category: Data Enrichment & Threat Intelligence
provider: ReliaQuest
commonfields:
  id: ReliaQuest GreyMatter DRP Incidents
  version: -1
description: ReliaQuest GreyMatter DR monitors and manages an organization's digital risk across the widest range of data sources within the open, deep, and dark web.
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: Enter the Digital Shadows SearchLight API URL
  defaultvalue: https://api.searchlight.app
  display: DS SearchLight API URL
  name: searchLightUrl
  required: true
  type: 0
  section: Connect
- additionalinfo: Account ID associated with this account.
  name: accountId
  display: Account ID
  required: true
  type: 0
  section: Connect
- additionalinfo: Enter the API Key for this account.
  hiddenusername: true
  displaypassword: API Key
  name: apiKey
  required: true
  type: 9
  section: Connect
- additionalinfo: Enter the API Secret for this account.
  hiddenusername: true
  displaypassword: API Secret
  name: apiSecret
  required: true
  type: 9
  section: Connect
- additionalinfo: Verify certificate
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- additionalinfo: First fetch
  defaultvalue: 2 years
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 2 months, 1 years or datetime in "%Y-%m-%d %H:%M:%S" format)
  name: first_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: Remove all if you don't want to select  all risk types, and then select specifically
  defaultvalue: all
  display: Risk Types
  name: riskTypes
  options:
  - association-with-malware
  - custom-risk
  - evidence-of-adversary-impact
  - evidence-of-credential-access
  - evidence-of-initial-access
  - evidence-of-reconnaissance
  - evidence-of-resource-development
  - expired-certificate
  - exposed-access-key
  - exposed-cloud-service
  - exposed-commercial-document
  - exposed-credential
  - exposed-customer-account
  - exposed-device
  - exposed-employee-pii
  - exposed-payment-card
  - exposed-technical-document
  - impersonating-company-profile
  - impersonating-domain
  - impersonating-employee-profile
  - impersonating-mobile-app
  - impersonating-subdomain
  - leaked-sensitive-code
  - leaked-sensitive-technology
  - marked-document
  - mention-by-a-threat-actor
  - misconfigured-web-server
  - exposed-port
  - phishing-report
  - phishing-webpage
  - report-of-botnet-activity
  - report-of-technical-vulnerability
  - reported-data-breach
  - revoked-certificate
  - selling-unauthorized-goods
  - unauthorized-code-commit
  - vulnerable-product
  - vulnerable-service
  - weak-certificate
  - all
  required: true
  type: 16
  section: Collect
- additionalinfo: Remove all if you don't want to select  all risk types, and then select specifically
  defaultvalue: all
  display: Risk Level
  name: riskLevel
  options:
  - all
  - none
  - low
  - medium
  - high
  - very-low
  - very-high
  required: false
  type: 16
  section: Collect
- additionalinfo: If you don't want to ingest rejected/resolved/closed incidents then set it to False. Otherwise incidents will ingested with auto-closed=True
  defaultvalue: "true"
  display: Ingest Closed / Auto-rejected Alerts
  name: ingestClosedIncidents
  required: false
  type: 8
  section: Collect
- additionalinfo: The maximum number of incidents to fetch
  defaultvalue: "50"
  display: Fetch Limit
  name: max_fetch
  required: true
  type: 0
  section: Collect
- additionalinfo: This controls how often the integration will perform a fetch_incidents command
  display: Incidents Fetch Interval
  defaultvalue: "1"
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
display: ReliaQuest GreyMatter DRP Incidents
name: ReliaQuest GreyMatter DRP Incidents
script:
  commands:
  - arguments:
    - name: query
      required: true
      description: Query string to search.
    description: Perform a general search against incidents, threats closed sources, etc.
    name: ds-search
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
supportlevelheader: xsoar
defaultmapperin: Reliaquest GreyMatter DRP Incidents Mapper
defaultclassifier: Reliaquest GreyMatter DRP Incidents Classifier
tests:
- No tests (auto formatted)