Skip to content

Recordedfuture threathunting v2.5.0 #29641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 13, 2023
Merged

Recordedfuture threathunting v2.5.0 #29641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7c95c7d
Recordedfuture threathunting v2.5.0 (#29025)
nestoor22 Sep 12, 2023
e496435
Minor README fixes
MichaelYochpaz Sep 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
113 changes: 113 additions & 0 deletions Packs/RecordedFuture/Integrations/RecordedFuture/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1154,6 +1154,119 @@ Search for a malware by specified filters.
| RecordedFuture.Malware.type | string | Recorded Future entity type \(always = "Malware"\). |
| RecordedFuture.Malware.intelCard | date | Recorded Future intelligence card URL. |


#### Base Command

`recordedfuture-threat-map`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| actors_ids | Actors IDs for which to get the threat map | Optional |
| actor_name | Actors name for which to get the threat map | Optional |
| include_links | Fetch links to threat actor or not | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
|--------------------------------------|----------|-------------------------------------------|
| RecordedFuture.ThreatMap.id | string | Recorded Future threat actor ID. |
| RecordedFuture.ThreatMap.name | string | Recorded Future entity name. |
| RecordedFuture.ThreatMap.alias | array | Recorded Future threat actor alias. |
| RecordedFuture.ThreatMap.intent | number | Recorded Future threat actor intent. |
| RecordedFuture.ThreatMap.id | string | Recorded Future threat actor ID. |
| RecordedFuture.ThreatMap.opportunity | number | Recorded Future threat actor opportunity. |
| RecordedFuture.ThreatMap.log_entries | array | Recorded Future threat actor log entries. |
| RecordedFuture.ThreatMap.links | array | Recorded Future threat actor links. |


#### Base Command

`recordedfuture-threat-links`

#### Input

| **Argument Name** | **Description** | **Required** |
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|
| entity_type | Type of the entity to fetch links for. E.g. "domain", "ip", "file", "url", "cve", "malware", "organization, "person". Should be provided along with the entity in entity_name argument. | Optional |
| entity_name | Name of the entity to fetch links for | Optional |
| entity_id | ID of entity to fetch links for | Optional |
| source_type | Source of the links to be fetched. Can be "insikt" or "technical" | Optional |
| timeframe | Time range of the links to be fetched. Eg. "-1d" for last 1 day | Optional |
| technical_type | Type of technical source to fetch links from. Can be "type:MalwareAnalysis", "type:InfrastructureAnalysis", "type:NetworkTrafficAnalysis" or "type:TTPAnalysis" | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
|---------------------------------------|----------|----------------------------------|
| RecordedFuture.Links.entity.id | string | Recorded Future Entity id. |
| RecordedFuture.Links.entity.type | string | Recorded Future Entity type |
| RecordedFuture.Links.links.type | string | Recorded Future link type. |
| RecordedFuture.Links.links.id | string | Recorded Future link id. |
| RecordedFuture.Links.links.name | string | Recorded Future link name. |
| RecordedFuture.Links.links.source | string | Recorded Future link source. |
| RecordedFuture.Links.links.section | string | Recorded Future link section. |
| RecordedFuture.Links.links.attributes | string | Recorded Future link attributes. |


#### Base Command

`recordedfuture-detection-rules`

#### Input

| **Argument Name** | **Description** | **Required** |
|-------------------|--------------------------------------------|--------------|
| entity_type | Type of the entity to fetch links for | Optional |
| entity_name | Name of the entity to fetch links for | Optional |
| entity_id | ID of entity to fetch links for | Optional |
| rule_types | Rule type. Can be "yara", "sigma", "snort" | Optional |
| title | Rule title | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
|---------------------------------------------------|----------|---------------------------------------------|
| RecordedFuture.DetectionRules.id | string | Recorded Future Detection rule id. |
| RecordedFuture.DetectionRules.type | string | Recorded Future Detection rule type. |
| RecordedFuture.DetectionRules.title | string | Recorded Future Detection rule title. |
| RecordedFuture.DetectionRules.description | string | Recorded Future Detection rule description. |
| RecordedFuture.DetectionRules.created | string | Recorded Future link name. |
| RecordedFuture.DetectionRules.updated | string | Recorded Future link source. |
| RecordedFuture.DetectionRules.rules | array | Recorded Future link section. |
| RecordedFuture.DetectionRules.rules.entities | array | Recorded Future link attributes. |
| RecordedFuture.DetectionRules.rules.entities.id | string | Recorded Future link attributes. |
| RecordedFuture.DetectionRules.rules.entities.type | string | Recorded Future link attributes. |
| RecordedFuture.DetectionRules.rules.entities.name | string | Recorded Future link attributes. |
| RecordedFuture.DetectionRules.rules.content | string | Recorded Future link attributes. |
| RecordedFuture.DetectionRules.rules.file_name | string | Recorded Future link attributes. |


#### Base Command

`recordedfuture-collective-insight`

#### Input
#### Input

| **Argument Name** | **Description** | **Required** |
|--------------------|-----------------------------------------------------------------------------------------------------|--------------|
| entity_type | Value that can contain one of the enumerated list of values (ip, hash, domain, vulnerability, url). | Required |
| entity_name | Value of the IOC itself | Required |
| entity_source_type | Used to describe what log source the IOC came from | Optional |
| incident_name | Title of the incident related to the IOC | Optional |
| incident_id | ID of the incident related to the IOC | Optional |
| incident_type | Attack vector associated with the incident (C2, Phishing.. etc) | Optional |
| mitre_codes | List contains one or more MITRE codes associated with the IOC | Optional |
| malware | List contains all known malware associated with the IOCs | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
|-----------------------------------------|----------|-----------------|
| RecordedFuture.CollectiveInsight.status | string | Request status |

## Breaking changes from the previous version of this integration - Recorded Future v2

Renamed the integration setting "Incident Sharing" to "Collective Insights", resetting any previous configuration to this setting.
45 changes: 40 additions & 5 deletions Packs/RecordedFuture/Integrations/RecordedFuture/RecordedFuture.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

import copy
import platform
from typing import *

# flake8: noqa: F402,F405 lgtm

Expand All @@ -12,7 +13,7 @@
# disable insecure warnings
requests.packages.urllib3.disable_warnings() # type: ignore

__version__ = '2.4.3'
__version__ = '2.5.0'


# === === === === === === === === === === === === === === ===
Expand Down Expand Up @@ -282,9 +283,7 @@ def get_single_alert(self) -> dict:
"""Get a single alert"""
return self._call(url_suffix='/v2/alert/lookup')

def get_alerts(
self,
) -> Dict[str, Any]:
def get_alerts(self) -> Dict[str, Any]:
"""Get alerts."""
return self._call(url_suffix='/v2/alert/search')

Expand Down Expand Up @@ -320,6 +319,18 @@ def get_triage(self) -> Dict[str, Any]:
"""SOAR triage lookup."""
return self._call(url_suffix='/v2/lookup/triage')

def get_threat_map(self) -> Dict[str, Any]:
return self._call(url_suffix='/v2/threat/actors')

def get_threat_links(self) -> Dict[str, Any]:
return self._call(url_suffix='/v2/links/search')

def get_detection_rules(self) -> Dict[str, Any]:
return self._call(url_suffix='/v2/detection_rules/search')

def submit_detection_to_collective_insight(self) -> Dict[str, Any]:
return self._call(url_suffix='/v2/collective-insights/detections')


# === === === === === === === === === === === === === === ===
# === === === === === === ACTIONS === === === === === === ===
Expand Down Expand Up @@ -441,13 +452,28 @@ def triage_command(self) -> List[CommandResults]:
response = self.client.get_triage()
return self._process_result_actions(response=response)

def threat_actors_command(self) -> List[CommandResults]:
response = self.client.get_threat_map()
return self._process_result_actions(response=response)

def threat_links_command(self) -> List[CommandResults]:
response = self.client.get_threat_links()
return self._process_result_actions(response=response)

def detection_rules_command(self) -> List[CommandResults]:
response = self.client.get_detection_rules()
return self._process_result_actions(response=response)

def collective_insight_command(self) -> List[CommandResults]:
response = self.client.submit_detection_to_collective_insight()
return self._process_result_actions(response=response)

# === === === === === === === === === === === === === === ===
# === === === === === === === MAIN === === === === === === ==
# === === === === === === === === === === === === === === ===


def main() -> None:
def main() -> None: # pragma: no cover
"""Main method used to run actions."""
try:
demisto_params = demisto.params()
Expand Down Expand Up @@ -525,6 +551,15 @@ def main() -> None:
elif command == 'recordedfuture-threat-assessment':
return_results(actions.triage_command())

elif command == 'recordedfuture-threat-map':
return_results(actions.threat_actors_command())
elif command == 'recordedfuture-threat-links':
return_results(actions.threat_links_command())
elif command == 'recordedfuture-detection-rules':
return_results(actions.detection_rules_command())
elif command == 'recordedfuture-collective-insight':
return_results(actions.collective_insight_command())

except Exception as e:
return_error(message=f'Failed to execute {demisto.command()} command: {str(e)}')

Expand Down
Loading