Cybersixgill

Cybersixgill is a threat intelligence platform that provides real-time insights into cyber threats from the deep and dark web.

Cybersixgill is a leading threat intelligence platform that provides real-time insights into cyber threats from the deep and dark web. This connector enables Swimlane Turbine users to seamlessly integrate Cybersixgill's actionable intelligence into their security operations. By leveraging this integration, users can automate the retrieval, update, and deletion of actionable alerts, conduct threat analysis, and engage with Cybersixgill's IQ for enhanced threat detection and response. This empowers security teams to streamline their workflows, enhance threat visibility, and respond to threats more efficiently.

Prerequisites

Before you can use the Cybersixgill connector for Turbine, you'll need access to the Cybersixgill API. This requires the following:

OAuth 2.0 client credentials authentication using the following parameters:

URL: The endpoint for accessing Cybersixgill's API services.

Client ID: Your unique identifier for authenticating API requests.

Client Secret: A secret key used in conjunction with the Client ID to authenticate API requests.

Capabilities

This connector provides the following capabilities:

Get actionable alerts by ID.

Deletes a list of actionable alerts by ID.

Updates a list of actionable alerts by ID.

Get actionable alerts statistics per user.

Gets an actionable alert by ID.

Deletes an actionable alert by ID.

Updates an actionable alert by ID.

IQ/Chat - Enter a question and return a response.

IQ/Chat by Request ID.

Additional Documentation

Cybersixgill Connector Documentation

Cybersixgill API Documentation

Cybersixgill Authentication Guide

Configurations

Cybersixgill Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Delete Actionable Alert by ID

Remove a specified actionable alert from Cybersixgill using the unique alert ID provided as a path parameter.

Endpoint

URL: /alerts/actionable_alert/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Delete Actionable Alert by ID action

Input Example

{"path_parameters":{"id":"5fbcfeb23a5ce900013de081"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items_modified	array	Output field: items_modified
items_modified_count	number	Count value
message	string	Response message
status	number	Status value

Output Example

{"items_modified":["5fbcfeb23a5ce900013de081"],"items_modified_count":1,"message":"Successfully deleted 5fbcfeb23a5ce900013de081","status":200}

Delete Actionable Alerts

Remove specified actionable alerts from Cybersixgill using a list of IDs and optional filters. Requires data_body input.

Endpoint

URL: /alerts/actionable-alert

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.organization_id	string	Optional	Parameters for the Delete Actionable Alerts action
parameters.is_read	string	Optional	Parameters for the Delete Actionable Alerts action
parameters.threat_level	string	Optional	Parameters for the Delete Actionable Alerts action
parameters.threat_type	string	Optional	Parameters for the Delete Actionable Alerts action
data_body	string	Required	Response data

Input Example

{"parameters":{"organization_id":"string","is_read":"unread","threat_level":"emerging","threat_type":"string"},"data_body":"[\"5ebc3929a4a7e300012365ae\"]"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items_modified_count	number	Count value
message	string	Response message
status	number	Status value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified_count":1,"message":"Successfully deleted 1 Actionable Alerts","status":200}}

Get Actionable Alert by ID

Retrieve a specific actionable alert from Cybersixgill using the unique alert ID provided in the path parameters.

Endpoint

URL: /alerts/actionable_alert/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.organization_id	string	Optional	Parameters for the Get Actionable Alert by ID action
path_parameters.id	string	Required	Parameters for the Get Actionable Alert by ID action

Input Example

{"parameters":{"organization_id":"string"},"path_parameters":{"id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
additional_info	object	Output field: additional_info
additional_info.asset_attributes	array	Output field: additional_info.asset_attributes
additional_info.date	string	Date value
additional_info.matched_organization_aliases	array	Output field: additional_info.matched_organization_aliases
additional_info.matched_organization_aliases.file_name	string	Name of the resource
additional_info.matched_organization_aliases.file	string	Output field: additional_info.matched_organization_aliases.file
additional_info.organization_aliases	array	Output field: additional_info.organization_aliases
additional_info.organization_name	string	Name of the resource
additional_info.post_attributes	array	Output field: additional_info.post_attributes
additional_info.query_attributes	array	Output field: additional_info.query_attributes
additional_info.site	string	Output field: additional_info.site
additional_info.template_id	string	Unique identifier
alert_id	string	Unique identifier
alert_name	string	Name of the resource
assessment	string	Output field: assessment
category	string	Output field: category
content_type	string	Type of the resource
description	string	Output field: description
es_id	string	Unique identifier
es_item	object	Output field: es_item
es_item.category	string	Output field: es_item.category
es_item.channel_message_id	number	Unique identifier
es_item.collection_date	string	Date value

Output Example

{"additional_info":{"asset_attributes":["string"],"date":"2024-01-01T00:00:00Z","matched_organization_aliases":[{}],"organization_aliases":["string"],"organization_name":"Example Name","post_attributes":["string"],"query_attributes":["string"],"site":"string","template_id":"string"},"alert_id":"string","alert_name":"Example Name","assessment":"string","category":"string","content_type":"string","description":"string","es_id":"string","es_item":{"category":"string","channel_message_id":123,"colle...

Get Actionable Alert Stats per User

Retrieve statistics for actionable alerts on a per-user basis in Cybersixgill.

Endpoint

URL: /alerts/actionable_alert/stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.organization_id	string	Optional	Parameters for the Get Actionable Alert Stats per User action
parameters.threat_level	string	Optional	Parameters for the Get Actionable Alert Stats per User action

Input Example

{"parameters":{"organization_id":"string","threat_level":"emerging"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
by_threat_level	object	Output field: by_threat_level
by_threat_level.emerging	number	Output field: by_threat_level.emerging
by_threat_level.imminent	number	Output field: by_threat_level.imminent
by_threat_type	object	Type of the resource
by_threat_type.Brand Protection	number	Type of the resource
by_threat_type.Compromised Accounts	number	Type of the resource
by_threat_type.DDoS Attack	number	Type of the resource
by_threat_type.Data Leak	number	Response data
by_threat_type.Defacement	number	Type of the resource
by_threat_type.Fraud	number	Type of the resource
by_threat_type.Malware	number	Type of the resource
by_threat_type.Phishing	number	Type of the resource
by_threat_type.Vulnerability Exploit	number	Type of the resource
by_threat_type.Web Attack	number	Type of the resource
total	number	Output field: total

Output Example

{"by_threat_level":{"emerging":140,"imminent":360},"by_threat_type":{"Brand Protection":9,"Compromised Accounts":48,"DDoS Attack":96,"Data Leak":49,"Defacement":97,"Fraud":164,"Malware":9,"Phishing":82,"Vulnerability Exploit":129,"Web Attack":96},"total":500}

Get Actionable Alerts

Retrieve a list of actionable alerts from Cybersixgill using optional filters to refine results.

Endpoint

URL: /alerts/actionable-alert

Method: GET

Input

Argument Name	Type	Required	Description
parameters.alert_type_id	string	Optional	Parameters for the Get Actionable Alerts action
parameters.organization_id	string	Optional	Parameters for the Get Actionable Alerts action
parameters.sort_by	string	Optional	Parameters for the Get Actionable Alerts action
parameters.sort_order	string	Optional	Parameters for the Get Actionable Alerts action
parameters.offset	string	Optional	Parameters for the Get Actionable Alerts action
parameters.fetch_size	string	Optional	Parameters for the Get Actionable Alerts action
parameters.from_date	string	Optional	Parameters for the Get Actionable Alerts action
parameters.to_date	string	Optional	Parameters for the Get Actionable Alerts action
parameters.is_read	string	Optional	Parameters for the Get Actionable Alerts action
parameters.threat_level	string	Optional	Parameters for the Get Actionable Alerts action
parameters.threat_type	string	Optional	Parameters for the Get Actionable Alerts action

Input Example

{"parameters":{"alert_type_id":"string","organization_id":"string","sort_by":"date","sort_order":"asc","offset":"200","fetch_size":"50","from_date":"YYYY-MM-DD","to_date":"YYYY-MM-DD","is_read":"unread","threat_level":"imminent","threat_type":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"alert_name":"RogueAppAlert","category":"regular","content":"String","date":"2020-05-13 18:15:05","id":"5ebc3929a4a7e300012365ae","read":false,"severity":10,"threat_level":"imminent","threats":["Data Leak","Brand Protection","Phishing"],"title":"An App Matching JJ Halen Assets was Found in an App Store","user_id":"5d2336aef8db38787dbe4f69"}

IQ Chat

Pose a question to Cybersixgill's IQ and receive relevant answers. Requires a 'query' in the JSON body.

Endpoint

URL: /iq/chat

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Parameter for IQ Chat
add_references	boolean	Optional	Parameter for IQ Chat

Input Example

{"json_body":{"query":"Is there a CVE related to the BlackLotus malware?","add_references":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
answer	string	Output field: answer
request_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"answer":"Yes, there is a CVE related to the BlackLotus malware. The CVE is CVE2022-21894....","request_id":"846c19a4-a70c-4595-ac19-a4a70c9595d4"}}

IQ Chat by Request ID

Retrieve query results applicable to your organization using the ID from a previous iq/chat request in Cybersixgill. Requires answer_request_id in the JSON body.

Endpoint

URL: /iq/chat/my_organization

Method: POST

Input

Argument Name	Type	Required	Description
answer_request_id	string	Optional	Unique identifier

Input Example

{"json_body":{"answer_request_id":"5607113f-b7e2-4a50-adcb-7f1634baa228"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
answer	string	Output field: answer
request_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"answer":"string","request_id":"fc01ca85-f074-4e84-81ca-85f074be8442"}}

Update Actionable Alert by ID

Update a specific actionable alert in Cybersixgill using its unique ID, modifying parameters such as read status, threat level, and current status.

Endpoint

URL: /alerts/actionable_alert/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Actionable Alert by ID action
parameters.organization_id	string	Optional	Parameters for the Update Actionable Alert by ID action
read	string	Optional	Parameter for Update Actionable Alert by ID
threat_level	string	Optional	Parameter for Update Actionable Alert by ID
status	string	Optional	Status value

Input Example

{"parameters":{"organization_id":"string"},"json_body":{"read":"read","threat_level":"emerging","status":"resolved"},"path_parameters":{"id":"5fbcfeb23a5ce900013de081"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items_modified	array	Output field: items_modified
items_modified_count	number	Count value
message	string	Response message
status	number	Status value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified":["5fbcfeb23a5ce900013de081"],"items_modified_count":1,"message":"Successfully deleted 5fbcfeb23a5ce900013de081","status":200}}

Update Actionable Alerts

Update Cybersixgill actionable alerts by ID, with options to mark them as read or unread and change their treatment status.

Endpoint

URL: /alerts/actionable-alert

Method: PATCH

Input

Argument Name	Type	Required	Description
parameters.organization_id	string	Optional	Parameters for the Update Actionable Alerts action
id_list	array	Optional	Unique identifier
set_read	string	Optional	Parameter for Update Actionable Alerts
threat_level	string	Optional	Parameter for Update Actionable Alerts
threat_type	string	Optional	Type of the resource

Input Example

{"parameters":{"organization_id":"string"},"json_body":{"id_list":["5fb4c6a6d604c200010f0916"],"set_read":"read","threat_level":"emerging","threat_type":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items_modified_count	number	Count value
message	string	Response message
status	number	Status value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified_count":1,"message":"Successfully updated 1 Actionable Alerts","status":200}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT