Publisher: Cofense
Connector Version: 1.0.4
Product Vendor: Cofense
Product Name: Triage v2
Product Version Supported (regex): ".*"
Minimum Product Version: 4.9.39220
This app supports actions for Cofense Triage's version 2 API for faster bidirectional phishing analysis and response
The asset configuration parameters affect [test connectivity] and some other actions of the application. Below are the explanation and usage of all these parameters. The parameters related to test connectivity action are Server URL, Verify server certificate, Client ID, and Client Secret.
- Server URL: The URL used to connect with the Cofense Triage server. Example: https://platform.cofensetriage.com
- Verify server certificate: Validate server certificate.
- Client ID: Client ID.
- Client Secret: Client Secret.
- Data to be ingested: The type of data that is to be ingested. The following are the valid
values:
- reports
- threat_indicators
- Threat indicator type: The type of threat indicators to retrieve. The default value is "All"
which retrieves all types of threat indicators. The following are the valid values that the
parameter can take:
- All
- Header
- Hostname
- URL
- MD5
- SHA256
- Threat indicator level: The level of the threat indicators to retrieve. The default value is
"All" which retrieves all levels of threat indicators. The following are the valid values that
the parameter can take:
- All
- Malicious
- Suspicious
- Benign
- Report location: The location of the reports to retrieve. The default value is "All" which
retrieves reports from all the locations. The following are the valid values that the parameter
can take:
- All
- Inbox
- Reconnaissance
- Processed
- Match priority: The highest priority of a rule matching the reported email.
- Category ID: The category ID of the report.
- Tags: This parameter allows filtering the reports based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes, for example: tag1,"test,tag",tag2. If a comma-separated list is provided, reports matching any of the tags from the provided list will be retrieved.
- Categorization tags: This parameter allows filtering the reports based on the list of comma-separated categorization tags. If a comma-separated list is provided, reports matching any of the tags from the provided list will be retrieved.
- Ingest subfields: Whether or not to ingest the subfields of the selected data. If this parameter is set to true, the data and all the resources related to the data that are present in the relationships will be ingested.
- Category ID to severity mapping: The mapping in JSON format between the category ID of the report and the Phantom container severity. If no value is provided, then the default mapping will be used and, if the category ID isn't present in the default mapping the severity will be set to "Low". If a value is provided, the combination of the provided value and the default mapping will be used to decide the severity. The default mapping is: {"High": ["4"], "Medium": ["3"], "Low": ["1", "2", "5"]}. Example value for the parameter is: {"High": ["8", "9"], "Medium": ["7"], "Low": ["6"]}
- Cef mapping: This parameter is a JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value. For example, if the cef_mapping is {"website":"requestURL"} your artifact will have requestURL cef field in place of website cef field. This parameter will be taken into consideration only during ingestion.
- Start date: The initial start date and time of the ingestion. This parameter retrieves the data that was updated on or after the provided date. It will be taken into consideration during the poll now and the first run of scheduled/interval polling.
- Sort: This parameter allows sorting the data based on the 'updated_at' date. The default
value is "oldest_first" which sorts the results in the oldest first order. The following are the
valid values that the parameter can take:
- oldest_first
- latest_first
- Update state after: This parameter saves the context after ingestion of every provided number of containers. This parameter is only used for scheduled/interval polling and only if the sort parameter value is "oldest_first".
- Max results: Maximum number of results to ingest. If not provided all the data will be ingested.
-
- This action will test the connectivity of the Phantom server to the Cofense Triage instance by making an initial API call using the provided asset configuration parameters. This action can be used to generate a new token.
- The action validates the provided asset configuration parameters. Based on the API call response, the appropriate success and failure message will be displayed when the action gets executed.
-
-
Action Parameter: Location
- This parameter allows filtering the reports based on the location. The following are the
valid values that the parameter can take:
- All
- Inbox
- Reconnaissance
- Processed
- This parameter allows filtering the reports based on the location. The following are the
valid values that the parameter can take:
-
Action Parameter: From address
- This parameter allows filtering the reports based on the sender's email address of the reported email.
-
Action Parameter: Reporter's email
- This parameter allows filtering the reports based on the reporter's email address of the reported email.
-
Action Parameter: Subject
- This parameter allows filtering the reports with the subject containing a specific string. All the reports containing the provided value in the subject will be retrieved.
-
Action Parameter: Match priority
- This parameter allows filtering the reports based on the highest priority of a rule matching the reported email.
-
Action Parameter: Category ID
- This parameter allows filtering the reports based on the category ID of the report.
-
Action Parameter: Start date
- This parameter allows filtering the reports updated on or after the provided date.
-
Action Parameter: End date
- This parameter allows filtering the reports updated before the provided date.
-
Action Parameter: Tags
- This parameter allows filtering the reports based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes, for example: tag1,"test,tag",tag2. If a comma-separated list is provided, reports matching any of the tags from the provided list will be retrieved.
-
Action Parameter: Categorization tags
- This parameter allows filtering the reports based on the list of comma-separated categorization tags. If a comma-separated list is provided, reports matching any of the tags from the provided list will be retrieved.
-
Action Parameter: Sort
- This parameter allows sorting the reports based on the 'updated_at' date of the report.
By default, it will sort in the oldest first order. The following are the valid values
that the parameter can take:
- oldest_first
- latest_first
- This parameter allows sorting the reports based on the 'updated_at' date of the report.
By default, it will sort in the oldest first order. The following are the valid values
that the parameter can take:
-
Action Parameter: Ingest report
- This parameter allows the ingestion of the report into the container.
-
Action Parameter: Ingest subfields
- This parameter allows the ingestion of the fields relating to the report into the container. If this parameter is set to true, the report and all the resources related to the report that are present in the relationships together will get ingested into the container.
-
Action Parameter: Label
- This parameter allows the ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Tenant
- This parameter allows the creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Cef mapping
- This parameter is a JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value. For example, if the cef_mapping is {"website":"requestURL"} your artifact will have requestURL cef field in place of website cef field. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Max results
- Maximum number of results to return. If not provided all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- List all the reports present in Inbox containing “demo” word in the subject and having
match priority equals 5 and is sent by '[email protected]'.
- Location = Inbox
- Subject = Demo
- Match Priority = 5
- From Address = [email protected]
- List all the reports updated between 2020-09-23T08:31:58Z and 2020-09-29T09:00:00Z and
sort them in oldest_first order.
- Start date = 2020-09-23T08:31:58Z
- End date = 2020-09-29T09:00:00Z
- Sort = oldest_first
- List the reports in the latest_first order.
- Sort = latest_first
- List all the reports present in Inbox containing “demo” word in the subject and having
match priority equals 5 and is sent by '[email protected]'.
-
-
-
Action Parameter: Report ID
- The ID of the report to be retrieved.
-
Action Parameter: Ingest report
- This parameter allows the ingestion of the report into the container.
-
Action Parameter: Ingest subfields
- This parameter allows the ingestion of the fields relating to the report into the container. If this parameter is set to true, the report and all the resources related to the report that are present in the relationships together will get ingested into the container.
-
Action Parameter: Label
- This parameter allows the ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Tenant
- This parameter allows the creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Cef mapping
- This parameter is a JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value. For example, if the cef_mapping is {"website":"requestURL"} your artifact will have requestURL cef field in place of website cef field. This parameter will be taken into consideration only during ingestion.
-
Example:
- Fetch the report with ID equals 15.
- Report ID = 15
- Fetch the report with ID equals 15.
-
-
-
Action Parameter: Report ID
- This parameter is the ID of the report which the user wants to categorize.
-
Action Parameter: Category ID
- This parameter is the ID of the category into which the user wants to categorize the report. Category ID is either known by Cofense Triage users or it can be fetched from the output of Get categories action.
-
Action Parameter: Category Name
- This parameter is the name of the category into which the user wants to categorize the report. This parameter can be provided if the category ID is not known by Cofense Triage users.
-
Action Parameter: Response ID
- This parameter is the ID of the response.
-
Action Parameter: Categorization Tags
- This parameter allows the user to provide multiple tags to be given to the report while categorizing it. It accepts a comma-separated list of tags.
-
Note - If both category ID and category name are provided, then category ID will be given a higher priority.
-
Example:
- Categorize the report having Report ID 5, with given category ID 1, and add
categorization tag ‘test’.
- Report ID = 5
- Category ID = 1
- Categorization tags = test
- Categorize the report having Report ID 10, with given category ID 2 and add
categorization tag ‘test tag’, also send a response using response template ID 2.
- Report ID = 10
- Category ID = 2
- Categorization tags = test tag
- Response ID = 2
- Categorize the report having Report ID 5, with given category ID 1, and add
categorization tag ‘test’.
-
-
-
Action Parameter: VIP
- This parameter allows searching for the VIP reporters. If the value of the parameter is false, then all the reporters will be retrieved.
-
Action Parameter: Reputation score
- This parameter allows searching for reporters having the provided reputation score. It allows a comma-separated list. If a comma-separated list is provided, then the reporters with any of the specified scores will be retrieved.
-
Action Parameter: Email
- This parameter allows searching for the reporter with a specific email.
-
Action Parameter: Sort
- This parameter allows sorting the reporters based on the ID. By default, it will sort in
the oldest first order. The following are the valid values that the parameter can
take:
- oldest_first
- latest_first
- This parameter allows sorting the reporters based on the ID. By default, it will sort in
the oldest first order. The following are the valid values that the parameter can
take:
-
Action Parameter: Max results
- Maximum number of results to return. If not provided, all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- List the latest 15 VIP reporters with a reputation score equals 15.
- VIP = true
- Reputation Score = 15
- Max results = 15
- Sort = latest_first
- Fetch the reporter with the email address [email protected].
- Email = [email protected]
- List the latest 15 VIP reporters with a reputation score equals 15.
-
-
-
Action Parameter: Reporter ID
- This parameter is the ID of the reporter to fetch.
-
Example:
- Fetch the reporter with the Reporter ID equals 10.
- Report ID = 10
- Fetch the reporter with the Reporter ID equals 10.
-
-
-
Action Parameter: Risk score
- This parameter is the risk score of the URL.
-
Action Parameter: Risk score operator
- This parameter is the operator to work with the risk score parameter. The default value
is 'eq'.For example: if the risk score = 5 and the risk score operator = 'lt', then all
the URLs having a risk score less than 5 will be retrieved. The following are the valid
values that the parameter can take:
- eq
- not_eq
- lt
- lteq
- gt
- gteq
- This parameter is the operator to work with the risk score parameter. The default value
is 'eq'.For example: if the risk score = 5 and the risk score operator = 'lt', then all
the URLs having a risk score less than 5 will be retrieved. The following are the valid
values that the parameter can take:
-
Action Parameter: URL Value
- This parameter is the value of the URL to search for.
-
Action Parameter: Start date
- This parameter allows filtering the URLs updated on or after the provided date.
-
Action Parameter: End date
- This parameter allows filtering the URLs updated before the provided date.
-
Action Parameter: Sort
- This parameter allows sorting the URLs based on the 'updated_at' date of the URL. By
default, it will sort in the oldest first order. The following are the valid values that
the parameter can take:
- oldest_first
- latest_first
- This parameter allows sorting the URLs based on the 'updated_at' date of the URL. By
default, it will sort in the oldest first order. The following are the valid values that
the parameter can take:
-
Action Parameter: Max results
- Maximum number of results to return. If not provided, all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- List all the URLs having a risk score equals 5 in the latest first order.
- Risk score ID = 5
- Risk score operator = eq
- Sort = latest_first
- List the URL having value equals 'https://testurl.com'.
- URL value = https://testurl.com
- List oldest 5 URLs that are updated between 2020-09-23T08:31:58Z and
2020-09-29T09:00:00Z.
- Start date = 2020-09-23T08:31:58Z
- End date = 2020-09-29T09:00:00Z
- Sort = oldest_first
- Max results = 5
- List all the URLs having a risk score equals 5 in the latest first order.
-
-
-
Action Parameter: URL ID
- This parameter is the ID of the URL to fetch.
-
Example:
- Fetch the URL with URL ID equals 5.
- URL ID = 5
- Fetch the URL with URL ID equals 5.
-
-
-
Action Parameter: Name
- This parameter specifies a short display name of the response sent to individuals when a report is categorized.
-
Action Parameter: Description
- This parameter specifies the expanded name or description of the response.
-
Action Parameter: Subject
- This parameter specifies the subject of the response. It supports template variables.
-
Action Parameter: Body
- This parameter specifies the body of the email. It supports template variables.
-
Action Parameter: To reporter
- This parameter specifies whether to add the reporter to the response recipient list (true) or not (false). The default is true. Either 'to_reporter' or 'to_other', or both, must be enabled.
-
Action Parameter: To other
- This parameter specifies whether to add the addresses specified in 'to_other_address' to the response recipient list (true) or not (false). The default is false. If true, specify one or more values in 'to_other_address'. Either to_reporter or 'to_other', or both, must be enabled.
-
Action Parameter: To other address
- This parameter is a comma-separated list of email addresses to send the response to. Works with 'to_other'.
-
Action Parameter: Attach original
- This parameter specifies whether to attach the original email to the response (true) or not (false).
-
Action Parameter: CC address
- This parameter is a comma-separated list of email addresses to CC the response to.
-
Action Parameter: BCC address
- This parameter is a comma-separated list of email addresses to BCC the response to.
-
Template variables: The user can insert variables into the subject and body of the response while creating it. When the response is sent as a result of categorizing a report, Cofense Triage replaces the variables with information from that report. The following are the template variables
- [SUBJECT]: Replaced with the subject of the reported email.
- [REPORT_DATE]: Replaced with the date the email was reported.
-
Example:
- Create a response with name: "Example Response", Description: "This is an example
response", Subject: "Email '[SUBJECT]' reported [REPORT_DATE] is SAFE", and Body =
"The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe".
- Name = Example Response
- Description = This is an example response
- Subject = Email '[SUBJECT]' reported [REPORT_DATE] is SAFE
- Body = The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe
- Create a response with name: "Example Response", Subject: "Email '[SUBJECT]' reported
[REPORT_DATE] is SAFE", and Body = "The email '[SUBJECT]' that you reported on
[REPORT_DATE] is safe". The response should be sent to the reporter and not others.
- Name = Example Response
- To reporter = true
- To other = false
- Subject = Email '[SUBJECT]' reported [REPORT_DATE] is SAFE
- Body = The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe
- Create a response with name: "Example Response", Description: "This is an example
response", Subject: "Email '[SUBJECT]' reported [REPORT_DATE] is SAFE", and Body =
"The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe".
Note: This action is supported for Cofense Triage with version older than 1.23.
-
-
-
Action Parameter: Max results
- This parameter allows the user to limit the number of results. It expects a numeric value as an input.
-
Example:
- List 50 responses.
- Max results = 50
- List 50 responses.
Note: This action is supported for Cofense Triage with version older than 1.23.
-
-
-
Action Parameter: Level
- This parameter is the level of threat indicator. The following are the valid values that
the parameter can take:
- Malicious
- Suspicious
- Benign
- This parameter is the level of threat indicator. The following are the valid values that
the parameter can take:
-
Action Parameter: Type
- This parameter is the type of threat indicator. The following are the valid values that
the parameter can take:
- Header
- Hostname
- URL
- MD5
- SHA256
- This parameter is the type of threat indicator. The following are the valid values that
the parameter can take:
-
Action Parameter: Value
- This parameter is the value of the threat indicator. If the value of the parameter 'type' is 'Header', then the value of this parameter should be in the form {header_key}:{header_value}.
-
Action Parameter: Source
- This parameter is the source of the threat indicator. The default value of this parameter is "Splunk_Phantom-UI"
-
Example:
- Create a malicious threat indicator with type: URL and value: 'https://testurl.com'.
- Level = Malicious
- Type = URL
- Value = 'https://testurl.com'
- Create a Suspicious threat indicator, source: 'Splunk_Phantom-UI', type: Header and
value: 'From:[email protected]'
- Level = Suspicious
- Type = Header
- Value = From:[email protected]
- Source = Splunk_Phantom-UI
- Create a malicious threat indicator with type: URL and value: 'https://testurl.com'.
-
-
-
Action Parameter: Name
- This parameter allows the user to fetch the categories with the name containing a specific string.
-
Action Parameter: Malicious
- This parameter allows the user to fetch the categories based on whether the category is used to classify malicious reports or not. If the value is false, then all the categories will be fetched.
-
Action Parameter: Max results
- Maximum number of results to return. If not provided, all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- List the categories containing ‘threat’ in the name and are malicious.
- Name = Threat
- Malicious = true
- List 50 categories.
- Max results = 50
- List the categories containing ‘threat’ in the name and are malicious.
-
-
-
Action Parameter: Level
- This parameter allows filtering based on the level of threat indicator. The following
are the valid values that the parameter can take:
- All
- Malicious
- Suspicious
- Benign
- This parameter allows filtering based on the level of threat indicator. The following
are the valid values that the parameter can take:
-
Action Parameter: Type
- This parameter allows filtering based on the type of threat indicator. The following are
the valid values that the parameter can take:
- All
- Header
- Hostname
- URL
- MD5
- SHA256
- This parameter allows filtering based on the type of threat indicator. The following are
the valid values that the parameter can take:
-
Action Parameter: Source
- This parameter allows filtering based on the source of the threat. If not provided, threat indicators from all the sources will be fetched.
-
Action Parameter: Value
- This parameter allows filtering based on the actual value of the threat indicator.
-
Action Parameter: Start date
- This parameter allows the user to fetch the threat indicators updated on or after the provided date.
-
Action Parameter: End date
- This parameter allows the user to fetch the threat indicators updated before the provided date.
-
Action Parameter: Sort
- This parameter allows sorting the result data set based on the 'updated_at' date of the
threat indicator. By default, it will sort in the oldest first order. The following are
the valid values that the parameter can take:
- oldest_first
- latest_first
- This parameter allows sorting the result data set based on the 'updated_at' date of the
threat indicator. By default, it will sort in the oldest first order. The following are
the valid values that the parameter can take:
-
Action Parameter: Ingest threat indicator
- This parameter allows ingestion of the threat indicator(s) into the container(s).
-
Action Parameter: Ingest subfields
- This parameter allows the ingestion of the fields relating to the threat indicator into the container. If this parameter is set to true, the threat indicator and all the resources related to the threat indicator that are present in the relationships together will get ingested.
-
Action Parameter: Label
- This parameter allows the ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_threat_indicator' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Tenant
- This parameter allows the creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_threat_indicator' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Cef mapping
- This parameter is a JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value. For example, if the cef_mapping is {"website":"requestURL"} your artifact will have requestURL cef field in place of website cef field. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Max results
- Maximum number of results to return. If not provided all the data will be retrieved.
-
Note - If no value is provided in any parameter then all the records will be retrieved.
-
Example:
- List all the Malicious threat indicators that are URLs and are reported from the
Triage-UI source.
- Level = Malicious
- Type = URL
- Source = Triage-UI
- List all the threat indicators updated between 2020-09-23T08:31:58Z and
2020-09-29T09:00:00Z and sort them in oldest_first order.
- Start date = 2020-09-23T08:31:58Z
- End date = 2020-09-29T09:00:00Z
- Sort = oldest_first
- List 50 threat indicators in the latest first order.
- Max results = 50
- Sort = latest_first
- List all the Malicious threat indicators that are URLs and are reported from the
Triage-UI source.
-
-
-
Action Parameter: Report ID
- This parameter is the ID of the report.
-
Action Parameter: Download method
- This parameter allows the user to download the email as an artifact or as a vaulted file.
-
Action Parameter: Create vaulted file artifact
- If storing the file as a vaulted file, this parameter allows the user to create an artifact referencing that file.
-
Example:
- Download email for report ID equals 10.
- Report ID = 10
- Download method = vaulted file
- Download email for report ID equals 10.
-
-
-
Action Parameter: Body format
- This parameter allows filtering the comments based on the body format. The following are
the valid values that the parameter can take:
- all
- text
- json
- This parameter allows filtering the comments based on the body format. The following are
the valid values that the parameter can take:
-
Action Parameter: Tags
- This parameter allows filtering the comments based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes, for example: tag1,"test,tag",tag2. If a comma-separated list is provided, comments matching any of the tags from the provided list will be retrieved.
-
Action Parameter: Start date
- This parameter allows filtering the comments updated on or after the provided date.
-
Action Parameter: End date
- This parameter allows filtering the comments updated before the provided date.
-
Action Parameter: Sort
- This parameter allows sorting the comments based on the 'updated_at' date of the
comment. By default, it will sort in the oldest first order. The following are the valid
values that the parameter can take:
- oldest_first
- latest_first
- This parameter allows sorting the comments based on the 'updated_at' date of the
comment. By default, it will sort in the oldest first order. The following are the valid
values that the parameter can take:
-
Action Parameter: Max results
- Maximum number of results to return. If not provided, all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- List the latest 20 comments having 'text' body format with a tag 'test'.
- Body format = text
- Tags = test
- Sort = latest_first
- Max results = 20
- List all the comments updated between 2020-09-23T08:31:58Z and 2020-09-29T09:00:00Z and
sort them in oldest_first order.
- Start date = 2020-09-23T08:31:58Z
- End date = 2020-09-29T09:00:00Z
- Sort = oldest_first
- List the comments in the latest_first order.
- Sort = latest_first
- List the latest 20 comments having 'text' body format with a tag 'test'.
-
-
-
Action Parameter: Comment ID
- This parameter is the ID of the comment to fetch.
-
Example:
- Fetch the comment with comment ID equals 5.
- Comment ID = 5
- Fetch the comment with comment ID equals 5.
-
-
-
Action Parameter: Rule ID
- This parameter is the ID of the rule to fetch.
-
Action Parameter: Ingest report
- This parameter allows ingestion of reports related to the rule.
-
Action Parameter: Ingest subfields
- This parameter allows the ingestion of the fields relating to the report into the container. If this parameter is set to true, the report and all the resources related to the report that are present in the relationships together will get ingested into the container.
-
Action Parameter: Label
- This parameter allows the ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Tenant
- This parameter allows the creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set. This parameter will be taken into consideration only during ingestion.
-
Action Parameter: Cef mapping
- This parameter is a JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value. For example, if the cef_mapping is {"website":"requestURL"} your artifact will have requestURL cef field in place of website cef field. This parameter will be taken into consideration only during ingestion.
-
Example:
- Fetch the rule with rule ID equals 5 and ingest the reports related to the rule.
- Rule ID = 5
- Ingest reports = True
- Label = events
- Tenant = Default
- Fetch the rule with rule ID equals 5 and ingest the reports related to the rule.
-
-
-
Action Parameter: Name
- This parameter allows filtering the rules with rule name containing a specific string. All the rules containing the provided value in the name will be retrieved.
-
Action Parameter: Description
- This parameter allows filtering the rules with rule description containing a specific string. All the rules containing the provided value in the description will be retrieved.
-
Action Parameter: Priority
- This parameter allows filtering the rules based on the priority.
-
Action Parameter: Tags
- This parameter allows filtering the rules based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes, for example: tag1,"test,tag",tag2. If a comma-separated list is provided, rules matching any of the tags from the provided list will be retrieved.
-
Action Parameter: Scope
- This parameter allows filtering the rules based on the scope.
-
Action Parameter: Author name
- This parameter allows filtering the rules with author name containing a specific string. All the rules containing the provided value in the author's name will be retrieved.
-
Action Parameter: Rule context
- This parameter allows filtering the rules based on the context. The following are the
valid values that the parameter can take:
- All
- Internal safe
- Unwanted
- Threat hunting
- Phishing tactic
- Cleanup
- Unknown
- This parameter allows filtering the rules based on the context. The following are the
valid values that the parameter can take:
-
Action Parameter: Active
- This parameter allows filtering the rules based on the status. If the value of the parameter is false, then all the rules will be retrieved.
-
Action Parameter: Reports count
- This parameter allows filtering the rules based on the number of reports the rule matched.
-
Action Parameter: Reports count operator
- This parameter is the operator to work with the reports count parameter. The default
value is 'eq'. For example: if the reports count = 5 and the reports count operator =
'lt', then all the rules having a report count less than 5 will be retrieved. The
following are the valid values that the parameter can take:
- eq
- not_eq
- lt
- lteq
- gt
- gteq
- This parameter is the operator to work with the reports count parameter. The default
value is 'eq'. For example: if the reports count = 5 and the reports count operator =
'lt', then all the rules having a report count less than 5 will be retrieved. The
following are the valid values that the parameter can take:
-
Action Parameter: Start date
- This parameter allows filtering the rules updated on or after the provided date.
-
Action Parameter: End date
- This parameter allows filtering the rules updated before the provided date.
-
Action Parameter: Sort
- This parameter allows sorting the rules based on the 'updated_at' date. By default, it
will sort in the oldest first order. The following are the valid values that the
parameter can take:
- oldest_first
- latest_first
- This parameter allows sorting the rules based on the 'updated_at' date. By default, it
will sort in the oldest first order. The following are the valid values that the
parameter can take:
-
Action Parameter: Max results
- Maximum number of results to return. If not provided all the data will be retrieved.
-
Note - If no value is provided in any parameter, then all the records will be retrieved.
-
Example:
- Fetch the active rules created by 'author1' with name equals 'test' having tag equals
'test' and priority equals 1.
- Name = test
- Priority = 1
- Author name = author1
- Active = True
- Tags = test
- List all the rules updated between 2020-09-23T08:31:58Z and 2020-09-29T09:00:00Z and
sort them in oldest_first order.
- Start date = 2020-09-23T08:31:58Z
- End date = 2020-09-29T09:00:00Z
- Sort = oldest_first
- Fetch 20 rules with report count equals 5.
- Reports count = 5
- Reports count operator = eq
- Max results = 20
- Fetch the active rules created by 'author1' with name equals 'test' having tag equals
'test' and priority equals 1.
-
-
-
Action Parameter: Type
- This parameter is the type of integration submission.
-
Action Parameter: Value
- This parameter is the value of integration submission.
-
Example:
- List integration submissions of type MD5 with value equals
f033362ca459dcab56aa6b2274751d13.
- Type = MD5
- Value = f033362ca459dcab56aa6b2274751d13
- List integration submissions of type URL with value equals http://test.com.
- Type = URL
- Value = http://test.com
- List integration submissions of type MD5 with value equals
f033362ca459dcab56aa6b2274751d13.
-
-
-
-
It will ingest data from the external system into the phantom server in the form of containers and artifacts. There are two approaches to polling which are mentioned below.
-
POLL NOW (Manual polling)
- It will fetch the data every time as per the corresponding asset configuration parameters. It doesn’t store the last run context of the fetched data. The corresponding asset configuration parameters for the POLL NOW are ingestion_type, threat_indicator_type, threat_indicator_level, report_location, match_priority, category_id, tags, categorization_tags, ingest_subfields, category_id_to_severity, cef_mapping, start_date, sort and max_results.
-
Scheduled/Interval Polling
- Scheduled Polling: The ingestion action can be triggered at every specified timestamp interval.
- Interval Polling: The ingestion action can be triggered at every time range interval.
- It will fetch the data every time as per the corresponding asset configuration parameters based on the stored context from the previous ingestion run. It stores the last run context of the fetched data. It starts fetching data based on the combination of the values of stored context for the previous ingestion run and the corresponding asset configuration parameters. The corresponding asset configuration parameters for the scheduled/interval are ingestion_type, threat_indicator_type, threat_indicator_level, report_location, match_priority, category_id, tags, categorization_tags, ingest_subfields, category_id_to_severity, cef_mapping, start_date, sort, update_state_after and max_results.
-
-
-
-
We have configured two types of data ingestion which you can select from the asset configuration parameters. Below are the two types
- reports: It will ingest only the reports.
- threat_indicators: It will ingest only the threat indicators.
-
Container
- A container is a composite object that consists of one or more artifacts that can be automated. Containers are the top-level data structure that Playbooks operate on. Every container has a common header, and beneath that, the ability to store arbitrary less structured JSON.
-
Artifacts
- Artifacts are objects that are associated with a Container and serve as corroboration or evidence related to the Container.
-
Each report or threat indicator will be ingested as an artifact in a separate container. Each subfield related to the report or the threat indicator will get ingested into the container of that report or threat indicator as a separate artifact if the 'ingest_subfields' parameter is true. Below is the explanation based on the type of data for that.
-
reports
For this type, one container will be created for each report.
-
Container 1:- Subject of the report
- This container will be used to store fetched report data in the form of artifacts.
-
-
threat indicators
For this type, one container will be created for each threat indicator.
-
Container 1:- Threat Indicator ID - ID
- This container will be used to store fetched threat indicator data in the form of artifacts.
-
-
-
-
-
It is the concept of storing the context of the previous ingestion run. This concept will be used in the scheduled/interval polling. It will use the state file to store the last run context. This state file will be created for the created asset for the application on the phantom platform.
-
State file location:
- For non-NRI Instances: /opt/phantom/local_data/app_states/7129d563-a28d-4afc-8081-f909dce54293
- For NRI Instances: /home/phanru/phantomcyber/local_data/app_states/7129d563-a28d-4afc-8081-f909dce54293
-
The default format of state file: {"app_version": "1.0.0"}
-
-
-
Example:
- Ingest the Malicious threat indicators that are URLs and are updated on or after
2020-09-23T08:31:58Z.
- Ingestion type = threat_indicators
- Threat Indicator Level = Malicious
- Threat Indicator Type = URL
- Start date = 2020-09-23T08:31:58Z
- Ingest the reports present in Inbox having match priority equals 5 and are updated on or
after 2020-09-23T08:31:58Z.
- Ingestion type = reports
- Report Location = Inbox
- Match Priority = 5
- Start date = 2020-09-23T08:31:58Z
- Ingest the Malicious threat indicators that are URLs and are updated on or after
2020-09-23T08:31:58Z.
-
The below configuration variables are required for this Connector to operate. These variables are specified when configuring a Triage v2 asset in SOAR.
VARIABLE | REQUIRED | TYPE | DESCRIPTION |
---|---|---|---|
base_url | required | string | Server URL |
verify_server_cert | optional | boolean | Verify server certificate |
client_id | required | string | Client ID |
client_secret | required | password | Client Secret |
ingestion_type | optional | string | The type of data that is to be ingested |
threat_indicator_type | optional | string | Filters the results based on the type of the threat indicator. The default retrieves all |
threat_indicator_level | optional | string | Filters the results based on the level of the threat indicator. The default retrieves all |
report_location | optional | string | Filters the reports based on the location of the report. The default retrieves all |
match_priority | optional | numeric | Filters the results based on the highest priority of a rule matching the reported email |
category_id | optional | numeric | Filters the reports based on the category ID |
tags | optional | string | Allows filtering the reports based on the list of comma-separated tags |
categorization_tags | optional | string | Allows filtering the reports based on the list of comma-separated categorization tags |
ingest_subfields | optional | boolean | Allows ingestion of the fields relating to the fetched data into the container |
category_id_to_severity | optional | string | Mapping between report category ID and the Phantom container severity |
cef_mapping | optional | string | JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value |
start_date | optional | string | The initial start date and time of the ingestion |
sort | optional | string | Sorts the results based on the 'updated_at' date. The default sorts in the oldest first order |
update_state_after | optional | numeric | Allows updating the state after ingestion of a specified number of containers |
max_results | optional | numeric | Maximum number of results to ingest |
test connectivity - Validate the asset configuration for connectivity using supplied configuration
get reports - Retrieve reports from the Cofense Triage Platform filtered based on the provided parameters
get report - Retrieve a report with the provided ID from the Cofense Triage Platform
get email - Downloads the raw email for the report that matches the specified report ID
get categories - Retrieve categories from the Cofense Triage Platform filtered based on the provided parameters
get responses - Retrieve responses from the Cofense Triage Platform. This action is supported for Cofense Triage with version older than 1.23
create response - Create a response. This action is supported for Cofense Triage with version older than 1.23
categorize report - Categorize a report into the provided category
get threat indicators - Retrieve threat indicators from the Cofense Triage Platform filtered based on the provided parameters
create threat indicator - Create a threat indicator with the provided parameters
get reporters - Retrieve reporters from the Cofense Triage Platform filtered based on the provided parameters
get reporter - Retrieve a reporter from the Cofense Triage Platform for the provided reporter ID
get urls - Retrieve URLs from the Cofense Triage Platform filtered based on the provided parameters
get url - Retrieve a URL from the Cofense Triage Platform for the provided URL ID
get comments - Retrieve comments from the Cofense Triage Platform filtered based on the provided parameters
get comment - Retrieve a comment from the Cofense Triage Platform for the provided comment ID
get rules - Retrieve rules from the Cofense Triage Platform filtered based on the provided parameters
get rule - Retrieve a rule from the Cofense Triage Platform for the provided rule ID
get integration submissions - Retrieve integration submissions from the Cofense Triage Platform filtered based on the provided parameters
on poll - Action handler for the on poll ingest functionality
Validate the asset configuration for connectivity using supplied configuration
Type: test
Read only: True
No parameters are required for this action
No Output
Retrieve reports from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If the 'ingest_subfields' parameter is true, the report and the subfields together will get ingested into the container. If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
location | optional | Allows filtering the reports based on the location | string | cofensetriage report location |
from_address | optional | Allows filtering the reports based on the sender's email address of the reported email | string | email |
reporter_email | optional | Allows filtering the reports based on the reporter's email address | string | email |
subject | optional | Allows filtering the reports based on the subject of the reported email | string | cofensetriage report subject |
match_priority | optional | Allows filtering the result data set based on the highest priority of a rule matching the reported email | numeric | cofensetriage priority |
category_id | optional | Allows filtering the reports based on the category ID | numeric | cofensetriage category id |
start_date | optional | Allows filtering the reports updated on or after the provided date | string | date |
end_date | optional | Allows filtering the reports updated before the provided date | string | date |
tags | optional | Allows filtering the reports based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes (Example: tag1,"test,tag",tag2) | string | cofensetriage tag |
categorization_tags | optional | Allows filtering the reports based on the list of comma-separated categorization tags | string | cofensetriage tag |
sort | optional | Allows sorting the reports based on the 'updated_at' date of the report | string | |
ingest_report | optional | Allows ingestion of the report into the container | boolean | |
ingest_subfields | optional | Allows ingestion of the fields relating to the report into the container | boolean | |
label | optional | Allows ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
tenant | optional | Allows creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
cef_mapping | optional | JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.location | string | cofensetriage report location |
action_result.parameter.from_address | string | email |
action_result.parameter.reporter_email | string | email |
action_result.parameter.subject | string | cofensetriage report subject |
action_result.parameter.match_priority | numeric | cofensetriage priority |
action_result.parameter.category_id | numeric | cofensetriage category id |
action_result.parameter.start_date | string | date |
action_result.parameter.end_date | string | date |
action_result.parameter.tags | string | cofensetriage tag |
action_result.parameter.categorization_tags | string | cofensetriage tag |
action_result.parameter.sort | string | |
action_result.parameter.ingest_report | boolean | |
action_result.parameter.ingest_subfields | boolean | |
action_result.parameter.label | string | |
action_result.parameter.tenant | string | |
action_result.parameter.cef_mapping | string | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage report id |
action_result.data.*.meta.risk_score_summary.vip | numeric | |
action_result.data.*.meta.risk_score_summary.rules | numeric | |
action_result.data.*.meta.risk_score_summary.reporter | numeric | |
action_result.data.*.meta.risk_score_summary.integrations | numeric | |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.md5 | string | md5 |
action_result.data.*.attributes.sha256 | string | sha256 |
action_result.data.*.attributes.subject | string | cofensetriage report subject |
action_result.data.*.attributes.location | string | cofensetriage report location |
action_result.data.*.attributes.html_body | string | |
action_result.data.*.attributes.text_body | string | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.risk_score | numeric | |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.raw_headers | string | |
action_result.data.*.attributes.received_at | string | date |
action_result.data.*.attributes.reported_at | string | date |
action_result.data.*.attributes.from_address | string | email |
action_result.data.*.attributes.processed_at | string | date |
action_result.data.*.attributes.match_priority | numeric | cofensetriage priority |
action_result.data.*.attributes.categorization_tags | string | cofensetriage tag |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.data.*.container_id | numeric | container id |
action_result.data.*.relationships.urls.links.self | string | url |
action_result.data.*.relationships.urls.links.related | string | url |
action_result.data.*.relationships.rules.links.self | string | url |
action_result.data.*.relationships.rules.links.related | string | url |
action_result.data.*.relationships.cluster.data.id | string | |
action_result.data.*.relationships.cluster.data.type | string | |
action_result.data.*.relationships.cluster.links.self | string | url |
action_result.data.*.relationships.cluster.links.related | string | url |
action_result.data.*.relationships.headers.links.self | string | url |
action_result.data.*.relationships.headers.links.related | string | url |
action_result.data.*.relationships.assignee.data.id | string | |
action_result.data.*.relationships.assignee.data.type | string | |
action_result.data.*.relationships.assignee.links.self | string | url |
action_result.data.*.relationships.assignee.links.related | string | url |
action_result.data.*.relationships.category.data.id | string | cofensetriage category id |
action_result.data.*.relationships.category.data.type | string | |
action_result.data.*.relationships.category.links.self | string | url |
action_result.data.*.relationships.category.links.related | string | url |
action_result.data.*.relationships.reporter.data.id | string | cofensetriage reporter id |
action_result.data.*.relationships.reporter.data.type | string | |
action_result.data.*.relationships.reporter.links.self | string | url |
action_result.data.*.relationships.reporter.links.related | string | url |
action_result.data.*.relationships.hostnames.links.self | string | url |
action_result.data.*.relationships.hostnames.links.related | string | url |
action_result.data.*.relationships.attachments.links.self | string | url |
action_result.data.*.relationships.attachments.links.related | string | url |
action_result.data.*.relationships.threat_indicators.links.self | string | url |
action_result.data.*.relationships.threat_indicators.links.related | string | url |
action_result.data.*.relationships.attachment_payloads.links.self | string | url |
action_result.data.*.relationships.attachment_payloads.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
action_result.summary.total_reports_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve a report with the provided ID from the Cofense Triage Platform
Type: investigate
Read only: True
If the 'ingest_subfields' parameter is true, the report and the subfields together will get ingested into the container.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
report_id | required | The ID of the report which is to be fetched | numeric | cofensetriage report id |
ingest_report | optional | Allow ingestion of the report into the container | boolean | |
ingest_subfields | optional | Ingestion of the fields relating to the report into the container | boolean | |
label | optional | Allows ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
tenant | optional | Allows creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
cef_mapping | optional | JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value | string |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.report_id | numeric | cofensetriage report id |
action_result.parameter.ingest_report | boolean | |
action_result.parameter.ingest_subfields | boolean | |
action_result.parameter.label | string | |
action_result.parameter.tenant | string | |
action_result.parameter.cef_mapping | string | |
action_result.data.*.id | string | cofensetriage report id |
action_result.data.*.container_id | numeric | container id |
action_result.data.*.meta.risk_score_summary.vip | numeric | |
action_result.data.*.meta.risk_score_summary.rules | numeric | |
action_result.data.*.meta.risk_score_summary.reporter | numeric | |
action_result.data.*.meta.risk_score_summary.integrations | numeric | |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.md5 | string | md5 |
action_result.data.*.attributes.sha256 | string | sha256 |
action_result.data.*.attributes.subject | string | cofensetriage report subject |
action_result.data.*.attributes.location | string | cofensetriage report location |
action_result.data.*.attributes.html_body | string | |
action_result.data.*.attributes.text_body | string | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.risk_score | numeric | |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.raw_headers | string | |
action_result.data.*.attributes.received_at | string | date |
action_result.data.*.attributes.reported_at | string | date |
action_result.data.*.attributes.from_address | string | email |
action_result.data.*.attributes.processed_at | string | date |
action_result.data.*.attributes.match_priority | numeric | cofensetriage priority |
action_result.data.*.attributes.categorization_tags | string | cofensetriage tag |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.data.*.relationships.urls.links.self | string | url |
action_result.data.*.relationships.urls.links.related | string | url |
action_result.data.*.relationships.rules.links.self | string | url |
action_result.data.*.relationships.rules.links.related | string | url |
action_result.data.*.relationships.cluster.data.id | string | |
action_result.data.*.relationships.cluster.data.type | string | |
action_result.data.*.relationships.cluster.links.self | string | url |
action_result.data.*.relationships.cluster.links.related | string | url |
action_result.data.*.relationships.headers.links.self | string | url |
action_result.data.*.relationships.headers.links.related | string | url |
action_result.data.*.relationships.assignee.data.id | string | |
action_result.data.*.relationships.assignee.data.type | string | |
action_result.data.*.relationships.assignee.links.self | string | url |
action_result.data.*.relationships.assignee.links.related | string | url |
action_result.data.*.relationships.category.data.id | string | cofensetriage category id |
action_result.data.*.relationships.category.data.type | string | |
action_result.data.*.relationships.category.links.self | string | url |
action_result.data.*.relationships.category.links.related | string | url |
action_result.data.*.relationships.reporter.data.id | string | cofensetriage reporter id |
action_result.data.*.relationships.reporter.data.type | string | |
action_result.data.*.relationships.reporter.links.self | string | url |
action_result.data.*.relationships.reporter.links.related | string | url |
action_result.data.*.relationships.hostnames.links.self | string | url |
action_result.data.*.relationships.hostnames.links.related | string | url |
action_result.data.*.relationships.attachments.links.self | string | url |
action_result.data.*.relationships.attachments.links.related | string | url |
action_result.data.*.relationships.threat_indicators.links.self | string | url |
action_result.data.*.relationships.threat_indicators.links.related | string | url |
action_result.data.*.relationships.attachment_payloads.links.self | string | url |
action_result.data.*.relationships.attachment_payloads.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Downloads the raw email for the report that matches the specified report ID
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
report_id | required | The ID of the report | numeric | cofensetriage report id |
download_method | required | Allows the user to download the email as an artifact or as a vaulted file | string | |
create_vaulted_file_artifact | optional | If storing as a vaulted file, this parameter allows the user to create an artifact referencing that file | boolean |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.create_vaulted_file_artifact | boolean | |
action_result.parameter.download_method | string | |
action_result.parameter.report_id | numeric | cofensetriage report id |
action_result.data.*.artifact_id | string | artifact id |
action_result.data.*.filename | string | file name |
action_result.data.*.md5 | string | md5 hash |
action_result.data.*.report_id | string | cofensetriage report id |
action_result.data.*.sha1 | string | sha1 hash |
action_result.data.*.sha256 | string | sha256 hash |
action_result.data.*.size | string | |
action_result.data.*.vault_id | string | vault id |
action_result.data.*.vaulted | string | file path |
action_result.status | string | |
action_result.message | string | |
action_result.summary.filename | string | file name |
action_result.summary.vault_id | string | vault id |
action_result.summary.report_id | numeric | cofensetriage report id |
action_result.summary.artifact_id | numeric | artifact id |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve categories from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
name | optional | Allows the user to fetch the categories with the name containing a specific string | string | cofensetriage category name |
malicious | optional | Allows the user to fetch the categories based on whether the category is used to classify malicious reports or not | boolean | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.name | string | cofensetriage category name |
action_result.parameter.malicious | boolean | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage category id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.name | string | cofensetriage category name |
action_result.data.*.attributes.color | string | |
action_result.data.*.attributes.score | numeric | |
action_result.data.*.attributes.archived | boolean | |
action_result.data.*.attributes.malicious | boolean | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.one_clicks.links.self | string | url |
action_result.data.*.relationships.one_clicks.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_categories_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve responses from the Cofense Triage Platform. This action is supported for Cofense Triage with version older than 1.23
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
max_results | optional | Allows the user to limit the number of results | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetirage response id |
action_result.data.*.relationships.one_clicks.links.self | string | url |
action_result.data.*.relationships.one_clicks.links.related | string | url |
action_result.data.*.attributes.body | string | |
action_result.data.*.attributes.name | string | |
action_result.data.*.attributes.to_other | boolean | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.bcc_address | string | email |
action_result.data.*.attributes.cc_address | string | email |
action_result.data.*.attributes.attach_original | boolean | |
action_result.data.*.attributes.to_other_address | string | email |
action_result.data.*.attributes.subject | string | |
action_result.data.*.attributes.to_reporter | boolean | |
action_result.data.*.attributes.description | string | |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_responses_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Create a response. This action is supported for Cofense Triage with version older than 1.23
Type: generic
Read only: False
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
name | required | Display name of the response sent to individuals | string | |
subject | required | Subject of the response | string | |
body | required | Body of the email | string | |
description | optional | Description of the response | string | |
to_reporter | optional | To add the reporter to the response recipient list or not | boolean | |
to_other | optional | To add the addresses specified in 'to_other_address' to the response recipient list or not | boolean | |
to_other_address | optional | Comma-separated list of email addresses to send the response to | string | email |
attach_original | optional | To attach the original email to the response or not | boolean | |
cc_address | optional | Comma-separated list of email addresses to CC the response to | string | email |
bcc_address | optional | Comma-separated list of email addresses to BCC the response to | string | email |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.name | string | |
action_result.parameter.subject | string | |
action_result.parameter.body | string | |
action_result.parameter.description | string | |
action_result.parameter.to_reporter | boolean | |
action_result.parameter.to_other | boolean | |
action_result.parameter.to_other_address | string | email |
action_result.parameter.attach_original | boolean | |
action_result.parameter.cc_address | string | email |
action_result.parameter.bcc_address | string | email |
action_result.data.*.id | string | cofensetirage response id |
action_result.data.*.relationships.one_clicks.links.self | string | url |
action_result.data.*.relationships.one_clicks.links.related | string | url |
action_result.data.*.attributes.body | string | |
action_result.data.*.attributes.name | string | |
action_result.data.*.attributes.to_other | boolean | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.bcc_address | string | email |
action_result.data.*.attributes.cc_address | string | email |
action_result.data.*.attributes.attach_original | boolean | |
action_result.data.*.attributes.to_other_address | string | email |
action_result.data.*.attributes.subject | string | |
action_result.data.*.attributes.to_reporter | boolean | |
action_result.data.*.attributes.description | string | |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.response_id | string | cofensetirage response id |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Categorize a report into the provided category
Type: generic
Read only: False
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
report_id | required | The ID of the report | numeric | cofensetriage report id |
category_id | optional | The ID of the category | numeric | cofensetriage category id |
category_name | optional | The name of the category | string | cofensetriage category name |
response_id | optional | The ID of the response | numeric | |
categorization_tags | optional | Allows the user to provide multiple tags to the report while categorizing it | string | cofensetriage tag |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.report_id | numeric | cofensetriage report id |
action_result.parameter.response_id | numeric | |
action_result.parameter.category_name | string | cofensetriage category name |
action_result.parameter.category_id | numeric | cofensetriage category id |
action_result.parameter.categorization_tags | string | cofensetriage tag |
action_result.data | string | |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve threat indicators from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If the 'ingest_subfields' parameter is true, the threat indicator and the subfields together will get ingested into the container. If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
level | optional | The level of the threat indicator | string | cofensetriage threat indicator level |
type | optional | Type of the threat indicators | string | cofensetriage threat indicator type |
source | optional | Source of the threat indicators | string | cofensetriage threat indicator source |
value | optional | Value of the threat indicators | string | sha256 md5 url hash domain host name |
start_date | optional | Threat indicators updated on or after the provided date | string | date |
end_date | optional | Threat indicators updated before the provided date | string | date |
sort | optional | Sorting based on updated date of threat indicators | string | |
ingest_threat_indicator | optional | Ingestion of threat indicator(s) into the container(s) | boolean | |
ingest_subfields | optional | Allow ingestion of the fields relating to the threat indicator into the container | boolean | |
label | optional | Allows ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_threat_indicator' or 'ingest_subfields' is set | string | |
tenant | optional | Allows creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_threat_indicator' or 'ingest_subfields' is set | string | |
cef_mapping | optional | JSON dictionary represented as a serialized JSON string | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.level | string | cofensetriage threat indicator level |
action_result.parameter.type | string | cofensetriage threat indicator type |
action_result.parameter.source | string | cofensetriage threat indicator source |
action_result.parameter.value | string | sha256 md5 url hash domain host name |
action_result.parameter.start_date | string | date |
action_result.parameter.end_date | string | date |
action_result.parameter.sort | string | |
action_result.parameter.ingest_threat_indicator | string | |
action_result.parameter.ingest_subfields | string | |
action_result.parameter.label | string | |
action_result.parameter.tenant | string | |
action_result.parameter.cef_mapping | string | |
action_result.parameter.max_results | string | |
action_result.data.*.id | string | cofensetriage threat indicator id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.threat_type | string | cofensetriage threat indicator type |
action_result.data.*.attributes.threat_level | string | cofensetriage threat indicator level |
action_result.data.*.attributes.threat_value | string | sha256 md5 url hash domain host name |
action_result.data.*.attributes.threat_source | string | cofensetriage threat indicator source |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.comments.links.self | string | url |
action_result.data.*.relationships.comments.links.related | string | url |
action_result.data.*.container_id | numeric | container id |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_threat_indicators_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Create a threat indicator with the provided parameters
Type: generic
Read only: False
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
level | required | The level of the threat indicator | string | cofensetriage threat indicator level |
type | required | Type of the threat indicator | string | cofensetriage threat indicator type |
value | required | Value of the threat indicator | string | sha256 md5 url hostname domain hash |
source | optional | Source of the threat indicator | string | cofensetriage threat indicator source |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.level | string | cofensetriage threat indicator level |
action_result.parameter.type | string | cofensetriage threat indicator type |
action_result.parameter.value | string | sha256 md5 url hostname domain hash |
action_result.parameter.source | string | cofensetriage threat indicator source |
action_result.data.*.id | string | cofensetriage threat indicator id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.threat_type | string | cofensetriage threat indicator type |
action_result.data.*.attributes.threat_level | string | cofensetriage threat indicator level |
action_result.data.*.attributes.threat_value | string | sha256 md5 url hostname hash domain |
action_result.data.*.attributes.threat_source | string | cofensetriage threat indicator source |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.comments.links.self | string | url |
action_result.data.*.relationships.comments.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.threat_indicator_id | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve reporters from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
vip | optional | Allows searching for the VIP reporters | boolean | |
reputation_score | optional | Allows searching for reporters having the provided reputation score. It allows a comma-separated list | string | cofensetriage reporter reputation score |
optional | Allows searching for the reporter with a specific email | string | email |
|
sort | optional | Allows sorting the reporters based on the ID | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.vip | boolean | |
action_result.parameter.reputation_score | string | cofensetriage reporter reputation score |
action_result.parameter.email | string | email |
action_result.parameter.sort | string | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage reporter id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.vip | boolean | |
action_result.data.*.attributes.email | string | email |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.reports_count | numeric | |
action_result.data.*.attributes.last_reported_at | string | date |
action_result.data.*.attributes.reputation_score | numeric | cofensetriage reporter reputation score |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_reporters_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve a reporter from the Cofense Triage Platform for the provided reporter ID
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
reporter_id | required | The unique ID of the reporter | numeric | cofensetriage reporter id |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.reporter_id | numeric | cofensetriage reporter id |
action_result.data.*.id | string | cofensetriage reporter id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.vip | boolean | |
action_result.data.*.attributes.email | string | email |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.reports_count | numeric | |
action_result.data.*.attributes.last_reported_at | string | date |
action_result.data.*.attributes.reputation_score | numeric | cofensetriage reporter reputation score |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve URLs from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
risk_score | optional | Risk score of the URL | numeric | cofensetriage risk score |
risk_score_operator | optional | Operator to work with the risk score parameter | string | |
url_value | optional | Value of the URL to search for | string | url |
start_date | optional | Allows filtering the URLs updated on or after the provided date | string | date |
end_date | optional | Allows filtering the URLs updated before the provided date | string | date |
sort | optional | Allows sorting the URLs based on the 'updated_at' date | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.risk_score | numeric | cofensetriage risk score |
action_result.parameter.risk_score_operator | string | |
action_result.parameter.url_value | string | url |
action_result.parameter.start_date | string | date |
action_result.parameter.end_date | string | date |
action_result.parameter.sort | string | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage url id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.url | string | url |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.risk_score | string | cofensetriage risk score |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.data.*.relationships.hostname.data.id | string | |
action_result.data.*.relationships.hostname.data.type | string | |
action_result.data.*.relationships.hostname.links.self | string | url |
action_result.data.*.relationships.hostname.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_urls_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve a URL from the Cofense Triage Platform for the provided URL ID
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
url_id | required | ID of the URL | numeric | cofensetriage url id |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.url_id | numeric | cofensetriage url id |
action_result.data.*.id | string | cofensetriage url id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.url | string | url |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.risk_score | string | cofensetriage risk score |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.data.*.relationships.hostname.data.id | string | |
action_result.data.*.relationships.hostname.data.type | string | |
action_result.data.*.relationships.hostname.links.self | string | url |
action_result.data.*.relationships.hostname.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve comments from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
body_format | optional | Allows filtering the comments based on the format of the comment body | string | cofensetriage comment body format |
tags | optional | Allows filtering the comments based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes (Example: tag1,"test,tag",tag2) | string | cofensetriage tag |
start_date | optional | Allows filtering the comments updated on or after the provided date | string | date |
end_date | optional | Allows filtering the comments updated before the provided date | string | date |
sort | optional | Allows sorting the comments based on the 'updated_at' date of the comment | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.body_format | string | cofensetriage comment body format |
action_result.parameter.tags | string | cofensetriage tag |
action_result.parameter.start_date | string | date |
action_result.parameter.end_date | string | date |
action_result.parameter.sort | string | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage comment id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.body | string | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.body_format | string | cofensetriage comment body format |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.commentable.data.id | string | |
action_result.data.*.relationships.commentable.data.type | string | |
action_result.data.*.relationships.commentable.links.self | string | url |
action_result.data.*.relationships.commentable.links.related | string | url |
action_result.data.*.attributes.body.type | string | |
action_result.data.*.attributes.body.properties.from.type | string | email |
action_result.data.*.attributes.body.properties.notes.type | string | |
action_result.data.*.attributes.body.properties.brands.type | string | |
action_result.data.*.attributes.body.properties.brands.items.type | string | |
action_result.data.*.attributes.body.properties.srctag.type | string | |
action_result.data.*.attributes.body.properties.sent_to.type | string | email |
action_result.data.*.attributes.body.properties.subject.type | string | |
action_result.data.*.attributes.body.properties.summary.type | string | |
action_result.data.*.attributes.body.properties.reply_to.type | string | |
action_result.data.*.attributes.body.properties.report_id.type | string | |
action_result.data.*.attributes.body.properties.message_id.type | string | |
action_result.data.*.attributes.body.properties.phenotypes.type | string | |
action_result.data.*.attributes.body.properties.report_url.type | string | url |
action_result.data.*.attributes.body.properties.reported_by.type | string | email |
action_result.data.*.attributes.body.properties.stage_1_iocs.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.files.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_ips.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_ips.items.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_urls.items.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.md5.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.size.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.files.type | string | file name |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.c2_ips.type | string | ip |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.c2_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_ips.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_ips.items.type | string | ip |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_urls.items.type | string | |
action_result.data.*.attributes.body.properties.received_time.type | string | |
action_result.data.*.attributes.body.properties.reported_time.type | string | |
action_result.data.*.attributes.body.properties.vision_results.type | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.results_id | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.query_created.type | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.messages_found | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.messages_removed | string | |
action_result.data.*.attributes.body.properties.escalation_type.type | string | |
action_result.data.*.attributes.body.properties.malware_families.type | string | |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_comments_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve a comment from the Cofense Triage Platform for the provided comment ID
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
comment_id | required | ID of the comment | numeric | cofensetriage comment id |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.comment_id | numeric | cofensetriage comment id |
action_result.data.*.id | string | cofensetriage comment id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.body | string | |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.body_format | string | cofensetriage comment body format |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.commentable.data.id | string | |
action_result.data.*.relationships.commentable.data.type | string | |
action_result.data.*.relationships.commentable.links.self | string | url |
action_result.data.*.relationships.commentable.links.related | string | url |
action_result.data.*.attributes.body.type | string | |
action_result.data.*.attributes.body.properties.from.type | string | email |
action_result.data.*.attributes.body.properties.notes.type | string | |
action_result.data.*.attributes.body.properties.brands.type | string | |
action_result.data.*.attributes.body.properties.brands.items.type | string | |
action_result.data.*.attributes.body.properties.srctag.type | string | |
action_result.data.*.attributes.body.properties.sent_to.type | string | email |
action_result.data.*.attributes.body.properties.subject.type | string | |
action_result.data.*.attributes.body.properties.summary.type | string | |
action_result.data.*.attributes.body.properties.reply_to.type | string | |
action_result.data.*.attributes.body.properties.report_id.type | string | |
action_result.data.*.attributes.body.properties.message_id.type | string | |
action_result.data.*.attributes.body.properties.phenotypes.type | string | |
action_result.data.*.attributes.body.properties.report_url.type | string | url |
action_result.data.*.attributes.body.properties.reported_by.type | string | email |
action_result.data.*.attributes.body.properties.stage_1_iocs.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.files.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_ips.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_ips.items.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_1_iocs.properties.infection_urls.items.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.md5.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.size.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.files.type | string | file name |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.c2_ips.type | string | ip |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.c2_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_ips.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_ips.items.type | string | ip |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_urls.type | string | |
action_result.data.*.attributes.body.properties.stage_2_iocs.properties.payload_urls.items.type | string | |
action_result.data.*.attributes.body.properties.received_time.type | string | |
action_result.data.*.attributes.body.properties.reported_time.type | string | |
action_result.data.*.attributes.body.properties.vision_results.type | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.results_id | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.query_created.type | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.messages_found | string | |
action_result.data.*.attributes.body.properties.vision_results.properties.messages_removed | string | |
action_result.data.*.attributes.body.properties.escalation_type.type | string | |
action_result.data.*.attributes.body.properties.malware_families.type | string | |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve rules from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
If no value is provided in any parameter, then all the records will be retrieved.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
name | optional | Allows filtering the rules based on the name | string | cofensetriage rule name |
description | optional | Allows filtering the rules based on the description | string | cofensetriage rule description |
priority | optional | Allows filtering the rules based on the priority | numeric | cofensetriage priority |
tags | optional | Allows filtering the rules based on the list of comma-separated tags. If the tag value contains a comma, enclose it in double-quotes (Example: tag1,"test,tag",tag2) | string | cofensetriage tag |
scope | optional | Allows filtering the rules based on the scope | string | cofensetriage rule scope |
author_name | optional | Allows filtering the rules based on the author name | string | cofensetriage rule author name |
rule_context | optional | Allows filtering the rules based on the context | string | cofensetriage rule context |
active | optional | Allows filtering the rules based on the status | boolean | |
reports_count | optional | Allows filtering the rules based on the number of reports the rule matched | numeric | cofensetriage rule reports count |
reports_count_operator | optional | Operator to work with the reports count parameter | string | |
start_date | optional | Allows filtering the rules updated on or after the provided date | string | date |
end_date | optional | Allows filtering the rules updated before the provided date | string | date |
sort | optional | Allows sorting the rules based on the 'updated_at' date of the rule | string | |
max_results | optional | Maximum number of results to return | numeric |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.name | string | cofensetriage rule name |
action_result.parameter.description | string | cofensetriage rule description |
action_result.parameter.priority | numeric | cofensetriage priority |
action_result.parameter.tags | string | cofensetriage tag |
action_result.parameter.scope | string | cofensetriage rule scope |
action_result.parameter.author_name | string | cofensetriage rule author name |
action_result.parameter.rule_context | string | cofensetriage rule context |
action_result.parameter.active | boolean | |
action_result.parameter.reports_count | numeric | cofensetriage rule reports count |
action_result.parameter.reports_count_operator | string | |
action_result.parameter.start_date | string | date |
action_result.parameter.end_date | string | date |
action_result.parameter.sort | string | |
action_result.parameter.max_results | numeric | |
action_result.data.*.id | string | cofensetriage rule id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.name | string | cofensetriage rule name |
action_result.data.*.attributes.scope | string | cofensetriage rule scope |
action_result.data.*.attributes.active | boolean | |
action_result.data.*.attributes.content | string | |
action_result.data.*.attributes.priority | numeric | cofensetriage priority |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.author_name | string | cofensetriage rule author name |
action_result.data.*.attributes.description | string | cofensetriage rule description |
action_result.data.*.attributes.imported_at | string | |
action_result.data.*.attributes.rule_context | string | cofensetriage rule context |
action_result.data.*.attributes.time_to_live | string | |
action_result.data.*.attributes.reports_count | numeric | cofensetriage rule reports count |
action_result.data.*.attributes.share_with_cofense | boolean | |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.data.*.relationships.report_context.data | string | |
action_result.data.*.relationships.report_context.links.self | string | url |
action_result.data.*.relationships.report_context.links.related | string | url |
action_result.data.*.relationships.cluster_context.data | string | |
action_result.data.*.relationships.cluster_context.links.self | string | url |
action_result.data.*.relationships.cluster_context.links.related | string | url |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_rules_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve a rule from the Cofense Triage Platform for the provided rule ID
Type: investigate
Read only: True
If the 'ingest_subfields' parameter is true, the report and the subfields together will get ingested into the container.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
rule_id | required | ID of the rule | numeric | cofensetriage rule id |
ingest_report | optional | Allows ingestion of the reports related to the rule into the container | boolean | |
ingest_subfields | optional | Allows ingestion of fields relating to the report into the container | boolean | |
label | optional | Allows ingestion of data into the container(s) with the provided label. The label must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
tenant | optional | Allows creation of container(s) for the provided tenant ID or tenant name. The tenant must be valid or the action will fail. Required if 'ingest_report' or 'ingest_subfields' is set | string | |
cef_mapping | optional | JSON dictionary represented as a serialized JSON string. Each key in the dictionary is a potential key name in an artifact that is to be renamed to the value | string |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.rule_id | numeric | cofensetriage rule id |
action_result.parameter.ingest_report | boolean | |
action_result.parameter.ingest_subfields | boolean | |
action_result.parameter.label | string | |
action_result.parameter.tenant | string | |
action_result.parameter.cef_mapping | string | |
action_result.data.*.id | string | cofensetriage rule id |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.reports.*.id | string | cofensetriage report id |
action_result.data.*.reports.*.meta.risk_score_summary.vip | numeric | |
action_result.data.*.reports.*.meta.risk_score_summary.rules | numeric | |
action_result.data.*.reports.*.meta.risk_score_summary.reporter | numeric | |
action_result.data.*.reports.*.meta.risk_score_summary.integrations | numeric | |
action_result.data.*.reports.*.type | string | |
action_result.data.*.reports.*.links.self | string | url |
action_result.data.*.reports.*.attributes.md5 | string | md5 |
action_result.data.*.reports.*.attributes.sha256 | string | sha256 |
action_result.data.*.reports.*.attributes.subject | string | cofensetriage report subject |
action_result.data.*.reports.*.attributes.location | string | cofensetriage report location |
action_result.data.*.reports.*.attributes.html_body | string | |
action_result.data.*.reports.*.attributes.text_body | string | |
action_result.data.*.reports.*.attributes.created_at | string | date |
action_result.data.*.reports.*.attributes.risk_score | numeric | cofensetriage risk score |
action_result.data.*.reports.*.attributes.updated_at | string | date |
action_result.data.*.reports.*.attributes.raw_headers | string | |
action_result.data.*.reports.*.attributes.received_at | string | date |
action_result.data.*.reports.*.attributes.reported_at | string | date |
action_result.data.*.reports.*.attributes.from_address | string | email |
action_result.data.*.reports.*.attributes.processed_at | string | date |
action_result.data.*.reports.*.attributes.match_priority | numeric | cofensetriage priority |
action_result.data.*.reports.*.container_id | numeric | container id |
action_result.data.*.reports.*.relationships.urls.links.self | string | url |
action_result.data.*.reports.*.relationships.urls.links.related | string | url |
action_result.data.*.reports.*.relationships.rules.links.self | string | url |
action_result.data.*.reports.*.relationships.rules.links.related | string | url |
action_result.data.*.reports.*.relationships.cluster.data.id | string | |
action_result.data.*.reports.*.relationships.cluster.data.type | string | |
action_result.data.*.reports.*.relationships.cluster.links.self | string | url |
action_result.data.*.reports.*.relationships.cluster.links.related | string | url |
action_result.data.*.reports.*.relationships.domains.links.self | string | url |
action_result.data.*.reports.*.relationships.domains.links.related | string | url |
action_result.data.*.reports.*.relationships.headers.links.self | string | url |
action_result.data.*.reports.*.relationships.headers.links.related | string | url |
action_result.data.*.reports.*.relationships.assignee.data | string | |
action_result.data.*.reports.*.relationships.assignee.links.self | string | url |
action_result.data.*.reports.*.relationships.assignee.links.related | string | url |
action_result.data.*.reports.*.relationships.category.data | string | |
action_result.data.*.reports.*.relationships.category.links.self | string | url |
action_result.data.*.reports.*.relationships.category.links.related | string | url |
action_result.data.*.reports.*.relationships.comments.links.self | string | url |
action_result.data.*.reports.*.relationships.comments.links.related | string | url |
action_result.data.*.reports.*.relationships.reporter.data.id | string | cofensetriage reporter id |
action_result.data.*.reports.*.relationships.reporter.data.type | string | |
action_result.data.*.reports.*.relationships.reporter.links.self | string | url |
action_result.data.*.reports.*.relationships.reporter.links.related | string | url |
action_result.data.*.reports.*.relationships.hostnames.links.self | string | url |
action_result.data.*.reports.*.relationships.hostnames.links.related | string | url |
action_result.data.*.reports.*.relationships.attachments.links.self | string | url |
action_result.data.*.reports.*.relationships.attachments.links.related | string | url |
action_result.data.*.reports.*.relationships.threat_indicators.links.self | string | url |
action_result.data.*.reports.*.relationships.threat_indicators.links.related | string | url |
action_result.data.*.reports.*.relationships.attachment_payloads.links.self | string | url |
action_result.data.*.reports.*.relationships.attachment_payloads.links.related | string | url |
action_result.data.*.attributes.name | string | cofensetriage rule name |
action_result.data.*.attributes.tags | string | cofensetriage tag |
action_result.data.*.attributes.scope | string | cofensetriage rule scope |
action_result.data.*.attributes.active | boolean | |
action_result.data.*.attributes.content | string | |
action_result.data.*.attributes.priority | numeric | cofensetriage priority |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.attributes.author_name | string | cofensetriage rule author name |
action_result.data.*.attributes.description | string | cofensetriage rule description |
action_result.data.*.attributes.imported_at | string | |
action_result.data.*.attributes.rule_context | string | cofensetriage rule context |
action_result.data.*.attributes.time_to_live | string | |
action_result.data.*.attributes.reports_count | numeric | cofensetriage rule reports count |
action_result.data.*.attributes.share_with_cofense | boolean | |
action_result.data.*.relationships.owner.data.id | string | |
action_result.data.*.relationships.owner.data.type | string | |
action_result.data.*.relationships.owner.links.self | string | url |
action_result.data.*.relationships.owner.links.related | string | url |
action_result.data.*.relationships.reports.links.self | string | url |
action_result.data.*.relationships.reports.links.related | string | url |
action_result.data.*.relationships.clusters.links.self | string | url |
action_result.data.*.relationships.clusters.links.related | string | url |
action_result.data.*.relationships.report_context.data | string | |
action_result.data.*.relationships.report_context.links.self | string | url |
action_result.data.*.relationships.report_context.links.related | string | url |
action_result.data.*.relationships.cluster_context.data | string | |
action_result.data.*.relationships.cluster_context.links.self | string | url |
action_result.data.*.relationships.cluster_context.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary | string | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Retrieve integration submissions from the Cofense Triage Platform filtered based on the provided parameters
Type: investigate
Read only: True
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
type | required | The type of integration submission | string | |
value | required | The value of integration submission | string | hash md5 sha256 url |
DATA PATH | TYPE | CONTAINS |
---|---|---|
action_result.parameter.type | string | |
action_result.parameter.value | string | hash md5 sha256 url |
action_result.data.*.id | string | |
action_result.data.*.type | string | |
action_result.data.*.links.self | string | url |
action_result.data.*.attributes.kind | string | |
action_result.data.*.attributes.result | string | |
action_result.data.*.attributes.status | string | |
action_result.data.*.attributes.risk_score | numeric | cofensetriage risk score |
action_result.data.*.attributes.created_at | string | date |
action_result.data.*.attributes.updated_at | string | date |
action_result.data.*.relationships.target.data.id | string | |
action_result.data.*.relationships.target.data.type | string | |
action_result.data.*.relationships.target.links.self | string | url |
action_result.data.*.relationships.target.links.related | string | url |
action_result.data.*.relationships.integration.data.id | string | |
action_result.data.*.relationships.integration.data.type | string | |
action_result.data.*.relationships.integration.links.self | string | url |
action_result.data.*.relationships.integration.links.related | string | url |
action_result.status | string | |
action_result.message | string | |
action_result.summary.total_integration_submissions_retrieved | numeric | |
summary.total_objects | numeric | |
summary.total_objects_successful | numeric |
Action handler for the on poll ingest functionality
Type: ingest
Read only: True
This action ingests reports or threat indicators from Cofense Triage as per the selected ingestion type.
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
---|---|---|---|---|
container_count | optional | Maximum number of containers to ingest | numeric | |
start_time | optional | Parameter ignored in this app | numeric | |
end_time | optional | Parameter ignored in this app | numeric | |
artifact_count | optional | Parameter ignored in this app | numeric |
No Output