commonfields:
  id: NTT Cyber Threat Sensor
  version: -1
name: NTT Cyber Threat Sensor
display: NTT Cyber Threat Sensor
category: Network Security
sectionorder:
- Connect
- Collect
provider: NTT Group
description: Retrieve alerts and recommendations from NTT CTS.
configuration:
- display: 'The API key for accessing CTS over AWS '
  name: APIKEY
  defaultvalue: ''
  type: 4
  required: true
  section: Connect
- display: Tenant identification. UUID formatted string
  name: TENANT_ID
  defaultvalue: <TENANT_ID>
  type: 0
  required: true
  section: Connect
- display: Days to fetch for the first time this application runs
  name: DAYS_BACK
  defaultvalue: 3
  type: 0
  required: true
  section: Collect
- display: Number of items to fetch each iteration (1 to 100)
  name: ITEMS_TO_FETCH
  defaultvalue: 20
  type: 0
  required: true
  section: Collect
- display: The unique key for accessing the alerts and active response recommendations
  name: SOARTOKEN
  defaultvalue: ''
  type: 4
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: The base URL for the backend to consume from
  name: BASEURL
  defaultvalue: https://cts.eu1.nttsecurity.io/v1
  type: 0
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
script:
  script: '-'
  type: python
  commands:
  - name: ntt-cyber-threat-sensor-poll-blobs
    arguments:
    - name: event_id
      required: true
      isArray: true
      description: ID of the incident from whom to fetch blobs for.
    - name: timestamp
      description: ISO timestamp for when alert was triggered.
      isArray: true
      required: true
    outputs:
    - contextPath: CTS.FetchBlob
      description: True if there are blobs to fetch.
      type: boolean
    - contextPath: CTS.Blob.ID
      description: ID of the incident.
      type: string
    - contextPath: CTS.Blob.Status
      description: Hold to wait and release to run.
      type: string
    description: Check if blobs is available
    execution: true
  - name: ntt-cyber-threat-sensor-fetch-blobs
    arguments:
    - name: event_id
      required: true
      description: ID of the incident from whom to fetch blobs for.
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Name
      description: The name of the file.
      type: string
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: string
    - contextPath: File.Info
      description: File information.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.Extension
      description: The file extension.
      type: string
    - contextPath: CTS.HasBlob
      description: If one or more blobs exist then True.
      type: boolean
    description: Collecting blobs, most commonly pcap from an incident
    execution: true
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)
defaultclassifier: NTT Cyber Threat Sensor - Classifier
defaultmapperin: NTT Cyber Threat Sensor - mapper