commonfields:
  id: FeedExpanse
  version: -1
display: Expanse Expander Feed (Deprecated)
deprecated: true
name: FeedExpanse
category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
description: Deprecated. Use Xpanse Feed integration instead. >
  Use this feed to retrieve the discovered IPs/Domains/Certificates from Expanse Expander asset database.
configuration:
- defaultvalue: https://expander.expanse.co
  display: Your server URL
  name: url
  required: true
  type: 0
- name: credentials
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: API Key
  name: apikey
  type: 4
  additionalinfo: The API Key to use for connection
  hidden: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- defaultvalue: '20000'
  display: The maximum number of indicators to fetch.
  name: max_fetch
  type: 0
  required: false
- defaultvalue: '7'
  name: min_last_observed
  display: 'Retrieve indicators observed in the last specified number of days'
  type: 0
  required: false
- defaultvalue: 'suddenDeath'
  display: ''
  name: feedExpirationPolicy
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  defaultvalue: '720'
  required: false
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  defaultvalue: F - Reliability cannot be judged
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
script:
  commands:
  - name: feedexpanse-get-indicators
    arguments:
    - defaultValue: '10'
      description: The maximum number of results to return per type
      name: max_indicators
    - defaultValue: yes
      description: Retrieve discovered IPs
      name: ip
    - defaultValue: yes
      description: Retrieve discovered Domains
      name: domain
    - defaultValue: yes
      description: Retrieve discovered certificates
      name: certificate
    - defaultValue: yes
      description: Retrieve IP Ranges
      name: iprange
    description: Retrieve discovered IPs/IP Ranges/Domains/Certificates
    execution: true
  feed: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.10.13.72123
fromversion: 6.0.0
tests:
- Feed Expanse Test