CybelAngel

Details
Content
Dependencies
Version History

CybelAngel Event Collector receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

The CybelAngel Event Collector integration receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

CybelAngel protects a global network of hundreds of enterprise clients, providing them with advanced EASM protection for enhanced security.

The CybelAngel Event Collector integration receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

CybelAngel protects a global network of hundreds of enterprise clients, providing them with advanced EASM protection for enhanced security.

Classifiers

Name	Description
CybelAngel

Incident Fields

Name	Description
CybelAngel Keywords	Keywords matched in the detection of the incident
CybelAngel Incident ID	ID used to locate Report in CybelAngel platform
CybelAngel Asset Urls	URLs related to the finding
CybelAngel Country Code	Country Code relating to physical location of incident
CybelAngel Incident Type	Type of the incident in question
CybelAngel Samples	Links for sample images to be ingested
CybelAngel Report Type	report type
CybelAngel Module	Module in which the incident belongs to
CybelAngel Tags	Tags on the report
CybelAngel Board	Darkweb Board in which data is detected
CybelAngel Liveness
CybelAngel Solved At	Date the incident has been resolved
CybelAngel Detected At	Date the incident was detected by scanners
CybelAngel Title	Title for the incident Report
CybelAngel Report Content	Entire report content
CybelAngel Risks	Risks attributed to the incident
CybelAngel Registrant Name	Name of the registrar for attributed domain
CybelAngel Screenshots	Links to screenshots of incident data
CybelAngel City	The City attributed to the physical location of incident
CybelAngel Updated At	Date the report was last updated
CybelAngel Sent At	Date the incident report was sent
CybelAngel Investigation ID	Disregard this ID.
CybelAngel UserGroups	UserGroups attributed to the Incident report
CybelAngel Origins	Potential Origin attributed to the incident
CybelAngel Threat	Threat attibuted to an Asset
CybelAngel Sender	Analyst who generated the report
CybelAngel IP	IP address relating to the Incident
CybelAngel Suggestions	Suggestions on how to deal with the incident report
CybelAngel User Session	Session pertaining to Darkweb alerts
CybelAngel Port	Port attributed to the incident
CybelAngel WHOIS	Who is data attributed to the incident
CybelAngel Abstract	Description of the CybelAngel incident
CybelAngel Abuse Email	Abuse email for domain threats
CybelAngel Registrant Email	Email associated to the registration of a domain
CybelAngel Domain Registered At	Date the domain is registered (if domain alert)
CybelAngel Analysis	Additional analysis of the incident in question
CybelAngel MX Servers	MX servers attributed to the incident
CybelAngel Malware Name	Name of malware used to steal user information
CybelAngel Machine Name	Name of infected machine
CybelAngel Malware Location	Location of the Malware on Victim machine
CybelAngel Created At	Date of creation of the incident
CybelAngel Location	Physical Location of host or incident
CybelAngel Severity	Severity of incident
CybelAngel NS Servers	Name servers attributed to the incident
CybelAngel Stream	Steam ID
CybelAngel Source	Source of the incident if applicable
CybelAngel Language	Language of the report
CybelAngel Volume	Collection of additional information relating to the incident

Incident Types

Name	Description
CybelAngel

Integrations

Name	Description
CybelAngel	CybelAngel collects reports from the CybelAngel platform, which specializes in external attack surface protection and management.
CybelAngel EASM (Partner Contribution)	This integration connects your alerts from CybelAngel.

Layouts

Name	Description
CybelAngel

Classifiers

Name	Description
CybelAngel

Incident Fields

Name	Description
CybelAngel Title	Title for the incident Report
CybelAngel Incident ID	ID used to locate Report in CybelAngel platform
CybelAngel UserGroups	UserGroups attributed to the Incident report
CybelAngel Module	Module in which the incident belongs to
CybelAngel Machine Name	Name of infected machine
CybelAngel Severity	Severity of incident
CybelAngel IP	IP address relating to the Incident
CybelAngel Port	Port attributed to the incident
CybelAngel Keywords	Keywords matched in the detection of the incident
CybelAngel Suggestions	Suggestions on how to deal with the incident report
CybelAngel Liveness
CybelAngel Malware Location	Location of the Malware on Victim machine
CybelAngel Samples	Links for sample images to be ingested
CybelAngel Origins	Potential Origin attributed to the incident
CybelAngel Screenshots	Links to screenshots of incident data
CybelAngel Tags	Tags on the report
CybelAngel Registrant Name	Name of the registrar for attributed domain
CybelAngel Stream	Steam ID
CybelAngel Malware Name	Name of malware used to steal user information
CybelAngel Location	Physical Location of host or incident
CybelAngel Registrant Email	Email associated to the registration of a domain
CybelAngel Sent At	Date the incident report was sent
CybelAngel Volume	Collection of additional information relating to the incident
CybelAngel Threat	Threat attibuted to an Asset
CybelAngel Solved At	Date the incident has been resolved
CybelAngel City	The City attributed to the physical location of incident
CybelAngel Language	Language of the report
CybelAngel Investigation ID	Disregard this ID.
CybelAngel Domain Registered At	Date the domain is registered (if domain alert)
CybelAngel Country Code	Country Code relating to physical location of incident
CybelAngel Source	Source of the incident if applicable
CybelAngel Sender	Analyst who generated the report
CybelAngel Report Content	Entire report content
CybelAngel Incident Type	Type of the incident in question
CybelAngel Abstract	Description of the CybelAngel incident
CybelAngel Risks	Risks attributed to the incident
CybelAngel Created At	Date of creation of the incident
CybelAngel Asset Urls	URLs related to the finding
CybelAngel Updated At	Date the report was last updated
CybelAngel MX Servers	MX servers attributed to the incident
CybelAngel Report Type	report type
CybelAngel Board	Darkweb Board in which data is detected
CybelAngel User Session	Session pertaining to Darkweb alerts
CybelAngel WHOIS	Who is data attributed to the incident
CybelAngel NS Servers	Name servers attributed to the incident
CybelAngel Abuse Email	Abuse email for domain threats
CybelAngel Analysis	Additional analysis of the incident in question
CybelAngel Detected At	Date the incident was detected by scanners

Incident Types

Name	Description
CybelAngel

Integrations

Name	Description
CybelAngel EASM (Partner Contribution)	This integration connects your alerts from CybelAngel.
CybelAngel	CybelAngel collects reports from the CybelAngel platform, which specializes in external attack surface protection and management.

Modeling Rules

Name	Description
CybelAngel Platform Modeling Rule

Required Content Packs (6)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Threat Intel Reports (BETA)	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (8)

Pack Name	Pack By
Base	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Threat Intel Reports (BETA)	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

1.1.9 - 8564799 (April 29, 2026)

Integrations

Documentation and metadata improvements.

Related pull requests:
- 44062

Download

1.1.8 - 8515806 (April 27, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43940

Download

1.1.7 - 8210013 (April 13, 2026)

Integrations

CybelAngel

Documentation and metadata improvements.

Related pull requests:
- 43748

Download

1.1.6 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

1.1.5 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.1.4 - 5591931 (October 27, 2025)

Integrations

CybelAngel EASM

Updated the Docker image to: demisto/python3:3.12.12.5490952.

CybelAngel

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41061

Download

1.1.3 - R5469292 (October 20, 2025)

Integrations

CybelAngel EASM

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

1.1.2 - 4206602 (July 17, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40627

Download

1.1.1 - 4193314 (July 16, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40589

Download

1.1.0 - 4029801 (July 1, 2025)

Integrations

CybelAngel

The First fetch timestamp parameter is no longer available.
Added support for fetching new events: Credentials watchlist, Domain watchlist.
Changed the name of The maximum number of events per fetch parameter to The maximum number of reports per fetch.
Added the following parameters:
- Event Types To Fetch.
- The maximum number of Domain watchlist events per fetch.
- The maximum number of Credential watchlist events per fetch.
- Fetch events.
Added support for event_type argument in the cybelangel-get-events command.
Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 39943

Download

1.0.6 - R3980324 (June 26, 2025)

Incident Fields

New: CybelAngel Abstract
New: Added a new incident field- CybelAngel Abstract that Description of the CybelAngel incident
New: CybelAngel Abuse Email
New: Added a new incident field- CybelAngel Abuse Email that Abuse email for domain threats
New: CybelAngel Analysis
New: Added a new incident field- CybelAngel Analysis that Additional analysis of the incident in question
New: CybelAngel Asset Urls
New: Added a new incident field- CybelAngel Asset Urls that URLs related to the finding
New: CybelAngel Board
New: Added a new incident field- CybelAngel Board that Darkweb Board in which data is detected
New: CybelAngel City
New: Added a new incident field- CybelAngel City that The City attributed to the physical location of incident
New: CybelAngel Country Code
New: Added a new incident field- CybelAngel Country Code that Country Code relating to physical location of incident
New: CybelAngel Created At
New: Added a new incident field- CybelAngel Created At that Date of creation of the incident
New: CybelAngel Detected At
New: Added a new incident field- CybelAngel Detected At that Date the incident was detected by scanners
New: CybelAngel Domain Registered At
New: Added a new incident field- CybelAngel Domain Registered At that Date the domain is registered (if domain alert)
New: CybelAngel IP
New: Added a new incident field- CybelAngel IP that IP address relating to the Incident
New: CybelAngel Incident ID
New: Added a new incident field- CybelAngel Incident ID that ID used to locate Report in CybelAngel platform
New: CybelAngel Incident Type
New: Added a new incident field- CybelAngel Incident Type that Type of the incident in question
New: CybelAngel Investigation ID
New: Added a new incident field- CybelAngel Investigation ID that Disregard this ID.
New: CybelAngel Keywords
New: Added a new incident field- CybelAngel Keywords that Keywords matched in the detection of the incident
New: CybelAngel Language
New: Added a new incident field- CybelAngel Language that Language of the report
New: CybelAngel Liveness
New: Added a new incident field- CybelAngel Liveness that shows the live status on an incident.
New: CybelAngel Location
New: Added a new incident field- CybelAngel Location that Physical Location of host or incident
New: CybelAngel MX Servers
New: Added a new incident field- CybelAngel MX Servers that MX servers attributed to the incident
New: CybelAngel Machine Name
New: Added a new incident field- CybelAngel Machine Name that Name of infected machine
New: CybelAngel Malware Location
New: Added a new incident field- CybelAngel Malware Location that Location of the Malware on Victim machine
New: CybelAngel Malware Name
New: Added a new incident field- CybelAngel Malware Name that Name of malware used to steal user information
New: CybelAngel Module
New: Added a new incident field- CybelAngel Module that Module in which the incident belongs to
New: CybelAngel NS Servers
New: Added a new incident field- CybelAngel NS Servers that Name servers attributed to the incident
New: CybelAngel Origins
New: Added a new incident field- CybelAngel Origins that Potential Origin attributed to the incident
New: CybelAngel Port
New: Added a new incident field- CybelAngel Port that Port attributed to the incident
New: CybelAngel Registrant Email
New: Added a new incident field- CybelAngel Registrant Email that Email associated to the registration of a domain
New: CybelAngel Registrant Name
New: Added a new incident field- CybelAngel Registrant Name that Name of the registrar for attributed domain
New: CybelAngel Report Content
New: Added a new incident field- CybelAngel Report Content that Entire report content
New: CybelAngel Report Type
New: Added a new incident field- CybelAngel Report Type that report type
New: CybelAngel Risks
New: Added a new incident field- CybelAngel Risks that Risks attributed to the incident
New: CybelAngel Samples
New: Added a new incident field- CybelAngel Samples that Links for sample images to be ingested
New: CybelAngel Screenshots
New: Added a new incident field- CybelAngel Screenshots that Links to screenshots of incident data
New: CybelAngel Sender
New: Added a new incident field- CybelAngel Sender that Analyst who generated the report
New: CybelAngel Sent At
New: Added a new incident field- CybelAngel Sent At that Date the incident report was sent
New: CybelAngel Severity
New: Added a new incident field- CybelAngel Severity that Severity of incident
New: CybelAngel Solved At
New: Added a new incident field- CybelAngel Solved At that Date the incident has been resolved
New: CybelAngel Source
New: Added a new incident field- CybelAngel Source that Source of the incident if applicable
New: CybelAngel Stream
New: Added a new incident field- CybelAngel Stream that Steam ID
New: CybelAngel Suggestions
New: Added a new incident field- CybelAngel Suggestions that Suggestions on how to deal with the incident report
New: CybelAngel Tags
New: Added a new incident field- CybelAngel Tags that Tags on the report
New: CybelAngel Threat
New: Added a new incident field- CybelAngel Threat that Threat attibuted to an Asset
New: CybelAngel Title
New: Added a new incident field- CybelAngel Title that Title for the incident Report
New: CybelAngel Updated At
New: Added a new incident field- CybelAngel Updated At that Date the report was last updated
New: CybelAngel User Session
New: Added a new incident field- CybelAngel User Session that Session pertaining to Darkweb alerts
New: CybelAngel UserGroups
New: Added a new incident field- CybelAngel UserGroups that UserGroups attributed to the Incident report
New: CybelAngel Volume
New: Added a new incident field- CybelAngel Volume that Collection of additional information relating to the incident
New: CybelAngel WHOIS
New: Added a new incident field- CybelAngel WHOIS that Who is data attributed to the incident

Incident Types

New: CybelAngel
New: Added a new incident type- CybelAngel that maps CybelAngel incident reports to XSOAR incidents.

Integrations

CybelAngel

Updated the CybelAngel Event Collector integration to fetch and interact with CybelAngel api in XSIAM.

CybelAngel EASM

Updated the CybelAngel integration to allow for users to fetch and interact with CybelAngel api in XSOAR.

Layouts

New: CybelAngel
New: Added a new layout- CybelAngel that shows the key attributes of CybelAngel incident.

Mappers

New: CybelAngel

New: Added a new mapper- CybelAngel that maps incident report JSON to CybelAngel Incident type.

Related pull requests:
- 37711
- 39497

Download

1.1.9 - 8564799 (April 29, 2026)

Integrations

CybelAngel

Documentation and metadata improvements.

Related pull requests:
- 44062

Download

1.1.8 - 8542515 (April 28, 2026)

Modeling Rules

CybelAngel Platform Modeling Rule

Documentation and metadata improvements.

Related pull requests:
- 43940

Download

1.1.7 - 8210013 (April 13, 2026)

Integrations

CybelAngel

Documentation and metadata improvements.

Related pull requests:
- 43748

Download

1.1.6 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

1.1.5 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.1.4 - 5591931 (October 27, 2025)

Integrations

CybelAngel EASM

Updated the Docker image to: demisto/python3:3.12.12.5490952.

CybelAngel

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41061

Download

1.1.3 - R5469292 (October 20, 2025)

Integrations

CybelAngel EASM

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

1.1.2 - 4206602 (July 17, 2025)

Modeling Rules

CybelAngel Platform Modeling Rule

Updated the CybelAngel Platform Modeling Rule, added integer casting for the xdm.target.port field.

Related pull requests:
- 40627

Download

1.1.1 - 4193314 (July 16, 2025)

Modeling Rules

CybelAngel Platform Modeling Rule

Updated the CybelAngel Platform modeling rule to support Credential watchlist and Domain watchlist event types.

Related pull requests:
- 40589

Download

1.1.0 - 4029801 (July 1, 2025)

Integrations

CybelAngel

The First fetch timestamp parameter is no longer available.
Added support for fetching new events: Credentials watchlist, Domain watchlist.
Changed the name of The maximum number of events per fetch parameter to The maximum number of reports per fetch.
Added the following parameters:
- Event Types To Fetch.
- The maximum number of Domain watchlist events per fetch.
- The maximum number of Credential watchlist events per fetch.
- Fetch events.
Added support for event_type argument in the cybelangel-get-events command.
Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 39943

Download

1.0.6 - R3980324 (June 26, 2025)

Incident Fields

New: CybelAngel Abstract
New: Added a new incident field- CybelAngel Abstract that Description of the CybelAngel incident
New: CybelAngel Abuse Email
New: Added a new incident field- CybelAngel Abuse Email that Abuse email for domain threats
New: CybelAngel Analysis
New: Added a new incident field- CybelAngel Analysis that Additional analysis of the incident in question
New: CybelAngel Asset Urls
New: Added a new incident field- CybelAngel Asset Urls that URLs related to the finding
New: CybelAngel Board
New: Added a new incident field- CybelAngel Board that Darkweb Board in which data is detected
New: CybelAngel City
New: Added a new incident field- CybelAngel City that The City attributed to the physical location of incident
New: CybelAngel Country Code
New: Added a new incident field- CybelAngel Country Code that Country Code relating to physical location of incident
New: CybelAngel Created At
New: Added a new incident field- CybelAngel Created At that Date of creation of the incident
New: CybelAngel Detected At
New: Added a new incident field- CybelAngel Detected At that Date the incident was detected by scanners
New: CybelAngel Domain Registered At
New: Added a new incident field- CybelAngel Domain Registered At that Date the domain is registered (if domain alert)
New: CybelAngel IP
New: Added a new incident field- CybelAngel IP that IP address relating to the Incident
New: CybelAngel Incident ID
New: Added a new incident field- CybelAngel Incident ID that ID used to locate Report in CybelAngel platform
New: CybelAngel Incident Type
New: Added a new incident field- CybelAngel Incident Type that Type of the incident in question
New: CybelAngel Investigation ID
New: Added a new incident field- CybelAngel Investigation ID that Disregard this ID.
New: CybelAngel Keywords
New: Added a new incident field- CybelAngel Keywords that Keywords matched in the detection of the incident
New: CybelAngel Language
New: Added a new incident field- CybelAngel Language that Language of the report
New: CybelAngel Liveness
New: Added a new incident field- CybelAngel Liveness that shows the live status on an incident.
New: CybelAngel Location
New: Added a new incident field- CybelAngel Location that Physical Location of host or incident
New: CybelAngel MX Servers
New: Added a new incident field- CybelAngel MX Servers that MX servers attributed to the incident
New: CybelAngel Machine Name
New: Added a new incident field- CybelAngel Machine Name that Name of infected machine
New: CybelAngel Malware Location
New: Added a new incident field- CybelAngel Malware Location that Location of the Malware on Victim machine
New: CybelAngel Malware Name
New: Added a new incident field- CybelAngel Malware Name that Name of malware used to steal user information
New: CybelAngel Module
New: Added a new incident field- CybelAngel Module that Module in which the incident belongs to
New: CybelAngel NS Servers
New: Added a new incident field- CybelAngel NS Servers that Name servers attributed to the incident
New: CybelAngel Origins
New: Added a new incident field- CybelAngel Origins that Potential Origin attributed to the incident
New: CybelAngel Port
New: Added a new incident field- CybelAngel Port that Port attributed to the incident
New: CybelAngel Registrant Email
New: Added a new incident field- CybelAngel Registrant Email that Email associated to the registration of a domain
New: CybelAngel Registrant Name
New: Added a new incident field- CybelAngel Registrant Name that Name of the registrar for attributed domain
New: CybelAngel Report Content
New: Added a new incident field- CybelAngel Report Content that Entire report content
New: CybelAngel Report Type
New: Added a new incident field- CybelAngel Report Type that report type
New: CybelAngel Risks
New: Added a new incident field- CybelAngel Risks that Risks attributed to the incident
New: CybelAngel Samples
New: Added a new incident field- CybelAngel Samples that Links for sample images to be ingested
New: CybelAngel Screenshots
New: Added a new incident field- CybelAngel Screenshots that Links to screenshots of incident data
New: CybelAngel Sender
New: Added a new incident field- CybelAngel Sender that Analyst who generated the report
New: CybelAngel Sent At
New: Added a new incident field- CybelAngel Sent At that Date the incident report was sent
New: CybelAngel Severity
New: Added a new incident field- CybelAngel Severity that Severity of incident
New: CybelAngel Solved At
New: Added a new incident field- CybelAngel Solved At that Date the incident has been resolved
New: CybelAngel Source
New: Added a new incident field- CybelAngel Source that Source of the incident if applicable
New: CybelAngel Stream
New: Added a new incident field- CybelAngel Stream that Steam ID
New: CybelAngel Suggestions
New: Added a new incident field- CybelAngel Suggestions that Suggestions on how to deal with the incident report
New: CybelAngel Tags
New: Added a new incident field- CybelAngel Tags that Tags on the report
New: CybelAngel Threat
New: Added a new incident field- CybelAngel Threat that Threat attibuted to an Asset
New: CybelAngel Title
New: Added a new incident field- CybelAngel Title that Title for the incident Report
New: CybelAngel Updated At
New: Added a new incident field- CybelAngel Updated At that Date the report was last updated
New: CybelAngel User Session
New: Added a new incident field- CybelAngel User Session that Session pertaining to Darkweb alerts
New: CybelAngel UserGroups
New: Added a new incident field- CybelAngel UserGroups that UserGroups attributed to the Incident report
New: CybelAngel Volume
New: Added a new incident field- CybelAngel Volume that Collection of additional information relating to the incident
New: CybelAngel WHOIS
New: Added a new incident field- CybelAngel WHOIS that Who is data attributed to the incident

Incident Types

New: CybelAngel
New: Added a new incident type- CybelAngel that maps CybelAngel incident reports to XSOAR incidents.

Integrations

CybelAngel

Updated the CybelAngel Event Collector integration to fetch and interact with CybelAngel api in XSIAM.

CybelAngel EASM

Updated the CybelAngel integration to allow for users to fetch and interact with CybelAngel api in XSOAR.

Mappers

New: CybelAngel

New: Added a new mapper- CybelAngel that maps incident report JSON to CybelAngel Incident type.

Related pull requests:
- 37711
- 39497

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	March 5, 2025
Last Release	April 29, 2026

Threat Intelligence Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.