Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for IoC Incident Feed #37021

Open
wants to merge 8 commits into
base: contrib/CyberInt_feature/sync-indicators
Choose a base branch
from
+1,823 −654
Open

Add support for IoC Incident Feed #37021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7030b47
- Fixed mirroring feature
klevitskiy-cyberint Nov 1, 2024
80ebcc0
Merge branch 'master' into feature/sync-indicators
klevitskiy-cyberint Nov 1, 2024
e33ff44
Merge branch 'contrib/CyberInt_feature/sync-indicators' into feature/…
klevitskiy-cyberint Nov 4, 2024
b7379a1
Merge branch 'contrib/CyberInt_feature/sync-indicators' into feature/…
klevitskiy-cyberint Nov 4, 2024
f88ac2c
Merge branch 'contrib/CyberInt_feature/sync-indicators' into feature/…
klevitskiy-cyberint Nov 6, 2024
74656de
minor fixes
klevitskiy-cyberint Nov 20, 2024
c884ffb
code fixes according to the review comments
klevitskiy-cyberint Nov 22, 2024
27cd0a8
Merge branch 'contrib/CyberInt_feature/sync-indicators' into feature/…
klevitskiy-cyberint Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
261 changes: 103 additions & 158 deletions Packs/Cyberint/Classifiers/classifier-mapper-incoming-CyberInt.json
View file
Open in desktop

Large diffs are not rendered by default.

88 changes: 55 additions & 33 deletions Packs/Cyberint/Classifiers/classifier-mapper-outgoing-CyberInt.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,56 @@
{
"description": "",
"feed": false,
"id": "CyberInt Outgoing (mapper)",
"mapping": {
"Cyberint Incident": {
"dontMapEventToLabels": true,
"internalMapping": {
"closure_reason": {
"simple": "cyberintclosurereason"
},
"closure_reason_description": {
"simple": "cyberintclosurereasondescription"
},
"mirror_direction": {
"simple": "dbotMirrorDirection"
},
"mirror_instance": {
"simple": "dbotMirrorInstance"
},
"ref_id": {
"simple": "dbotMirrorId"
},
"status": {
"simple": "cyberintstatus"
}
}
}
},
"name": "CyberInt Outgoing (mapper)",
"type": "mapping-outgoing",
"version": -1,
"fromVersion": "6.0.0"
}
"brands": null,
"cacheVersn": 0,
"defaultIncidentType": "",
"definitionId": "",
"description": "",
"feed": false,
"fromServerVersion": "",
"id": "46139b6e-d1e4-4f17-88bb-cf3b4bb5b6df",
"incidentSamples": null,
"indicatorSamples": null,
"instanceIds": null,
"itemVersion": "",
"keyTypeMap": {},
"locked": false,
"logicalVersion": 5,
"mapping": {
"Cyberint Incident": {
"dontMapEventToLabels": true,
"internalMapping": {
"closure_reason": {
"simple": "cyberintclosurereason"
},
"closure_reason_description": {
"simple": "cyberintclosurereasondescription"
},
"mirror_direction": {
"simple": "dbotMirrorDirection"
},
"mirror_instance": {
"simple": "dbotMirrorInstance"
},
"ref_id": {
"simple": "dbotMirrorId"
},
"status": {
"simple": "cyberintstatus"
}
}
}
},
"name": "Cyberint Outgoing (mapper)",
"nameRaw": "Cyberint Outgoing (mapper)",
"packID": "",
"packName": "",
"propagationLabels": [
"all"
],
"sourceClassifierId": "",
"system": false,
"toServerVersion": "",
"transformer": {},
"type": "mapping-outgoing",
"unclassifiedCases": null,
"version": -1
}
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-CyberInt_File_Type.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"id": "incident_cyberintfiletype",
"isReadOnly": false,
"locked": false,
"name": "CyberInt File Type",
"name": "Cyberint File Type",
"neverSetAsRequired": false,
"openEnded": false,
"ownerOnly": false,
Expand Down
4 changes: 2 additions & 2 deletions Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Related_entity.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"id": "incident_cyberintrelatedentity",
"version": -1,
"name": "CyberInt Related Entity",
"name": "Cyberint Related Entity",
"ownerOnly": false,
"cliName": "cyberintrelatedentity",
"type": "multiSelect",
Expand All @@ -27,4 +27,4 @@
"threshold": 72,
"fromVersion": "6.0.0",
"openEnded": true
}
}
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Brands.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"id": "incident_cyberinttargetedbrands",
"version": -1,
"name": "CyberInt Targeted Brands",
"name": "Cyberint Targeted Brands",
"ownerOnly": false,
"cliName": "cyberinttargetedbrands",
"type": "multiSelect",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Vectors.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"id": "incident_cyberinttargetedvectors",
"version": -1,
"name": "CyberInt Targeted Vectors",
"name": "Cyberint Targeted Vectors",
"ownerOnly": false,
"cliName": "cyberinttargetedvectors",
"type": "multiSelect",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"id": "incident_cyberintclosurereason",
"isReadOnly": false,
"locked": false,
"name": "CyberInt Closure reason",
"name": "Cyberint Closure reason",
"neverSetAsRequired": false,
"openEnded": false,
"ownerOnly": false,
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason_Description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": true,
"unsearchable": false,
"useAsKpi": false,
"version": -1,
"fromVersion": "6.0.0"
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Alert_ID.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberintalertid",
"version": -1,
"modified": "2021-02-22T21:50:43.871414193+02:00",
"name": "CyberInt Alert ID",
"name": "Cyberint Alert ID",
"ownerOnly": false,
"cliName": "cyberintalertid",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Confidence.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberintconfidence",
"version": -1,
"modified": "2021-02-22T21:51:24.438436947+02:00",
"name": "CyberInt Confidence",
"name": "Cyberint Confidence",
"ownerOnly": false,
"cliName": "cyberintconfidence",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberintdescription",
"version": -1,
"modified": "2021-02-22T21:51:53.226184184+02:00",
"name": "CyberInt Description",
"name": "Cyberint Description",
"ownerOnly": false,
"cliName": "cyberintdescription",
"type": "shortText",
Expand Down
30 changes: 30 additions & 0 deletions Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_ID.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"id": "incident_id",
"version": -1,
"modified": "2024-10-27T20:50:43.871414193+02:00",
"name": "Alert URL ID",
"ownerOnly": false,
"cliName": "id",
"type": "shortText",
"closeForm": false,
"editForm": true,
"required": false,
"neverSetAsRequired": false,
"isReadOnly": false,
"useAsKpi": false,
"locked": false,
"system": false,
"content": true,
"group": 0,
"hidden": false,
"associatedTypes": [
"Cyberint Incident"
],
"associatedToAll": false,
"unmapped": false,
"unsearchable": false,
"caseInsensitive": true,
"sla": 0,
"threshold": 72,
"fromVersion": "6.0.0"
}
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Tags.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberinttags",
"version": -1,
"modified": "2021-02-22T21:54:24.562891889+02:00",
"name": "CyberInt Tags",
"name": "Cyberint Tags",
"ownerOnly": false,
"cliName": "cyberinttags",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Threat_Actor.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberintthreatactor",
"version": -1,
"modified": "2021-02-22T21:55:13.479151489+02:00",
"name": "CyberInt Threat Actor",
"name": "Cyberint Threat Actor",
"ownerOnly": false,
"cliName": "cyberintthreatactor",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Ticket_ID.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberintticketid",
"version": -1,
"modified": "2021-02-22T21:55:22.750862583+02:00",
"name": "CyberInt Ticket ID",
"name": "Cyberint Ticket ID",
"ownerOnly": false,
"cliName": "cyberintticketid",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Title.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberinttitle",
"version": -1,
"modified": "2021-02-22T21:55:35.77661741+02:00",
"name": "CyberInt Title",
"name": "Cyberint Title",
"ownerOnly": false,
"cliName": "cyberinttitle",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Type.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberinttype",
"version": -1,
"modified": "2021-02-22T21:56:26.928862533+02:00",
"name": "CyberInt Type",
"name": "Cyberint Type",
"ownerOnly": false,
"cliName": "cyberinttype",
"type": "shortText",
Expand Down
2 changes: 1 addition & 1 deletion Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Vulnerable_CName_Record.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"id": "incident_cyberinvulnerablecnamerecord",
"version": -1,
"modified": "2021-02-22T21:50:43.871414193+02:00",
"name": "CyberInt Vulnerable CName Record",
"name": "Cyberint Vulnerable CName Record",
"ownerOnly": false,
"cliName": "vulnerablecnamerecord",
"type": "shortText",
Expand Down
Loading