name: DeCYFIR Feed description: DeCYFIR API's provides External Threat Landscape Management insights. display: DeCYFIR Indicators & Threat Intelligence Feed category: Data Enrichment & Threat Intelligence provider: CYFIRMA sectionorder: - Connect - Collect commonfields: id: DeCYFIR Feed version: -1 configuration: - defaultvalue: https://decyfir.cyfirma.com display: DeCYFIR Server URL (e.g. https://decyfir.cyfirma.com) name: url required: true type: 0 section: Connect - displaypassword: DeCYFIR API Key name: api_key type: 9 required: true hiddenusername: true display: '' section: Connect - display: Trust any certificate (not secure) name: insecure required: false type: 8 section: Connect advanced: true - display: Use system proxy settings name: proxy required: false type: 8 section: Connect advanced: true - defaultvalue: 'true' display: Fetch indicators name: feed required: false type: 8 section: Collect - additionalinfo: Indicators from this integration instance will be marked with this reputation. defaultvalue: feedInstanceReputationNotSet display: Indicator Reputation name: feedReputation options: - None - Good - Suspicious - Bad required: false type: 18 section: Collect - name: feedReliability additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: F - Reliability cannot be judged display: Source Reliability options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - display: '' type: 17 options: - never - interval - indicatorType - suddenDeath name: feedExpirationPolicy section: Collect - display: '' type: 1 name: feedExpirationInterval section: Collect - defaultvalue: '240' display: Feed Fetch Interval name: feedFetchInterval required: false type: 19 section: Collect - additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. defaultvalue: 'true' display: Bypass exclusion list name: feedBypassExclusionList required: false type: 8 section: Collect - additionalinfo: Supports CSV values. display: Tags name: feedTags required: false type: 0 section: Collect - additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed display: Traffic Light Protocol Color name: tlp_color options: - RED - AMBER - GREEN - WHITE required: false type: 15 section: Collect script: commands: - deprecated: true execution: true name: decyfir-get-indicators description: Deprecated. Use the decyfir-ip-get, decyfir-domain-get, decyfir-url-get, or decyfir-file-get commands instead. - deprecated: false description: Get IP indicators from CYFIRMA. execution: false name: decyfir-ip-get outputs: - contextPath: DeCYFIR.IP.Value description: Indicator value. type: String - contextPath: DeCYFIR.IP.Type description: Indicator type. type: String - contextPath: DeCYFIR.IP.Description description: Indicator description. type: String - contextPath: DeCYFIR.IP.Country description: Country associated with the indicator. type: String - contextPath: DeCYFIR.IP.ThreatActor description: Threat actors associated with the indicator. type: String - contextPath: DeCYFIR.IP.Action description: Recommended remediation actions. type: String - contextPath: DeCYFIR.IP.Role description: Indicator role or classification. type: String - contextPath: DeCYFIR.IP.Confidence description: Confidence score. type: Number - contextPath: DeCYFIR.IP.RiskScore description: Exposure risk score. type: Number - contextPath: DeCYFIR.IP.Vendors description: List of Vendors associated with the indicator. type: Unknown - contextPath: DeCYFIR.IP.RawJSON description: Raw indicator JSON data. type: Unknown - deprecated: false description: Get Domain indicators from CYFIRMA. execution: false name: decyfir-domain-get outputs: - contextPath: DeCYFIR.Domain.Value description: Indicator value. type: String - contextPath: DeCYFIR.Domain.Type description: Indicator type. type: String - contextPath: DeCYFIR.Domain.Description description: Indicator description. type: String - contextPath: DeCYFIR.Domain.Country description: Country associated with the indicator. type: String - contextPath: DeCYFIR.Domain.ThreatActor description: Threat actors associated with the indicator. type: String - contextPath: DeCYFIR.Domain.Action description: Recommended remediation actions. type: String - contextPath: DeCYFIR.Domain.Role description: Indicator role or classification. type: String - contextPath: DeCYFIR.Domain.Confidence description: Confidence score. type: Number - contextPath: DeCYFIR.Domain.RiskScore description: Exposure risk score. type: Number - contextPath: DeCYFIR.Domain.Vendors description: List of Vendors associated with the indicator. type: Unknown - contextPath: DeCYFIR.Domain.RawJSON description: Raw indicator JSON data. type: Unknown - deprecated: false description: Get URL indicators from CYFIRMA. execution: false name: decyfir-url-get outputs: - contextPath: DeCYFIR.URL.Value description: Indicator value. type: String - contextPath: DeCYFIR.URL.Type description: Indicator type. type: String - contextPath: DeCYFIR.URL.Description description: Indicator description. type: String - contextPath: DeCYFIR.URL.Country description: Country associated with the indicator. type: String - contextPath: DeCYFIR.URL.ThreatActor description: Threat actors associated with the indicator. type: String - contextPath: DeCYFIR.URL.Action description: Recommended remediation actions. type: String - contextPath: DeCYFIR.URL.Role description: Indicator role or classification. type: String - contextPath: DeCYFIR.URL.Confidence description: Confidence score. type: Number - contextPath: DeCYFIR.URL.RiskScore description: Exposure risk score. type: Number - contextPath: DeCYFIR.URL.Vendors description: List of Vendors associated with the indicator. type: Unknown - contextPath: DeCYFIR.URL.RawJSON description: Raw indicator JSON data. type: Unknown - deprecated: false description: Get File Hash indicators from CYFIRMA. execution: false name: decyfir-file-get outputs: - contextPath: DeCYFIR.File.Value description: Indicator value. type: String - contextPath: DeCYFIR.File.Type description: Indicator type. type: String - contextPath: DeCYFIR.File.Description description: Indicator description. type: String - contextPath: DeCYFIR.File.Country description: Country associated with the indicator. type: String - contextPath: DeCYFIR.File.ThreatActor description: Threat actors associated with the indicator. type: String - contextPath: DeCYFIR.File.Action description: Recommended remediation actions. type: String - contextPath: DeCYFIR.File.Role description: Indicator role or classification. type: String - contextPath: DeCYFIR.File.Confidence description: Confidence score. type: Number - contextPath: DeCYFIR.File.RiskScore description: Exposure risk score. type: Number - contextPath: DeCYFIR.File.Vendors description: List of Vendors associated with the indicator. type: Unknown - contextPath: DeCYFIR.File.RawJSON description: Raw indicator JSON data. type: Unknown dockerimage: demisto/python3:3.12.13.10116658 feed: true isfetch: false longRunning: false longRunningPort: false runonce: false script: '-' subtype: python3 type: python fromversion: 6.9.0 tests: - No tests (auto formatted)