commonfields:
  id: FireEye iSIGHT
  version: -1
name: FireEye iSIGHT
display: FireEye iSIGHT
category: Data Enrichment & Threat Intelligence
provider: Google
description: FireEye cyber threat intelligence.
configuration:
- display: Public Key
  name: publicKey
  defaultvalue: ""
  type: 0
  required: true
- display: Private Key
  name: privateKey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: Private Key
  name: credentials_private_key
  hiddenusername: true
  type: 9
  required: false
- display: Version
  name: version
  defaultvalue: "2.5"
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      isArray: true
      description: A comma separated list of IPs to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: IP.Address
      description: The IP address.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search reports by ip.
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      isArray: true
      description: A comma separated list of domains to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: Domain.Name
      description: The domain name.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search reports by domain.
  - name: file
    arguments:
    - name: file
      isArray: true
      description: A comma separated list of md5 or sha1 to search by.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    description: basic search file report by md5/sha1. NOTE - specify only one of md5/sha1 arguments.
  - name: isight-get-report
    arguments:
    - name: reportID
      required: true
      default: true
      description: Report ID to search by.
    outputs:
    - contextPath: Report.ID
      description: Report ID.
    - contextPath: Report.title
      description: Report title.
    - contextPath: Report.publishDate
      description: Report publish date.
    - contextPath: Report.intelligenceType
      description: Report intelligence type (overview, vulnerability, malware, threat).
    - contextPath: Report.audience
      description: Report audience.
    - contextPath: Report.ThreatScape
      description: Report threat scape.
    - contextPath: Report.operatingSystems
      description: Report operating systems.
    - contextPath: Report.riskRating
      description: Report risk rating.
    - contextPath: Report.version
      description: Report version.
    - contextPath: Report.tagSection
      description: Report tag section.
    description: Get specific report.
  - name: isight-submit-file
    arguments:
    - name: entryID
      required: true
      default: true
      description: entry-id of the file to submit (e.g. 41@18).
    - name: description
      required: true
      description: file description.
    - name: type
      description: "Type of the given file."
      required: true
      auto: PREDEFINED
      predefined:
      - malware
      - other
    description: Submission of malware and other files for community sharing.
tests:
- No test
fromversion: 5.0.0