category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: FeedMISPThreatActors
  version: -1
configuration:
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- defaultvalue: https://raw.githubusercontent.com/MISP/misp-galaxy/refs/heads/main/clusters/threat-actor.json
  display: MISP Threat actor galaxy raw address
  name: url
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Indicator Reputation
  name: feedReputation
  type: 18
  required: false
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: B - Usually reliable
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- name: feedExpirationPolicy
  display: ''
  defaultvalue: indicatorType
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
- name: feedExpirationInterval
  display: ''
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '240'
  type: 19
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- display: Traffic Light Protocol Color
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: WHITE
  section: Collect
- name: feedTags
  display: Tags
  type: 0
  additionalinfo: Supports CSV values.
  section: Collect
description: Fetches the MISP threat actor galaxy and builds it into Threat Actor indicators in Cortex Threat Intel Management (TIM).
display: Feed MISP Threat Actors
name: FeedMISPThreatActors
script:
  feed: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: mispthreatactors-get-indicators
    arguments:
    - name: limit
      description: Limit the amount of indicators to fetch (default is 10).
      required: false
    outputs:
    - contextPath: FeedMISPThreatActors.ThreatActor.name
      description: The name of the threat actor.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.description
      description: The threat actor description.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.aliases
      description: Additional aliases the threat actor may be known by.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.country
      description: The origin country of the threat actor.
      type: string
    description: Retrieves indicators from Threat Vault.
fromversion: 6.10.0
tests:
- No tests (auto formatted)