name: CTM360_HackerView
display: CTM360 HackerView
category: Network Security
provider: CTM360
commonfields:
  id: CTM360_HackerView
  version: -1
configuration:
- additionalinfo: "Choose the direction to mirror the incident: Incoming (from HackerView to Cortex XSOAR), Outgoing (from Cortex XSOAR to HackerView), or Incoming and Outgoing (from/to Cortex XSOAR and HackerView)."
  defaultvalue: Incoming And Outgoing
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- defaultvalue: Light Scan
  display: Module To Use
  additionalinfo: "The module to use: Light Scan or Deep Scan."
  name: module_to_use
  required: false
  type: 15
  options:
  - Light Scan
  - Deep Scan
  section: Collect
- additionalinfo: The time the incidents should be fetched starting from.
  name: first_fetch
  required: false
  type: 0
  defaultvalue: 7 days
  display: First fetch (<number> <time unit>, e.g., 12 hours)
  section: Collect
  advanced: true
- name: api_key
  type: 9
  required: true
  additionalinfo: The CTM360 HackerView API Key to use for fetching data.
  section: Connect
  displaypassword: API Key
  hiddenusername: true
- display: Maximum Number of Incidents per Fetch
  name: max_fetch
  type: 0
  required: true
  section: Collect
  defaultvalue: "25"
  additionalinfo: The maximum number of incidents to fetch per run. Maximum is 200.
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Incident type
  defaultvalue: HackerView Incident
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultmapperin: 'CTM360-HackerView - Incoming Mapper'
description: 'External Attack Surface Management platform, which combines automated asset discovery, issue identification / management, remediation guidelines, security ratings and third party risk management.'
script:
  commands:
  - name: ctm360-hv-incident-list
    description: Get the list of incidents from HV.
    arguments:
    - description: Select "From" date to fetch incidents starting from it.
      name: dateFrom
      required: false
    - description: Select "To" date to fetch incidents up to it.
      name: dateTo
      required: false
    - description: Set number of results to fetch.
      name: maxHits
      required: false
    - description: Set the order of the results.
      name: order
      required: false
    outputs:
    - contextPath: HackerView.IncidentList
      description: List of all HV incidents.
  - name: ctm360-hv-incident-status-change
    description: Change status of a HV incident and optionally add a comment.
    arguments:
    - name: ticketId
      description: '"ID" of the incident to change status.'
      required: true
    - name: ticketStatus
      description: 'New "Status" of incident.'
      required: true
    - name: comment
      description: '"Comment" to accompany the status change (Optional).'
      required: false
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type.
    arguments: []
  - name: ctm360-hv-incident-details
    description: Fetch details of a single incident from the HackerView platform.
    arguments:
    - description: '"Ticket ID" of the incident to fetch.'
      name: ticketId
      required: true
    outputs:
    - contextPath: HackerView.RemoteIncident.id
      description: The symbolic incident ID.
    - contextPath: HackerView.RemoteIncident.timestamp
      description: The database timestamp.
    - contextPath: HackerView.RemoteIncident.confidence
      description: The confidence of the report.
    - contextPath: HackerView.RemoteIncident.cve_id
      description: The associated CVE identifier(s).
    - contextPath: HackerView.RemoteIncident.cwe
      description: The list of associated CWEs.
    - contextPath: HackerView.RemoteIncident.issue_category
      description: The category of the incident.
    - contextPath: HackerView.RemoteIncident.issue_name
      description: The name of the incident.
    - contextPath: HackerView.RemoteIncident.potential_attack_type
      description: The potential attack type that can make use of the incident.
    - contextPath: HackerView.RemoteIncident.potential_impact
      description: The potential impact of the incident.
    - contextPath: HackerView.RemoteIncident.status
      description: The active status of the incident.
    - contextPath: HackerView.RemoteIncident.progress_status
      description: The progress of incident response.
    - contextPath: HackerView.RemoteIncident.severity
      description: The severity of the incident.
    - contextPath: HackerView.RemoteIncident.resolved_ip
      description: The IP resolved on the affected asset.
    - contextPath: HackerView.RemoteIncident.first_seen
      description: The incident creation date.
    - contextPath: HackerView.RemoteIncident.last_seen
      description: The last discovery date for the incident.
    - contextPath: HackerView.RemoteIncident.last_updated
      description: The last update date for the incident.
    - contextPath: HackerView.RemoteIncident.environments
      description: The environments associated with the incident.
    - contextPath: HackerView.RemoteIncident.ticket_id
      description: The ticket ID.
    - contextPath: HackerView.RemoteIncident.technologies
      description: The technologies on the affected asset.
    - contextPath: HackerView.RemoteIncident.domain
      description: The domain of the affected asset.
    - contextPath: HackerView.RemoteIncident.host
      description: The host of the affected asset.
    - contextPath: HackerView.RemoteIncident.asset_type
      description: The affected asset type.
    - contextPath: HackerView.RemoteIncident.asset
      description: The affected asset.
    - contextPath: HackerView.RemoteIncident.brand
      description: The organization brand the incident belongs to.
    - contextPath: HackerView.RemoteIncident.ip
      description: The IP address associated with the finding.
    - contextPath: HackerView.RemoteIncident.port
      description: The network port associated with the finding.
    - contextPath: HackerView.RemoteIncident.uri
      description: The URI path or resource related to the finding.
    - contextPath: HackerView.RemoteIncident.url
      description: The base URL of the affected asset or service.
    - contextPath: HackerView.RemoteIncident.issue_type
      description: The type or classification of the issue.
    - contextPath: HackerView.RemoteIncident.issue_description
      description: The detailed description of the issue.
    - contextPath: HackerView.RemoteIncident.cpe
      description: The Common Platform Enumeration (CPE) identifier if applicable.
    - contextPath: HackerView.RemoteIncident.cvss_metrics
      description: The CVSS vector or metric string for the vulnerability.
    - contextPath: HackerView.RemoteIncident.cvss_score
      description: The CVSS base score for the vulnerability.
    - contextPath: HackerView.RemoteIncident.epss_score
      description: The Exploit Prediction Scoring System (EPSS) score.
    - contextPath: HackerView.RemoteIncident.known_exploited
      description: The indicator of whether the vulnerability is known to be exploited.
    - contextPath: HackerView.RemoteIncident.hackerview_link
      description: The link to the issue in the HackerView platform.
    - contextPath: HackerView.RemoteIncident.evidence
      description: The request/response evidence for the finding (e.g. request, response, curl_command).
  - name: get-remote-data
    arguments:
    - description: The incident ID.
      name: id
      required: true
    - description: Retrieves entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: get-modified-remote-data
    arguments:
    - description: A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
  - name: update-remote-system
    arguments:
    - description: Remote ID of incident to update in the remote system.
      name: remoteId
      required: true
    description: Updates the remote system with local changes.
  isfetch: true
  runonce: false
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)
sectionorder:
- Connect
- Collect