CybelAngel

Details
Content
Dependencies
Version History

CybelAngel Event Collector receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

The CybelAngel Event Collector integration receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

CybelAngel protects a global network of hundreds of enterprise clients, providing them with advanced EASM protection for enhanced security.

The CybelAngel Event Collector integration receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

CybelAngel protects a global network of hundreds of enterprise clients, providing them with advanced EASM protection for enhanced security.

Classifiers

Name	Description
CybelAngel

Incident Fields

Name	Description
CybelAngel Sent At	Date the incident report was sent
CybelAngel Severity	Severity of incident
CybelAngel Abstract	Description of the CybelAngel incident
CybelAngel Abuse Email	Abuse email for domain threats
CybelAngel Registrant Email	Email associated to the registration of a domain
CybelAngel User Session	Session pertaining to Darkweb alerts
CybelAngel Location	Physical Location of host or incident
CybelAngel Domain Registered At	Date the domain is registered (if domain alert)
CybelAngel Analysis	Additional analysis of the incident in question
CybelAngel Volume	Collection of additional information relating to the incident
CybelAngel Origins	Potential Origin attributed to the incident
CybelAngel Stream	Steam ID
CybelAngel Detected At	Date the incident was detected by scanners
CybelAngel NS Servers	Name servers attributed to the incident
CybelAngel Report Content	Entire report content
CybelAngel Solved At	Date the incident has been resolved
CybelAngel Liveness
CybelAngel Samples	Links for sample images to be ingested
CybelAngel Risks	Risks attributed to the incident
CybelAngel Registrant Name	Name of the registrar for attributed domain
CybelAngel Incident ID	ID used to locate Report in CybelAngel platform
CybelAngel Module	Module in which the incident belongs to
CybelAngel Port	Port attributed to the incident
CybelAngel Keywords	Keywords matched in the detection of the incident
CybelAngel Sender	Analyst who generated the report
CybelAngel Machine Name	Name of infected machine
CybelAngel Investigation ID	Disregard this ID.
CybelAngel Tags	Tags on the report
CybelAngel Malware Name	Name of malware used to steal user information
CybelAngel Language	Language of the report
CybelAngel MX Servers	MX servers attributed to the incident
CybelAngel Title	Title for the incident Report
CybelAngel UserGroups	UserGroups attributed to the Incident report
CybelAngel Malware Location	Location of the Malware on Victim machine
CybelAngel City	The City attributed to the physical location of incident
CybelAngel Report Type	report type
CybelAngel Updated At	Date the report was last updated
CybelAngel Asset Urls	URLs related to the finding
CybelAngel Country Code	Country Code relating to physical location of incident
CybelAngel Created At	Date of creation of the incident
CybelAngel Screenshots	Links to screenshots of incident data
CybelAngel WHOIS	Who is data attributed to the incident
CybelAngel Source	Source of the incident if applicable
CybelAngel Board	Darkweb Board in which data is detected
CybelAngel Threat	Threat attibuted to an Asset
CybelAngel Incident Type	Type of the incident in question
CybelAngel IP	IP address relating to the Incident
CybelAngel Suggestions	Suggestions on how to deal with the incident report

Incident Types

Name	Description
CybelAngel

Integrations

Name	Description
CybelAngel	CybelAngel collects reports from the CybelAngel platform, which specializes in external attack surface protection and management.
CybelAngel EASM (Partner Contribution)	This integration connects your alerts from CybelAngel.

Layouts

Name	Description
CybelAngel

Classifiers

Name	Description
CybelAngel

Incident Fields

Name	Description
CybelAngel NS Servers	Name servers attributed to the incident
CybelAngel Board	Darkweb Board in which data is detected
CybelAngel Stream	Steam ID
CybelAngel Samples	Links for sample images to be ingested
CybelAngel Title	Title for the incident Report
CybelAngel Location	Physical Location of host or incident
CybelAngel Abuse Email	Abuse email for domain threats
CybelAngel User Session	Session pertaining to Darkweb alerts
CybelAngel MX Servers	MX servers attributed to the incident
CybelAngel Tags	Tags on the report
CybelAngel Asset Urls	URLs related to the finding
CybelAngel Incident ID	ID used to locate Report in CybelAngel platform
CybelAngel Liveness
CybelAngel Investigation ID	Disregard this ID.
CybelAngel Malware Location	Location of the Malware on Victim machine
CybelAngel Language	Language of the report
CybelAngel Sent At	Date the incident report was sent
CybelAngel Machine Name	Name of infected machine
CybelAngel Suggestions	Suggestions on how to deal with the incident report
CybelAngel Created At	Date of creation of the incident
CybelAngel Keywords	Keywords matched in the detection of the incident
CybelAngel Report Type	report type
CybelAngel Abstract	Description of the CybelAngel incident
CybelAngel Solved At	Date the incident has been resolved
CybelAngel Incident Type	Type of the incident in question
CybelAngel Report Content	Entire report content
CybelAngel WHOIS	Who is data attributed to the incident
CybelAngel Volume	Collection of additional information relating to the incident
CybelAngel Registrant Email	Email associated to the registration of a domain
CybelAngel Malware Name	Name of malware used to steal user information
CybelAngel Country Code	Country Code relating to physical location of incident
CybelAngel Threat	Threat attibuted to an Asset
CybelAngel Domain Registered At	Date the domain is registered (if domain alert)
CybelAngel Module	Module in which the incident belongs to
CybelAngel Sender	Analyst who generated the report
CybelAngel Detected At	Date the incident was detected by scanners
CybelAngel UserGroups	UserGroups attributed to the Incident report
CybelAngel Analysis	Additional analysis of the incident in question
CybelAngel Port	Port attributed to the incident
CybelAngel Updated At	Date the report was last updated
CybelAngel IP	IP address relating to the Incident
CybelAngel Severity	Severity of incident
CybelAngel City	The City attributed to the physical location of incident
CybelAngel Screenshots	Links to screenshots of incident data
CybelAngel Risks	Risks attributed to the incident
CybelAngel Origins	Potential Origin attributed to the incident
CybelAngel Source	Source of the incident if applicable
CybelAngel Registrant Name	Name of the registrar for attributed domain

Incident Types

Name	Description
CybelAngel

Integrations

Name	Description
CybelAngel EASM (Partner Contribution)	This integration connects your alerts from CybelAngel.
CybelAngel	CybelAngel collects reports from the CybelAngel platform, which specializes in external attack surface protection and management.

Modeling Rules

Name	Description
CybelAngel Platform Modeling Rule

Required Content Packs (6)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Threat Intel Reports (BETA)	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (7)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Threat Intel Reports (BETA)	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.0.6 - 3079234 (April 7, 2025)

Incident Fields

New: CybelAngel Abstract
New: Added a new incident field- CybelAngel Abstract that Description of the CybelAngel incident
New: CybelAngel Abuse Email
New: Added a new incident field- CybelAngel Abuse Email that Abuse email for domain threats
New: CybelAngel Analysis
New: Added a new incident field- CybelAngel Analysis that Additional analysis of the incident in question
New: CybelAngel Asset Urls
New: Added a new incident field- CybelAngel Asset Urls that URLs related to the finding
New: CybelAngel Board
New: Added a new incident field- CybelAngel Board that Darkweb Board in which data is detected
New: CybelAngel City
New: Added a new incident field- CybelAngel City that The City attributed to the physical location of incident
New: CybelAngel Country Code
New: Added a new incident field- CybelAngel Country Code that Country Code relating to physical location of incident
New: CybelAngel Created At
New: Added a new incident field- CybelAngel Created At that Date of creation of the incident
New: CybelAngel Detected At
New: Added a new incident field- CybelAngel Detected At that Date the incident was detected by scanners
New: CybelAngel Domain Registered At
New: Added a new incident field- CybelAngel Domain Registered At that Date the domain is registered (if domain alert)
New: CybelAngel IP
New: Added a new incident field- CybelAngel IP that IP address relating to the Incident
New: CybelAngel Incident ID
New: Added a new incident field- CybelAngel Incident ID that ID used to locate Report in CybelAngel platform
New: CybelAngel Incident Type
New: Added a new incident field- CybelAngel Incident Type that Type of the incident in question
New: CybelAngel Investigation ID
New: Added a new incident field- CybelAngel Investigation ID that Disregard this ID.
New: CybelAngel Keywords
New: Added a new incident field- CybelAngel Keywords that Keywords matched in the detection of the incident
New: CybelAngel Language
New: Added a new incident field- CybelAngel Language that Language of the report
New: CybelAngel Liveness
New: Added a new incident field- CybelAngel Liveness that shows the live status on an incident.
New: CybelAngel Location
New: Added a new incident field- CybelAngel Location that Physical Location of host or incident
New: CybelAngel MX Servers
New: Added a new incident field- CybelAngel MX Servers that MX servers attributed to the incident
New: CybelAngel Machine Name
New: Added a new incident field- CybelAngel Machine Name that Name of infected machine
New: CybelAngel Malware Location
New: Added a new incident field- CybelAngel Malware Location that Location of the Malware on Victim machine
New: CybelAngel Malware Name
New: Added a new incident field- CybelAngel Malware Name that Name of malware used to steal user information
New: CybelAngel Module
New: Added a new incident field- CybelAngel Module that Module in which the incident belongs to
New: CybelAngel NS Servers
New: Added a new incident field- CybelAngel NS Servers that Name servers attributed to the incident
New: CybelAngel Origins
New: Added a new incident field- CybelAngel Origins that Potential Origin attributed to the incident
New: CybelAngel Port
New: Added a new incident field- CybelAngel Port that Port attributed to the incident
New: CybelAngel Registrant Email
New: Added a new incident field- CybelAngel Registrant Email that Email associated to the registration of a domain
New: CybelAngel Registrant Name
New: Added a new incident field- CybelAngel Registrant Name that Name of the registrar for attributed domain
New: CybelAngel Report Content
New: Added a new incident field- CybelAngel Report Content that Entire report content
New: CybelAngel Report Type
New: Added a new incident field- CybelAngel Report Type that report type
New: CybelAngel Risks
New: Added a new incident field- CybelAngel Risks that Risks attributed to the incident
New: CybelAngel Samples
New: Added a new incident field- CybelAngel Samples that Links for sample images to be ingested
New: CybelAngel Screenshots
New: Added a new incident field- CybelAngel Screenshots that Links to screenshots of incident data
New: CybelAngel Sender
New: Added a new incident field- CybelAngel Sender that Analyst who generated the report
New: CybelAngel Sent At
New: Added a new incident field- CybelAngel Sent At that Date the incident report was sent
New: CybelAngel Severity
New: Added a new incident field- CybelAngel Severity that Severity of incident
New: CybelAngel Solved At
New: Added a new incident field- CybelAngel Solved At that Date the incident has been resolved
New: CybelAngel Source
New: Added a new incident field- CybelAngel Source that Source of the incident if applicable
New: CybelAngel Stream
New: Added a new incident field- CybelAngel Stream that Steam ID
New: CybelAngel Suggestions
New: Added a new incident field- CybelAngel Suggestions that Suggestions on how to deal with the incident report
New: CybelAngel Tags
New: Added a new incident field- CybelAngel Tags that Tags on the report
New: CybelAngel Threat
New: Added a new incident field- CybelAngel Threat that Threat attibuted to an Asset
New: CybelAngel Title
New: Added a new incident field- CybelAngel Title that Title for the incident Report
New: CybelAngel Updated At
New: Added a new incident field- CybelAngel Updated At that Date the report was last updated
New: CybelAngel User Session
New: Added a new incident field- CybelAngel User Session that Session pertaining to Darkweb alerts
New: CybelAngel UserGroups
New: Added a new incident field- CybelAngel UserGroups that UserGroups attributed to the Incident report
New: CybelAngel Volume
New: Added a new incident field- CybelAngel Volume that Collection of additional information relating to the incident
New: CybelAngel WHOIS
New: Added a new incident field- CybelAngel WHOIS that Who is data attributed to the incident

Incident Types

New: CybelAngel
New: Added a new incident type- CybelAngel that maps CybelAngel incident reports to XSOAR incidents.

Integrations

Updated the CybelAngel Event Collector integration to fetch and interact with CybelAngel api in XSIAM.

CybelAngel EASM

Updated the CybelAngel integration to allow for users to fetch and interact with CybelAngel api in XSOAR.

Layouts

New: CybelAngel
New: Added a new layout- CybelAngel that shows the key attributes of CybelAngel incident.

Mappers

New: CybelAngel

New: Added a new mapper- CybelAngel that maps incident report JSON to CybelAngel Incident type.

Related pull requests:
- 37711
- 39497

Download

1.0.5 - R2988287 (March 26, 2025)

Integrations

CybelAngel

Metadata and documentation improvements.

Related pull requests:
- 39011

Download

1.0.4 - 2901908 (March 18, 2025)

CybelAngel

Documentation and metadata improvements.

Related pull requests:
- 38999

Download

1.0.3 - 2659951 (March 5, 2025)

CybelAngel Event Collector receives reports from the CybelAngel platform, which specializes in external attack surface protection and management.

Related pull requests:
- 38696

Download

1.0.6 - 3079234 (April 7, 2025)

Incident Fields

New: CybelAngel Abstract
New: Added a new incident field- CybelAngel Abstract that Description of the CybelAngel incident
New: CybelAngel Abuse Email
New: Added a new incident field- CybelAngel Abuse Email that Abuse email for domain threats
New: CybelAngel Analysis
New: Added a new incident field- CybelAngel Analysis that Additional analysis of the incident in question
New: CybelAngel Asset Urls
New: Added a new incident field- CybelAngel Asset Urls that URLs related to the finding
New: CybelAngel Board
New: Added a new incident field- CybelAngel Board that Darkweb Board in which data is detected
New: CybelAngel City
New: Added a new incident field- CybelAngel City that The City attributed to the physical location of incident
New: CybelAngel Country Code
New: Added a new incident field- CybelAngel Country Code that Country Code relating to physical location of incident
New: CybelAngel Created At
New: Added a new incident field- CybelAngel Created At that Date of creation of the incident
New: CybelAngel Detected At
New: Added a new incident field- CybelAngel Detected At that Date the incident was detected by scanners
New: CybelAngel Domain Registered At
New: Added a new incident field- CybelAngel Domain Registered At that Date the domain is registered (if domain alert)
New: CybelAngel IP
New: Added a new incident field- CybelAngel IP that IP address relating to the Incident
New: CybelAngel Incident ID
New: Added a new incident field- CybelAngel Incident ID that ID used to locate Report in CybelAngel platform
New: CybelAngel Incident Type
New: Added a new incident field- CybelAngel Incident Type that Type of the incident in question
New: CybelAngel Investigation ID
New: Added a new incident field- CybelAngel Investigation ID that Disregard this ID.
New: CybelAngel Keywords
New: Added a new incident field- CybelAngel Keywords that Keywords matched in the detection of the incident
New: CybelAngel Language
New: Added a new incident field- CybelAngel Language that Language of the report
New: CybelAngel Liveness
New: Added a new incident field- CybelAngel Liveness that shows the live status on an incident.
New: CybelAngel Location
New: Added a new incident field- CybelAngel Location that Physical Location of host or incident
New: CybelAngel MX Servers
New: Added a new incident field- CybelAngel MX Servers that MX servers attributed to the incident
New: CybelAngel Machine Name
New: Added a new incident field- CybelAngel Machine Name that Name of infected machine
New: CybelAngel Malware Location
New: Added a new incident field- CybelAngel Malware Location that Location of the Malware on Victim machine
New: CybelAngel Malware Name
New: Added a new incident field- CybelAngel Malware Name that Name of malware used to steal user information
New: CybelAngel Module
New: Added a new incident field- CybelAngel Module that Module in which the incident belongs to
New: CybelAngel NS Servers
New: Added a new incident field- CybelAngel NS Servers that Name servers attributed to the incident
New: CybelAngel Origins
New: Added a new incident field- CybelAngel Origins that Potential Origin attributed to the incident
New: CybelAngel Port
New: Added a new incident field- CybelAngel Port that Port attributed to the incident
New: CybelAngel Registrant Email
New: Added a new incident field- CybelAngel Registrant Email that Email associated to the registration of a domain
New: CybelAngel Registrant Name
New: Added a new incident field- CybelAngel Registrant Name that Name of the registrar for attributed domain
New: CybelAngel Report Content
New: Added a new incident field- CybelAngel Report Content that Entire report content
New: CybelAngel Report Type
New: Added a new incident field- CybelAngel Report Type that report type
New: CybelAngel Risks
New: Added a new incident field- CybelAngel Risks that Risks attributed to the incident
New: CybelAngel Samples
New: Added a new incident field- CybelAngel Samples that Links for sample images to be ingested
New: CybelAngel Screenshots
New: Added a new incident field- CybelAngel Screenshots that Links to screenshots of incident data
New: CybelAngel Sender
New: Added a new incident field- CybelAngel Sender that Analyst who generated the report
New: CybelAngel Sent At
New: Added a new incident field- CybelAngel Sent At that Date the incident report was sent
New: CybelAngel Severity
New: Added a new incident field- CybelAngel Severity that Severity of incident
New: CybelAngel Solved At
New: Added a new incident field- CybelAngel Solved At that Date the incident has been resolved
New: CybelAngel Source
New: Added a new incident field- CybelAngel Source that Source of the incident if applicable
New: CybelAngel Stream
New: Added a new incident field- CybelAngel Stream that Steam ID
New: CybelAngel Suggestions
New: Added a new incident field- CybelAngel Suggestions that Suggestions on how to deal with the incident report
New: CybelAngel Tags
New: Added a new incident field- CybelAngel Tags that Tags on the report
New: CybelAngel Threat
New: Added a new incident field- CybelAngel Threat that Threat attibuted to an Asset
New: CybelAngel Title
New: Added a new incident field- CybelAngel Title that Title for the incident Report
New: CybelAngel Updated At
New: Added a new incident field- CybelAngel Updated At that Date the report was last updated
New: CybelAngel User Session
New: Added a new incident field- CybelAngel User Session that Session pertaining to Darkweb alerts
New: CybelAngel UserGroups
New: Added a new incident field- CybelAngel UserGroups that UserGroups attributed to the Incident report
New: CybelAngel Volume
New: Added a new incident field- CybelAngel Volume that Collection of additional information relating to the incident
New: CybelAngel WHOIS
New: Added a new incident field- CybelAngel WHOIS that Who is data attributed to the incident

Incident Types

New: CybelAngel
New: Added a new incident type- CybelAngel that maps CybelAngel incident reports to XSOAR incidents.

Integrations

CybelAngel

Updated the CybelAngel Event Collector integration to fetch and interact with CybelAngel api in XSIAM.

CybelAngel EASM

Updated the CybelAngel integration to allow for users to fetch and interact with CybelAngel api in XSOAR.

Mappers

New: CybelAngel

New: Added a new mapper- CybelAngel that maps incident report JSON to CybelAngel Incident type.

Related pull requests:
- 37711
- 39497

Download

1.0.5 - R2988287 (March 26, 2025)

Integrations

CybelAngel

Metadata and documentation improvements.

Related pull requests:
- 39011

Download

1.0.4 - 2929110 (March 20, 2025)

CybelAngel

Documentation and metadata improvements.

Related pull requests:
- 38999

Download

1.0.3 - 2659951 (March 5, 2025)

Integrations

CybelAngel

Updated the pack name from "CybelAngel Event Collector" to "CybelAngel". No impact is expected as a result of the change.
Added 9 new commands:
- cybelangel-report-list
- cybelangel-report-get
- cybelangel-mirror-report-get
- cybelangel-archive-report-by-id-get
- cybelangel-report-status-update
- cybelangel-report-comments-get
- cybelangel-report-comment-create
- cybelangel-report-attachment-get
- cybelangel-report-remediation-request-create
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 38696

Download

1.0.2 - R2040490 (January 22, 2025)

Integrations

CybelAngel Event Collector

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404

Download

1.0.1 - R1681986 (November 21, 2024)

Integrations

CybelAngel Event Collector

Fixed an issue where the integration didn't request for a new bearer token when the api returned 403 error code.
Fixed an issue where cybelangel-get-events command didn't work correctly.

Related pull requests:
- 33617

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	March 5, 2025
Last Release	April 7, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.