sectionorder: - Connect - Collect commonfields: id: Cyberint Feed version: -1 fromversion: 6.9.0 name: Cyberint Feed display: Check Point EM Feed provider: Check Point Software Technologies category: Data Enrichment & Threat Intelligence description: Use the Cyberint Feed integration to get indicators from the feed. configuration: - display: Cyberint API URL additionalinfo: Cyberint API URL on which the services run (i.e https://your-company.cyberint.io) name: url required: true type: 0 section: Connect - display: Company Name additionalinfo: Company (client) name associated with Cyberint instance. name: client_name required: true type: 0 section: Connect - display: API Key (Leave empty. Fill in the API Key in the password field.) displaypassword: API access token name: access_token hiddenusername: true type: 9 required: true section: Connect - display: Fetch indicators name: feed defaultvalue: "true" type: 8 required: false section: Collect - display: Indicator Reputation name: feedReputation defaultvalue: Good type: 18 options: - None - Good - Suspicious - Bad additionalinfo: Indicators from this integration instance will be marked with this reputation required: false section: Collect - display: Source Reliability name: feedReliability defaultvalue: F - Reliability cannot be judged type: 15 required: true options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged additionalinfo: Reliability of the source providing the intelligence data section: Collect - additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed display: Traffic Light Protocol Color name: tlp_color options: - RED - AMBER - GREEN - WHITE type: 15 required: false section: Collect - additionalinfo: Which indicator types to fetch defaultvalue: All display: Indicator Type name: indicator_type options: - All - IP - Domain - URL - File required: true type: 16 section: Collect - display: Feed Name name: feed_name defaultvalue: All options: - All - malware_payload - cnc_server - infected_machine - phishing_website - payload_delivery - cc_skimming - botnet - anonymization required: true type: 16 section: Collect - additionalinfo: Confidence about the indicator details. The value of confidence to fetch indicators from. The value between 0-100. display: Confidence name: confidence_from defaultvalue: "0" type: 0 required: false section: Collect - additionalinfo: Severity about the indicator details. The value of severity to fetch indicators from. The value between 0-100. display: Severity name: severity_from defaultvalue: "0" type: 0 required: false section: Collect - display: "" name: feedExpirationPolicy defaultvalue: suddenDeath type: 17 options: - never - interval - indicatorType - suddenDeath required: false section: Collect - display: "" name: feedExpirationInterval defaultvalue: "20160" type: 1 required: false section: Collect - display: Feed Fetch Interval name: feedFetchInterval defaultvalue: "240" type: 19 required: false section: Collect - additionalinfo: Supports CSV values. display: Tags name: feedTags type: 0 required: false section: Collect - display: Bypass exclusion list name: feedBypassExclusionList defaultvalue: "true" type: 8 additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. required: false section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect script: script: '' type: python commands: - name: cyberint-get-indicators arguments: - name: date description: Date of data feed for retrieval (e.g. 2024-12-31). The default value is today. - name: limit description: The maximum number of results to return. The default value is 50. defaultValue: "50" - name: offset description: Specifies the starting point or position from which data retrieval or processing should begin. defaultValue: "0" outputs: - contextPath: Cyberint.indicator.detected_activity description: Detected activity. type: String - contextPath: Cyberint.indicator.ioc_type description: The indicator type. type: String - contextPath: Cyberint.indicator.ioc_value description: The indicator value. type: String - contextPath: Cyberint.indicator.observation_date description: Observation date. type: String - contextPath: Cyberint.indicator.severity_score description: Severity score. type: String - contextPath: Cyberint.indicator.confidence description: Confidence. type: String - contextPath: Cyberint.indicator.description description: Description. type: String description: Gets indicators from the feed. - name: cyberint-get-file-sha256 arguments: - name: value description: SHA256 string. outputs: - contextPath: Cyberint.file_sha256.entity.type description: The indicator type. type: String - contextPath: Cyberint.file_sha256.entity.value description: The indicator value. type: String - contextPath: Cyberint.file_sha256.risk.malicious_score description: Malicious score. type: String - contextPath: Cyberint.file_sha256.risk.occurrences_count description: Occurences count. type: String - contextPath: Cyberint.file_sha256.enrichment.filenames description: Filenames. type: String - contextPath: Cyberint.file_sha256.enrichment.first_seen description: First seen. type: String - contextPath: Cyberint.file_sha256.enrichment.download_urls description: Download URLs. type: String - contextPath: Cyberint.file_sha256.benign description: Benign. type: String description: Gets File SHA256 enrichment from the feed. - name: cyberint-get-domain arguments: - name: value description: Domain string. outputs: - contextPath: Cyberint.domain.entity.type description: The indicator type. type: String - contextPath: Cyberint.domain.entity.value description: The indicator value. type: String - contextPath: Cyberint.domain.risk.malicious_score description: Malicious score. type: String - contextPath: Cyberint.domain.risk.occurrences_count description: Occurences count. type: String - contextPath: Cyberint.domain.enrichment.ips description: IPs. type: String - contextPath: Cyberint.domain.enrichment.whois.created_date description: Created date. type: String - contextPath: Cyberint.domain.enrichment.whois.updated_date description: Updated date. type: String - contextPath: Cyberint.domain.enrichment.whois.expiration_date description: Expiration date. type: String - contextPath: Cyberint.domain.enrichment.whois.registrant_name description: Registrant name. type: String - contextPath: Cyberint.domain.enrichment.whois.registrant_email description: Registrant email. type: String - contextPath: Cyberint.domain.enrichment.whois.registrant_organization description: Registrant organization. type: String - contextPath: Cyberint.domain.enrichment.whois.registrant_country description: Registrant country. type: String - contextPath: Cyberint.domain.enrichment.whois.registrant_telephone description: Registrant telephone. type: String - contextPath: Cyberint.domain.enrichment.whois.technical_contact_email description: Technical contact email. type: String - contextPath: Cyberint.domain.enrichment.whois.technical_contact_name description: Technical contact name. type: String - contextPath: Cyberint.domain.enrichment.whois.technical_contact_organization description: Technical contact organization. type: String - contextPath: Cyberint.domain.enrichment.whois.registrar_name description: Registrar name. type: String - contextPath: Cyberint.domain.enrichment.whois.admin_contact_name description: Admin contact name. type: String - contextPath: Cyberint.domain.enrichment.whois.admin_contact_organization description: Admin contact organization. type: String - contextPath: Cyberint.domain.enrichment.whois.admin_contact_email description: Admin contact email. type: String - contextPath: Cyberint.domain.benign description: Benign. type: String description: Gets Domain enrichment from the feed. - name: cyberint-get-ipv4 arguments: - name: value description: IPv4 string. outputs: - contextPath: Cyberint.ipv4.entity.type description: The indicator type. type: String - contextPath: Cyberint.ipv4.entity.value description: The indicator value. type: String - contextPath: Cyberint.ipv4.risk.malicious_score description: Malicious score. type: String - contextPath: Cyberint.ipv4.risk.occurrences_count description: Occurences count. type: String - contextPath: Cyberint.ipv4.enrichment.geo.country description: Country. type: String - contextPath: Cyberint.ipv4.enrichment.geo.city description: City. type: String - contextPath: Cyberint.ipv4.enrichment.asn.number description: ASN number. type: String - contextPath: Cyberint.ipv4.enrichment.asn.organization description: ASN organization. type: String - contextPath: Cyberint.ipv4.enrichment.suspicious_urls description: Suspicious URLs. type: String - contextPath: Cyberint.ipv4.enrichment.suspicious_domains description: Suspicious domains. type: String - contextPath: Cyberint.ipv4.benign description: Benign. type: String description: Gets IPv4 enrichment from the feed. - name: cyberint-get-url arguments: - name: value description: URL string (starts with schema, e.g. https://). outputs: - contextPath: Cyberint.url.entity.type description: The indicator type. type: String - contextPath: Cyberint.url.entity.value description: The indicator value. type: String - contextPath: Cyberint.url.risk.malicious_score description: Malicious score. type: String - contextPath: Cyberint.url.risk.occurrences_count description: Occurences count. type: String - contextPath: Cyberint.url.enrichment.ips description: IPs. type: String - contextPath: Cyberint.url.enrichment.hostname description: Hostname. type: String - contextPath: Cyberint.url.enrichment.domain description: Domain. type: String - contextPath: Cyberint.url.benign description: Benign. type: String description: Gets URL enrichment from the feed. - name: cyberint-cve-enrich arguments: - name: cve_id description: CVE identifier to enrich (e.g., CVE-2024-1234). Supports a comma-separated list of identifiers. required: true isArray: true outputs: - contextPath: Cyberint.CVE.cve_id description: The CVE identifier. type: String - contextPath: Cyberint.CVE.cyberint_score description: Cyberint proprietary risk score for the CVE. type: Number - contextPath: Cyberint.CVE.epss description: EPSS (Exploit Prediction Scoring System) probability score. type: Number - contextPath: Cyberint.CVE.description description: The CVE description. type: String - contextPath: Cyberint.CVE.published description: The date the CVE was published. type: Date - contextPath: Cyberint.CVE.last_updated description: The date the CVE was last updated. type: Date - contextPath: Cyberint.CVE.cvss.cvss_v3.base_score description: CVSS v3 base score. type: Number - contextPath: Cyberint.CVE.cvss.cvss_v3.base_severity description: CVSS v3 base severity. type: String - contextPath: Cyberint.CVE.cvss.cvss_v4.base_score description: CVSS v4 base score. type: Number - contextPath: Cyberint.CVE.cwes.cwe_id description: Associated CWE identifier. type: String - contextPath: Cyberint.CVE.cwes.name description: Associated CWE name. type: String - contextPath: Cyberint.CVE.risk_factors description: Risk factors associated with the CVE. type: Unknown - contextPath: Cyberint.CVE.exploited_by description: Threat actors observed exploiting the CVE. type: Unknown - contextPath: Cyberint.CVE.products description: Products affected by the CVE. type: Unknown - contextPath: Cyberint.CVE.recommendation description: Cyberint remediation recommendation for the CVE. type: String - contextPath: Cyberint.CVE.references description: External references for the CVE. type: Unknown - contextPath: CVE.ID description: The CVE identifier. type: String - contextPath: CVE.CVSS description: The CVSS score of the CVE. type: String - contextPath: CVE.Published description: The date the CVE was published. type: Date - contextPath: CVE.Description description: The CVE description. type: String description: Enriches one or more CVE identifiers with Cyberint vulnerability intelligence, including EPSS, CVSS, CWE, the Cyberint CVE score and active-exploitation evidence. - name: cyberint-credential-leak-lookup arguments: - name: domain description: The company domain to search leaked credentials for (e.g., example.com). required: true - name: last_seen_from description: Only return credentials last seen on or after this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ). - name: last_seen_to description: Only return credentials last seen on or before this ISO-formatted date (YYYY-MM-DDTHH:MM:SSZ). - name: limit description: Maximum number of leaked credential records to return per credential type (employee/customer). outputs: - contextPath: Cyberint.LeakedCredential.domain description: The company domain that was searched. type: String - contextPath: Cyberint.LeakedCredential.total description: Total number of leaked credential records returned. type: Number - contextPath: Cyberint.LeakedCredential.employee_total description: Number of leaked employee credential records returned. type: Number - contextPath: Cyberint.LeakedCredential.customer_total description: Number of leaked customer credential records returned. type: Number - contextPath: Cyberint.LeakedCredential.employee_credentials.username description: The leaked employee account username. type: String - contextPath: Cyberint.LeakedCredential.employee_credentials.first_seen description: The date the employee credential was first observed. type: Date - contextPath: Cyberint.LeakedCredential.employee_credentials.last_seen description: The date the employee credential was last observed. type: Date - contextPath: Cyberint.LeakedCredential.employee_credentials.entries description: The leaked credential entries (password, source, URL) for the employee account. type: Unknown - contextPath: Cyberint.LeakedCredential.customer_credentials.username description: The leaked customer account username. type: String - contextPath: Cyberint.LeakedCredential.customer_credentials.first_seen description: The date the customer credential was first observed. type: Date - contextPath: Cyberint.LeakedCredential.customer_credentials.last_seen description: The date the customer credential was last observed. type: Date - contextPath: Cyberint.LeakedCredential.customer_credentials.entries description: The leaked credential entries (password, source, URL) for the customer account. type: Unknown description: Looks up leaked employee or customer credentials associated with a company domain, using the Cyberint leaked-credentials API. compliantpolicies: - User Soft Remediation dockerimage: demisto/python3:3.12.13.10404775 feed: true subtype: python3 tests: - No tests