique ID of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity
      description: 'The entity associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.brand
      description: 'The brand related to the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.queue_state
      description: 'The queue state of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_state
      description: 'The current state of the entity (active/inactive).'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.severity
      description: 'The severity of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.product
      description: 'The product related to the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.platform
      description: 'The platform associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.source
      description: 'The source of the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.created_at
      description: 'The timestamp when the alert was created.'
      type: Date
    - contextPath: Doppel.GetAlerts.alerts.doppel_link
      description: 'The link to the alert in the Doppel platform.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.domain
      description: 'The domain associated with the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.registrar
      description: 'The registrar of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.ip_address
      description: 'The IP address of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.country_code
      description: 'The country code of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.hosting_provider
      description: 'The hosting provider for the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.contact_email
      description: 'The contact email of the domain.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.mx_records
      description: 'The MX records associated with the domain.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.entity_content.root_domain.nameservers
      description: 'The nameservers associated with the domain.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.timestamp
      description: 'The timestamp of the audit log.'
      type: Date
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.type
      description: 'The type of the audit log.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.value
      description: 'The value associated with the audit log.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.changed_by
      description: 'The user or system that changed the status.'
      type: String
    - contextPath: Doppel.GetAlerts.alerts.audit_logs.metadata
      description: 'Additional metadata for the audit log.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.tags
      description: 'The tags associated with the alert.'
      type: Unknown
    - contextPath: Doppel.GetAlerts.alerts.uploaded_by
      description: 'The source or user who uploaded the alert.'
      type: String
    - contextPath: Doppel.GetAlerts.metadata.count
      description: 'The total count of alerts.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.page
      description: 'The current page number in the results.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.total_pages
      description: 'The total number of pages for the alerts.'
      type: Integer
    - contextPath: Doppel.GetAlerts.metadata.page_size
      description: 'The number of alerts per page.'
      type: Integer
  - arguments: []
    description: Returns the list of fields for an incident type.
    name: get-mapping-fields
  - arguments: []
    description: Pushes local changes to the remote system.
    name: update-remote-system
  - arguments:
    - default: false
      description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    description: Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
    name: get-modified-remote-data
  - arguments:
    - default: false
      description: The remote incident ID.
      isArray: false
      name: id
      required: true
      secret: false
    - default: false
      defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    name: get-remote-data
  dockerimage: demisto/python3:3.12.13.10404775
  script: '-'
  type: python
  subtype: python3
  isFetchSamples: true
  isfetch: true
  isremotesyncin: true
  isremotesyncout: true
  ismappable: true
  runonce: false
fromversion: 6.10.0
tests:
- No tests (auto formatted)