Cyfirma
CYFIRMA is a cybersecurity platform that provides threat intelligence to help organizations anticipate and mitigate cyber risks.
CYFIRMA is a leading cyber threat intelligence platform that provides proactive insights into potential threats. The CYFIRMA connector for Swimlane Turbine enables users to access Indicators of Compromise (IOCs) in STIX 1.1 JSON format, allowing for seamless integration into security workflows. By leveraging this connector, Swimlane Turbine users can automate the retrieval of critical threat intelligence, enhancing their ability to respond to emerging threats swiftly and effectively. This integration empowers security teams to maintain a proactive security posture by accessing timely and relevant threat data directly within their automation playbooks.
Prerequisites
Before you can use the CYFIRMA connector for Turbine, you'll need access to the CYFIRMA API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint URL for accessing CYFIRMA's API services.
- Key: Your unique API key for authenticating requests to CYFIRMA.
CYFIRMA is an external threat landscape management platform company offering predictive threat visibility and intelligence.
Capabilities
This connector provides the following capabilities:
- Get IOC
Asset Setup
The CYFIRMA asset requires an URL and an API Key to interact with the API.
Additional Documentation
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
key | key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get IOC
Provides Indicators of Compromise (IOCs) in STIX 1.1 JSON format from CYFIRMA, requiring parameters such as delta and all.
Endpoint
- URL: /core/api-ua/threatioc/stix-json
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.delta | boolean | Required | true - will return only the IOCs that were added in the platform after the last API call. false - will return the IOCs that were added in the system in the last 24 hours. |
parameters.all | boolean | Required | true - will return all the IOCs irrespective of whether it has been linked to the client. false - will return only those IOCs that have been linked to the client. |
Input Example
{"parameters":{"delta":true,"all":false}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
observables | object | Output field: observables |
indicators | object | Output field: indicators |
indicators.indicators | array | Output field: indicators.indicators |
exploitTargets | object | Output field: exploitTargets |
incidents | object | Unique identifier |
coursesOfAction | object | Output field: coursesOfAction |
campaigns | object | Output field: campaigns |
threatActors | object | Output field: threatActors |
reports | object | Output field: reports |
relatedPackages | object | Output field: relatedPackages |
id | string | Unique identifier |
idref | object | Unique identifier |
timestamp | string | Output field: timestamp |
version | string | Output field: version |
stixheader | object | Output field: stixheader |
stixheader.title | object | Output field: stixheader.title |
stixheader.packageIntents | array | Output field: stixheader.packageIntents |
stixheader.descriptions | array | Output field: stixheader.descriptions |
stixheader.descriptions.value | string | Value for the parameter |
stixheader.descriptions.id | object | Unique identifier |
stixheader.descriptions.ordinality | object | Output field: stixheader.descriptions.ordinality |
stixheader.descriptions.structuringFormat | object | Output field: stixheader.descriptions.structuringFormat |
stixheader.shortDescriptions | array | Output field: stixheader.shortDescriptions |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 30 Oct 2023 17:08:47 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","Content-Encoding":"gzip","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-se...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate |
CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC |
CF-RAY | HTTP response header: CF-RAY | 81e54323fddf9a90-NAG |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
content-security-policy | HTTP response header: content-security-policy | default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com https://d3js.org https://cdn.ckeditor.com https://www.amcharts.com https://cdn.amcharts.com https://d3js.org/d3.v4.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://www.amcharts.com https://d3js.org https://cdn.ckeditor.com; img-src * 'self' data:; font-src * 'self' data: |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Mon, 30 Oct 2023 17:08:47 GMT |
expires | The date/time after which the response is considered stale | 0 |
permissions-policy | HTTP response header: permissions-policy | camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(), accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self) |
pragma | HTTP response header: pragma | no-cache |
referrer-policy | HTTP response header: referrer-policy | strict-origin-when-cross-origin |
Server | Information about the software used by the origin server | cloudflare |
strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000 ; includeSubDomains, max-age=63072000; includeSubDomains; preload |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
vary | HTTP response header: vary | Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers |
x-content-type-options | HTTP response header: x-content-type-options | nosniff, nosniff |
x-frame-options | HTTP response header: x-frame-options | DENY, DENY |
x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block, 1; mode=block |