category: Data Enrichment & Threat Intelligence
commonfields:
  id: Haseen Threat Intel
  version: -1
name: Haseen Threat Intel
display: Haseen Threat Intel
description: Fetches indicators of compromise from a STIX 2.x threat-intelligence feed and parses them into Cortex XSOAR indicators.
sectionorder:
- Connect
- Collect
marketplaces:
- xsoar
- marketplacev2
configuration:
- display: Server URL
  name: url
  defaultvalue: 'https://share.haseen.gov.sa/api/v1/threat-intelligence/export/{export_id}'
  type: 0
  required: true
  section: Connect
  additionalinfo: "The full STIX export URL, including the export ID (e.g. https://share.haseen.gov.sa/api/v1/threat-intelligence/export/1234). Do not append ?token=... to this URL - provide the token in the API Token field below; it is sent automatically as a query parameter."
- display: API Token
  name: api_token
  type: 14
  required: true
  section: Connect
  additionalinfo: The API token from Haseen (settings page). Sent as a `token` query parameter on every request, per the Haseen API guide. This token and the Basic Auth Password below are the same secret - keep them in sync when rotating.
- display: Basic Auth Credentials (optional)
  displaypassword: Password
  name: credentials
  type: 9
  required: false
  section: Connect
  additionalinfo: The credentials for exports that require Basic authentication in addition to the token. Username is the account email; password is the API token. This password and the API Token parameter above are the same secret - keep them in sync when rotating.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
  defaultvalue: 'true'
  additionalinfo: Whether to fetch indicators from the Haseen feed.
- display: Indicator Reputation
  name: feedReputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
  section: Collect
  additionalinfo: The reputation to apply to indicators from this integration instance.
- display: Source Reliability
  name: feedReliability
  type: 15
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  defaultvalue: 'B - Usually reliable'
  section: Collect
  additionalinfo: The reliability of the source providing the intelligence data.
- display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: 'WHITE'
  required: false
  section: Collect
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
- display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: A comma-separated list of tags to apply to the fetched indicators.
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  advanced: true
  additionalinfo: Whether to bypass the exclusion list for indicators from this feed. When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- display: Incremental Feed
  name: feedIncremental
  type: 8
  required: false
  section: Collect
  advanced: true
  defaultvalue: 'false'
  additionalinfo: Whether to pull only new or modified indicators that have been sent from the integration.
- display: Indicator Limit
  name: limit
  type: 0
  defaultvalue: '1000'
  required: false
  section: Collect
  additionalinfo: The maximum number of indicators to fetch per iteration. Leave empty to fetch all indicators (no limit).
- display: First Fetch Time
  name: first_fetch
  defaultvalue: '7 days'
  type: 0
  required: false
  section: Collect
  additionalinfo: The time interval for the first retroactive fetch, formatted as <number> and <time unit> of type minute/hour/day. For example, 1 minute, 12 hours.
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  defaultvalue: '60'
  required: false
  section: Collect
  advanced: true
  additionalinfo: The interval at which to fetch indicators, in minutes. Haseen rate-limits the feed to 2 requests per hour, so set this to 60 or higher (the minimum) to avoid 429 throttling.
- name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  defaultvalue: '20160'
  additionalinfo: The interval in minutes after which an indicator's expiration is reset (in case the indicator has not been updated by the feed).
  advanced: true
  section: Collect
- name: feedExpirationPolicy
  display: ''
  type: 17
  required: false
  defaultvalue: indicatorType
  additionalinfo: The policy applied when a fetched indicator expires.
  advanced: true
  section: Collect
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
script:
  commands: []
  dockerimage: demisto/python3:3.12.14.13053055
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)