category: Data Enrichment & Threat Intelligence provider: Palo Alto Networks commonfields: id: Unit 42 Feed version: -1 sectionorder: - Connect - Collect configuration: - display: Fetch indicators additionalinfo: Select this check box to fetch indicators (default selected). name: feed type: 8 defaultvalue: 'true' section: Collect - display: Feed Types additionalinfo: Choose the requested indicator feeds. Indicators feed and Threat Objects (actors, malware, campaigns, techniques, etc.) feed (default is both). name: feed_types type: 16 options: - "Indicators" - "Threat Objects" required: false defaultvalue: Indicators,Threat Objects section: Collect advanced: true - display: Indicator Types additionalinfo: Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched. name: indicator_types type: 16 options: - File - IP - URL - Domain defaultvalue: File,IP,URL,Domain required: false section: Collect advanced: true - display: Maximum Indicators Per Fetch name: limit type: 0 defaultvalue: '100000' additionalinfo: |- Maximum number of indicators to fetch per type. Example: limit=20,000 with 4 types selected = 80,000 total indicators. The total (limit × number of types) is automatically capped at 100,000. If limit × types > 100,000, the limit per type is adjusted. Example: limit=30,000 with 4 types selected = 120,000 total indicators adjusted to 25,000 per type (100,000 / 4 = 25,000). Fetch priority order: 1. Threat Objects 2. IPs 3. Domains 4. URLs 5. Files Default (total for all types): 100,000. Maximum (total for all types): 100,000. required: false section: Collect advanced: true - display: Feed Fetch Interval additionalinfo: Don't set the feed fetch interval to less than 12 hours. name: feedFetchInterval type: 19 defaultvalue: '720' required: false section: Collect advanced: true hidden: true - display: Indicator Reputation additionalinfo: Indicators from this integration instance will be marked with this reputation. name: feedReputation type: 18 options: - None - Good - Suspicious - Bad defaultvalue: None required: false section: Collect advanced: true - display: Source Reliability additionalinfo: Reliability of the source providing the intelligence context. name: feedReliability type: 15 options: - A++ - Reputation script - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged defaultvalue: A++ - Reputation script required: false section: Collect advanced: true - display: Tags name: feedTags additionalinfo: Supports CSV values. type: 0 required: false section: Collect advanced: true - display: Traffic Light Protocol Color (TLP). name: tlp_color additionalinfo: The Traffic Light Protocol (TLP) designation applied to indicators fetched from the feed. type: 15 options: - RED - AMBER - GREEN - WHITE defaultvalue: AMBER required: false section: Collect advanced: true - display: '' name: feedExpirationPolicy additionalinfo: The feed's expiration policy. type: 17 options: - Indicator Type - Time Interval - Never Expired defaultvalue: Indicator Type required: false section: Collect advanced: true - display: Indicator Expiration Interval additionalinfo: The indicator's expiration policy. name: feedExpirationInterval defaultvalue: "20160" type: 1 required: false section: Collect advanced: true - display: Create relationships additionalinfo: Create relationships with other indicators. name: create_relationships type: 8 defaultvalue: 'true' required: false section: Collect advanced: true - display: Incremental feed additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. If the indicator is new or modified on the 3rd-party vendor's side, only indicators that are new or modified are sent to Cortex. Therefore, all indicators coming from these feeds are labeled new or modified. name: feedIncremental defaultvalue: 'true' hidden: true required: false type: 8 section: Collect advanced: true - display: Bypass exclusion list name: feedBypassExclusionList additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. defaultvalue: 'false' type: 8 required: false section: Collect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true description: Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team. display: Unit 42 Feed name: Unit 42 Feed script: commands: - arguments: - name: indicator_types description: Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched. auto: PREDEFINED predefined: - File - IP - URL - Domain defaultValue: 'File,IP,URL,Domain' required: false - defaultValue: '10' description: The maximum number of indicators to return. The default is 10. The maximum is 5000. name: limit description: Gets indicators from the feed. name: unit42-get-indicators - arguments: - defaultValue: '10' description: The maximum number of threat objects to return. The default is 10. The maximum is 5000. name: limit description: Gets threat objects from the feed. name: unit42-get-threat-objects dockerimage: demisto/python3:3.12.13.10404775 feed: true runonce: false script: '-' type: python subtype: python3 fromversion: 6.10.0 supportedModules: - agentix - xsiam tests: - No tests (auto formatted)