name: decyfir
description: DeCYFIR API's provides External Threat Landscape Management insights.
display: DeCYFIR
category: Data Enrichment & Threat Intelligence
provider: CYFIRMA
sectionorder:
- Connect
- Collect
commonfields:
  id: decyfir
  version: -1
configuration:
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: https://decyfir.cyfirma.com
  display: DeCYFIR Server URL (e.g. https://decyfir.cyfirma.com)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: DeCYFIR API Key
  name: api_key
  type: 9
  required: true
  hiddenusername: true
  display: ''
  section: Connect
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- defaultvalue: 30 days
  display: How much time before the first fetch to retrieve incidents
  name: first_fetch
  options:
  - 10 days
  - 15 days
  - 30 days
  - 60 days
  - 90 days
  required: false
  type: 15
  hidden: false
  section: Collect
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  required: false
  type: 0
  additionalinfo: The maximum number of incidents to fetch per sub-category.
  hidden: false
  section: Collect
script:
  commands:
  - deprecated: false
    description: Initiate a take down request.
    execution: false
    name: decyfir-takedown-initiate
    arguments:
    - name: alert_id
      required: true
      description: The ID of the alert for which to initiate the take down request.
    outputs:
  - deprecated: false
    description: Get take down list.
    execution: false
    name: decyfir-takedown-list
    arguments:
    - name: sub_category
      required: false
      description: The sub-category for which to retrieve the take down list. If not provided, the take down list for all sub-categories will be retrieved.
    - name: size
      required: false
      defaultValue: '100'
      description: The number of records to retrieve. If not provided, the default value is 100.
    - name: page
      required: false
      defaultValue: '0'
      description: The page number to retrieve. If not provided, the default value is 0.
    outputs:
    - contextPath: DeCYFIR.Takedown.Category
      description: Takedown category.
      type: String

    - contextPath: DeCYFIR.Takedown.SubCategory
      description: Takedown sub-category.
      type: String

    - contextPath: DeCYFIR.Takedown.Domain
      description: Associated domain.
      type: String

    - contextPath: DeCYFIR.Takedown.Status
      description: Current takedown request status.
      type: String

    - contextPath: DeCYFIR.Takedown.TicketName
      description: Takedown ticket identifier.
      type: String

    - contextPath: DeCYFIR.Takedown.TicketDetails
      description: Takedown request details.
      type: String

    - contextPath: DeCYFIR.Takedown.CreatedBy
      description: User who created the request.
      type: String

    - contextPath: DeCYFIR.Takedown.CreatedDate
      description: Request creation date.
      type: Date

    - contextPath: DeCYFIR.Takedown.ModifiedBy
      description: User who last modified the request.
      type: String

    - contextPath: DeCYFIR.Takedown.ModifiedDate
      description: Last modification date.
      type: Date

    - contextPath: DeCYFIR.Takedown.OnHoldByClient
      description: Whether the request is on hold by the client.
      type: Boolean

    - contextPath: DeCYFIR.Takedown.OnHoldByExternal
      description: Whether the request is on hold externally.
      type: Boolean

    - contextPath: DeCYFIR.Takedown.URLStatus
      description: URL takedown status.
      type: String

    - contextPath: DeCYFIR.Takedown.URLStatusUpdatedBy
      description: User who updated the URL status.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.5.0
tests:
- No tests (auto formatted)