category: Data Enrichment & Threat Intelligence
provider: Filigran
commonfields:
  id: OpenCTI Feed
  version: -1
configuration:
- display: API Key
  name: apikey
  required: true
  type: 4
- display: Base URL
  name: base_url
  required: true
  type: 0
- additionalinfo: 'The indicator types to fetch. Out of the box indicator types supported in XSOAR are: "User-Account", "Domain", "Email-Address", "File-md5", "File-sha1", "File-sha256", "HostName", "IPV4-Addr", "IPV6-Addr", "Registry-Key-Value", and "URL". The rest will not cause automatic indicator creation in XSOAR. Please refer to the integration documentation for more information. The default is "ALL".'
  defaultvalue: ALL
  display: Indicators Type to fetch
  name: indicator_types
  options:
  - ALL
  - User-Account
  - Domain
  - Email-Address
  - File-MD5
  - File-SHA1
  - File-SHA256
  - HostName
  - IPV4-Addr
  - IPV6-Addr
  - Registry-Key-Value
  - URL
  required: true
  type: 16
- defaultvalue: '500'
  display: Max. indicators per fetch (default is 500)
  name: max_indicator_to_fetch
  type: 0
  required: false
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: feedInstanceReputationNotSet
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
deprecated: true
description: Deprecated. Use OpenCTI Feed 4.X instead.
display: OpenCTI Feed 3.X (Deprecated)
name: OpenCTI Feed
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of indicators to return per fetch. The default value is "50".
      name: limit
    - auto: PREDEFINED
      defaultValue: ALL
      description: 'The indicator types to fetch. Out of the box indicator types supported in XSOAR are: "User-Account", "Domain", "Email-Address", "File-md5", "File-sha1", "File-sha256", "HostName", "IPV4-Addr", "IPV6-Addr", "Registry-Key-Value", and "URL". The rest will not cause automatic indicator creation in XSOAR. Please refer to the integration documentation for more information. The default is "ALL".'
      isArray: true
      name: indicator_types
      predefined:
      - ALL
      - User-Account
      - Domain
      - Email-Address
      - File-MD5
      - File-SHA1
      - File-SHA256
      - HostName
      - IPV4-Addr
      - IPV6-Addr
      - Registry-Key-Value
      - URL
    - description: The last ID from the previous call from which to begin pagination for this call.
      name: last_id
    description: Gets indicators from the feed.
    name: opencti-get-indicators
    outputs:
    - contextPath: OpenCTI.Indicators.type
      description: Indicator type.
      type: String
    - contextPath: OpenCTI.Indicators.value
      description: Indicator value.
      type: String
    - contextPath: OpenCTI.LastRunID
      description: the id of the last fetch to use pagination.
      type: String
  - description: 'WARNING: This command will reset your fetch history.'
    name: opencti-reset-fetch-indicators
  dockerimage: demisto/opencti:1.0.0.41469
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python

fromversion: 5.5.0