commonfields:
  id: Threatmon
  version: -1
name: Threatmon
display: Threatmon
sectionorder:
- Connect
- Collect
category: Data Enrichment & Threat Intelligence
description: Integration with Threatmon for vulnerability threat intelligence.
provider: ThreatMon
configuration:
- display: API URL
  name: url
  type: 0
  required: true
  section: Connect
  defaultvalue: https://external.threatmonit.io/api/threatmon/external/v1
- displaypassword: API Key
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Last Incident ID (for initial fetch)
  name: lastIncidentId
  type: 0
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
- display: Incident type
  name: incidentType
  type: 13
  required: false
  supportedModules:
  - xsiam
  - agentix
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  supportedModules:
  - xsiam
  - agentix
  section: Collect
- display: Fetch Interval (minutes)
  name: fetchInterval
  defaultvalue: "5"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
  supportedModules:
  - xsiam
  - agentix
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: threatmon_update_incident_status
    arguments:
    - name: alarmId
      required: true
      description: Threatmon Incident Code (ID).
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - Open
      - In Progress
      - False Positive
      - Ignore
      - Resolved
      description: 'Incident Status.'
    description: Update Incident Status endpoint allows you to change/update status. of specified Threatmon incidents.
  - name: threatmon_request_takedown
    arguments:
    - name: findingId
      required: true
      description: The ID of the finding (alarm row) to submit a takedown request for.
    - name: finding
      required: true
      description: Description of the finding that justifies the takedown request.
    description: Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.
  - name: threatmon_request_data_removal
    arguments:
    - name: findingId
      description: The ID of the finding (alarm row) to submit a data removal request for.
      required: true
    - name: finding
      description: The URL or content identifier of the finding to be removed from Black Market Monitoring results.
      required: true
    description: Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits. Returns 403 if the quota is exceeded or rights are insufficient.
  - name: threatmon_list_cves
    arguments:
    - name: page
      description: Page number to retrieve (0-based). Each page contains up to 100 CVEs, sorted by last update time (descending).
      defaultValue: "0"
    - name: cvss
      description: Filter CVEs by CVSS v3 severity.
      auto: PREDEFINED
      predefined:
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    outputs:
    - contextPath: ThreatMon.CVE.cve
      description: CVE identifier.
      type: String
    - contextPath: ThreatMon.CVE.summary
      description: CVE summary.
      type: String
    - contextPath: ThreatMon.CVE.cvssV2
      description: CVSS v2 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV2
      description: CVSS v2 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3
      description: CVSS v3 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3_1
      description: CVSS v3.1 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3_1
      description: CVSS v3.1 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV4
      description: CVSS v4 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV4
      description: CVSS v4 severity level.
      type: String
    - contextPath: ThreatMon.CVE.vendors
      description: Map of vendor names to affected product names.
      type: Unknown
    - contextPath: ThreatMon.CVE.exploit
      description: Whether a known exploit exists for this CVE.
      type: Boolean
    - contextPath: ThreatMon.CVE.knownRansomwareCampaignUse
      description: Known ransomware campaign associated with this CVE, if any.
      type: String
    - contextPath: ThreatMon.CVE.zeroday
      description: Whether this CVE was disclosed as a zero-day.
      type: Boolean
    - contextPath: ThreatMon.CVE.createdAt
      description: Date the CVE record was created in ThreatMon.
      type: Date
    - contextPath: ThreatMon.CVE.updatedAt
      description: Date the CVE record was last updated in ThreatMon.
      type: Date
    description: Retrieves a paginated list of all CVEs monitored by ThreatMon.
  - name: threatmon_list_subscribed_cves
    arguments:
    - name: page
      description: Page number to retrieve (0-based). Each page contains up to 100 CVEs, sorted by last update time (descending).
      defaultValue: "0"
    - name: cvss
      description: Filter CVEs by CVSS v3 severity.
      auto: PREDEFINED
      predefined:
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    - name: customer_name
      description: For MSSP accounts, retrieves subscribed CVEs on behalf of the specified child customer instead of the authenticated company.
    outputs:
    - contextPath: ThreatMon.CVE.cve
      description: CVE identifier.
      type: String
    - contextPath: ThreatMon.CVE.summary
      description: CVE summary.
      type: String
    - contextPath: ThreatMon.CVE.cvssV2
      description: CVSS v2 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV2
      description: CVSS v2 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3
      description: CVSS v3 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV3_1
      description: CVSS v3.1 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV3_1
      description: CVSS v3.1 severity level.
      type: String
    - contextPath: ThreatMon.CVE.cvssV4
      description: CVSS v4 score.
      type: Number
    - contextPath: ThreatMon.CVE.severityV4
      description: CVSS v4 severity level.
      type: String
    - contextPath: ThreatMon.CVE.vendors
      description: Map of vendor names to affected product names.
      type: Unknown
    - contextPath: ThreatMon.CVE.exploit
      description: Whether a known exploit exists for this CVE.
      type: Boolean
    - contextPath: ThreatMon.CVE.knownRansomwareCampaignUse
      description: Known ransomware campaign associated with this CVE, if any.
      type: String
    - contextPath: ThreatMon.CVE.zeroday
      description: Whether this CVE was disclosed as a zero-day.
      type: Boolean
    - contextPath: ThreatMon.CVE.createdAt
      description: Date the CVE record was created in ThreatMon.
      type: Date
    - contextPath: ThreatMon.CVE.updatedAt
      description: Date the CVE record was last updated in ThreatMon.
      type: Date
    description: Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.
  isfetch: true
  dockerimage: demisto/python3:3.12.13.10404775
fromversion: 5.0.0
tests:
- No tests