Cyberint

Cyberint is a cybersecurity platform that provides advanced threat intelligence and protection services.

Cyberint is a leading threat intelligence platform that provides comprehensive insights into cyber threats and vulnerabilities. The Cyberint connector for Swimlane Turbine enables seamless integration to automate the retrieval and analysis of threat intelligence data. This integration empowers security teams to efficiently manage alerts, enrich threat data, and update alert statuses, enhancing the overall security posture and response capabilities within the Swimlane platform.

Prerequisites

Before you can use the Cyberint connector for Turbine, you'll need access to the Cyberint API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing Cyberint's API.

API Key: A unique key provided by Cyberint to authenticate API requests.

Capabilities

This plugin provides the following capabilities:

Capabilities

Here

e.g. Manage Firewall Policies instead of listing each individual tasks

Limitations

Include information about known limitations here, including supported or minimum versions, especially known unsupported versions.

Asset Setup

The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors.

Tasks Setup

Special task setup as needed depending on plugin, exclude if empty.

Known available allowed input options from enum type selection

Notes

Any other notes not fitting other sections go here.

Any reference URLs to external docs or other resources

Additional Documentation

Cyberint Connector Documentation

Cyberint API Documentation

Cyberint Authentication Guide

Configurations

Cyberint API Key Authentication

Authenticates Cyberint using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
access_token	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Download Daily IOC Feed by Type and Activity

Download a daily JSON-Lines document from Cyberint by specifying the desired date, IOC type, and detected activity.

Endpoint

URL: /ioc/api/v1/feed/daily

Method: GET

Input

Argument Name	Type	Required	Description
parameters.detected_activity	string	Required	Parameters for the Download Daily IOC Feed by Type and Activity action
parameters.ioc_type	string	Required	Parameters for the Download Daily IOC Feed by Type and Activity action
parameters.date	string	Required	Parameters for the Download Daily IOC Feed by Type and Activity action
parameters.format	string	Optional	Parameters for the Download Daily IOC Feed by Type and Activity action

Input Example

{"parameters":{"detected_activity":"malware_payload","ioc_type":"ipv4","date":"2024-02-28","format":"json1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	array	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}

Get Alert Analysis Report

Retrieve an analysis report for a specific alert in Cyberint using the alert reference ID.

Endpoint

URL: /alert/api/v1/alerts/{{alert_ref_id}}/analysis_report

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_ref_id	string	Required	Alert Ref Id

Input Example

{"path_parameters":{"alert_ref_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
status	string	Status value
file	array	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"status_code":302,"status":"OK","response_headers":{},"json_body":{}}

Get Alert Attachment

Retrieve an attachment from Cyberint using the alert reference ID and attachment internal ID.

Endpoint

URL: /alert/api/v1/alerts/{{alert_ref_id}}/attachments/{{attachment_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_ref_id	string	Required	Alert Ref Id
path_parameters.attachment_id	string	Required	Attachment Id

Input Example

{"path_parameters":{"alert_ref_id":"string","attachment_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
status	string	Status value
file	array	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"status_code":302,"status":"OK","response_headers":{},"file":[]}

Get Alerts

Retrieve up to 100 alerts from Cyberint, sorted by modification date. Use filters like modification_date and created_date for specific results, or get alerts modified in the past 24 hours if no filters are applied.

Endpoint

URL: /alert/api/v1/alerts

Method: POST

Input

Argument Name	Type	Required	Description
page	number	Optional	Page number to retrieve
size	number	Optional	Number of alerts per page
filters	object	Optional	Filters to retrieve alerts by
filters.created_date	object	Optional	Query alerts by creation date if specified
filters.created_date.from	string	Required	Parameter for Get Alerts
filters.created_date.to	string	Required	Parameter for Get Alerts
filters.modification_date	object	Optional	Query alerts by modification date if specified
filters.modification_date.from	string	Required	Parameter for Get Alerts
filters.modification_date.to	string	Required	Parameter for Get Alerts
filters.environments	array	Optional	Filter alerts by environments. If not specified, retrieves all alerts in customer environment and all sub environments.
filters.status	array	Optional	Filter alerts by status
filters.severity	array	Optional	Filter alerts by severity
filters.type	array	Optional	Filter alerts by type

Input Example

{"json_body":{"page":1,"size":10,"filters":{"created_date":{"from":"2019-08-24T14:15:22Z","to":"2019-08-24T14:15:22Z"},"modification_date":{"from":"2019-08-24T14:15:22Z","to":"2019-08-24T14:15:22Z"},"environments":["string"],"status":["open"],"severity":["low"],"type":["refund_fraud"]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
status	string	Status value
total	number	Output field: total
alerts	array	Output field: alerts
alerts.environment	string	Output field: alerts.environment
alerts.ref_id	string	Unique identifier
alerts.confidence	number	Unique identifier
alerts.status	string	Status value
alerts.severity	string	Output field: alerts.severity
alerts.created_date	string	Date value
alerts.created_by	object	Output field: alerts.created_by
alerts.created_by.email	string	Output field: alerts.created_by.email
alerts.category	string	Output field: alerts.category
alerts.type	string	Type of the resource
alerts.source_category	string	Output field: alerts.source_category
alerts.source	string	Output field: alerts.source
alerts.targeted_vectors	array	Output field: alerts.targeted_vectors
alerts.targeted_vectors.file_name	string	Name of the resource
alerts.targeted_vectors.file	string	Output field: alerts.targeted_vectors.file
alerts.targeted_brands	array	Output field: alerts.targeted_brands
alerts.targeted_brands.file_name	string	Name of the resource
alerts.targeted_brands.file	string	Output field: alerts.targeted_brands.file
alerts.related_entities	array	Output field: alerts.related_entities
alerts.related_entities.file_name	string	Name of the resource
alerts.related_entities.file	string	Output field: alerts.related_entities.file

Output Example

{"status_code":200,"status":"OK","response_headers":{},"json_body":{"total":0,"alerts":[{}]}}

Get Domain IOC

Retrieve domain indicators of compromise (IOC) from Cyberint using specified parameters and value.

Endpoint

URL: /ioc/api/v1/domain

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	Parameters for the Get Domain IOC action

Input Example

{"parameters":{"value":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.entity	object	Response data
data.entity.type	string	Response data
data.entity.value	string	Response data
data.risk	object	Response data
data.risk.malicious_score	number	Response data
data.risk.detected_activities	array	Response data
data.risk.detected_activities.type	string	Response data
data.risk.detected_activities.observation_date	string	Response data
data.risk.detected_activities.description	string	Response data
data.risk.detected_activities.confidence	number	Response data
data.risk.detected_activities.occurrences_count	number	Response data
data.risk.occurrences_count	number	Response data
data.enrichment	object	Response data
data.enrichment.ips	array	Response data
data.enrichment.whois	object	Response data
data.enrichment.whois.registrant_name	string	Response data
data.enrichment.whois.registrant_email	string	Response data
data.enrichment.whois.registrant_organization	string	Response data
data.enrichment.whois.registrant_country	string	Response data
data.enrichment.whois.registrant_telephone	string	Response data
data.enrichment.whois.technical_contact_email	string	Response data
data.enrichment.whois.technical_contact_name	string	Response data

Output Example

{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}

Get Enriched CVE

Retrieve enriched Common Vulnerabilities and Exposures (CVE) details from Cyberint using the specified CVE ID.

Endpoint

URL: /cve-intel/get_enriched_cve/{{cve_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.cve_id	string	Required	CVE ID

Input Example

{"path_parameters":{"cve_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
status	string	Status value
data	object	Response data
data.id	string	Response data
data.cve	object	Response data
data.configurations	object	Response data
data.impact	object	Response data
data.published_date	string	Response data
data.last_modified_date	string	Response data
data.cyberint_score	number	Response data
data.research_content	object	Response data
data.known_exploited_vulnerability	boolean	Response data
data.epss	object	Response data
data.cwes	array	Response data
data.indicators	array	Response data
data.tags	array	Response data
data.indicators_histogram	object	Response data

Output Example

{"status_code":200,"status":"OK","response_headers":{},"json_body":{"data":{"id":"string","cve":{},"configurations":{},"impact":{},"published_date":"2019-08-24T14:15:22Z","last_modified_date":"2019-08-24T14:15:22Z","cyberint_score":10,"research_content":{},"known_exploited_vulnerability":true,"epss":{},"cwes":[],"indicators":[],"tags":[],"indicators_histogram":{}}}}

Get File SHA256 IOC

Retrieve the SHA256 Indicator of Compromise (IOC) for a specified file in Cyberint using the provided parameters, including the value.

Endpoint

URL: /ioc/api/v1/file/sha256

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	Parameters for the Get File SHA256 IOC action

Input Example

{"parameters":{"value":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.entity	object	Response data
data.entity.type	string	Response data
data.entity.value	string	Response data
data.risk	object	Response data
data.risk.malicious_score	number	Response data
data.risk.detected_activities	array	Response data
data.risk.detected_activities.type	string	Response data
data.risk.detected_activities.observation_date	string	Response data
data.risk.detected_activities.description	string	Response data
data.risk.detected_activities.confidence	number	Response data
data.risk.detected_activities.occurrences_count	number	Response data
data.risk.occurrences_count	number	Response data
data.enrichment	object	Response data
data.enrichment.filenames	array	Response data
data.enrichment.first_seen	string	Response data
data.enrichment.download_urls	array	Response data

Output Example

{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}

Get IPv4 IOC

Retrieve information on an IPv4 Indicator of Compromise (IOC) from Cyberint using the specified value parameter.

Endpoint

URL: /ioc/api/v1/ipv4

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	Parameters for the Get IPv4 IOC action

Input Example

{"parameters":{"value":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.entity	object	Response data
data.entity.type	string	Response data
data.entity.value	string	Response data
data.risk	object	Response data
data.risk.malicious_score	number	Response data
data.risk.detected_activities	array	Response data
data.risk.detected_activities.type	string	Response data
data.risk.detected_activities.observation_date	string	Response data
data.risk.detected_activities.description	string	Response data
data.risk.detected_activities.confidence	number	Response data
data.risk.detected_activities.occurrences_count	number	Response data
data.risk.occurrences_count	number	Response data
data.enrichment	object	Response data
data.enrichment.geo	object	Response data
data.enrichment.geo.country	string	Response data
data.enrichment.geo.city	string	Response data
data.enrichment.asn	object	Response data
data.enrichment.asn.number	number	Response data
data.enrichment.asn.organization	string	Response data
data.enrichment.suspicious_urls	array	Response data
data.enrichment.suspicious_domains	array	Response data

Output Example

{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}

Get URL IOC

Retrieve URL Indicators of Compromise (IOC) from Cyberint using specified parameters, including the value parameter.

Endpoint

URL: /ioc/api/v1/url

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	Parameters for the Get URL IOC action

Input Example

{"parameters":{"value":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.entity	object	Response data
data.entity.type	string	Response data
data.entity.value	string	Response data
data.risk	object	Response data
data.risk.malicious_score	number	Response data
data.risk.detected_activities	array	Response data
data.risk.detected_activities.type	string	Response data
data.risk.detected_activities.observation_date	string	Response data
data.risk.detected_activities.description	string	Response data
data.risk.detected_activities.confidence	number	Response data
data.risk.detected_activities.occurrences_count	number	Response data
data.risk.occurrences_count	number	Response data
data.enrichment	object	Response data
data.enrichment.ips	array	Response data
data.enrichment.hostname	string	Response data
data.enrichment.domain	string	Response data

Output Example

{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}

Update Alert Status

Update the status of up to 100 alerts in Cyberint. Requires alert_ref_ids and data in JSON body, with a closure reason if setting status to 'Close'.

Endpoint

URL: /alert/api/v1/alerts/status

Method: PUT

Input

Argument Name	Type	Required	Description
alert_ref_ids	array	Optional	ref id of the requested alerts
data	object	Optional	Response data
data.status	string	Optional	Desired status to update for the alerts
data.closure_reason	string	Optional	Reason for updating the alerts status to close

Input Example

{"json_body":{"alert_ref_ids":["1","2"],"data":{"status":"closed","closure_reason":"resolved"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
status	string	Status value

Output Example

{"status_code":200,"status":"OK","response_headers":{},"json_body":{}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT