Details
Content
Dependencies
Version History

Cyberint provides intelligence-driven digital risk protection. This integration will help your enterprise effectively consume actionable cyber alerts to increase your security posture.

Cyberint

Cyberint provides intelligence-driven digital risk protection.
Cyberint helps you identify emerging threats, verifies your security posture, and responds effectively to reduce their impact.

Visit our site at cyberint.com

What does this pack do?

Cyberint and XSOAR integration is here to simplify and streamline Digital Risk Protection for Cortex XSOAR users, bring enriched threat intelligence from the Argos Edge™ Digital Risk Protection Platform into Cortex XSOAR and automatically implement playbooks and incident processes.

Leverages enriched and contextualized data from the Argos™ Digital Risk Protection platform to maximize your security posture within Cortex XSOAR.
Easily exposes attack tools, phishing sites, fraud incidents, and more.
Automatically blocks IOCs, resets account credentials, changes access tokens, and more.
Optimizes your security team’s performance for faster Mean Time to Acknowledge (MTTA) and Mean Time to Remediate (MTTR).
Tracks the status of tickets with automatic sync updates across systems for instant visibility and comprehensive performance metrics.

Additional useful links

Link to our blog
Running commands - How to run commands with Argos Edge™ XSOAR Integration.
How to set up the integration - Step by step installation and configuration guide of the application.

Cyberint

Cyberint provides intelligence-driven digital risk protection.
Cyberint helps you identify emerging threats, verifies your security posture, and responds effectively to reduce their impact.

Visit our site at cyberint.com

What does this pack do?

Cyberint and XSOAR integration is here to simplify and streamline Digital Risk Protection for Cortex XSIAM users, bring enriched threat intelligence from the Argos Edge™ Digital Risk Protection Platform into Cortex XSIAM and automatically implement playbooks and incident processes.

Leverages enriched and contextualized data from the Argos™ Digital Risk Protection platform to maximize your security posture within Cortex XSIAM.
Easily exposes attack tools, phishing sites, fraud incidents, and more.
Automatically blocks IOCs, resets account credentials, changes access tokens, and more.
Optimizes your security team’s performance for faster Mean Time to Acknowledge (MTTA) and Mean Time to Remediate (MTTR).
Tracks the status of tickets with automatic sync updates across systems for instant visibility and comprehensive performance metrics.

Additional useful links

Link to our blog
Running commands - How to run commands with Argos Edge™ XSOAR Integration.
How to set up the integration - Step by step installation and configuration guide of the application.

Classifiers

Name	Description
Cyberint - Classifier	Cyberint Classifier
CyberInt (mapper)
CyberInt Outgoing (mapper)

Incident Fields

Name	Description
CyberInt Impacts
CyberInt Expert Analysis
CyberInt Description
CyberInt Related entities
CyberInt Confidence
CyberInt Title
CyberInt Tags
Cyberint Category
CyberInt Targeted Vectors
CyberInt Impact
CyberInt Related IOCs
CyberInt Closure reason
CyberInt Status
CyberInt Targeted Brands
CyberInt Targeted Brand
CyberInt Payment Card Exposed CSV
CyberInt Vulnerable CName Record
CyberInt Alert ID
CyberInt Source
CyberInt Descriptors
CyberInt Type
CyberInt Threat Actor
CyberInt Created by
CyberInt File Type
CyberInt Ticket ID
CyberInt Created date
CyberInt Related Entity
CyberInt Targeted Vector
CyberInt Credentials Exposed CSV
CyberInt Source category
CyberInt Alert Data
CyberInt Attachments
CyberInt Closure reason Description
CyberInt Recommendation

Incident Types

Name	Description
Cyberint Incident

Integrations

Name	Description
Cyberint (Partner Contribution)	Cyberint provides intelligence-driven digital risk protection. This integration will help your enterprise effectively consume actionable cyber alerts to increase your security posture.

Layouts

Name	Description
Cyberint Incident Layout	Cyberint incident layout

Classifiers

Name	Description
Cyberint - Classifier	Cyberint Classifier
CyberInt Outgoing (mapper)
CyberInt (mapper)

Incident Fields

Name	Description
CyberInt Attachments
CyberInt Expert Analysis
CyberInt Related IOCs
CyberInt Impacts
CyberInt Payment Card Exposed CSV
CyberInt Credentials Exposed CSV
CyberInt Source category
CyberInt Impact
CyberInt Vulnerable CName Record
CyberInt Targeted Brand
CyberInt Descriptors
CyberInt Confidence
CyberInt Targeted Vector
CyberInt Source
CyberInt Threat Actor
CyberInt Recommendation
CyberInt File Type
CyberInt Related entities
CyberInt Targeted Vectors
CyberInt Targeted Brands
CyberInt Closure reason
CyberInt Created by
CyberInt Status
CyberInt Alert Data
CyberInt Title
CyberInt Alert ID
CyberInt Related Entity
CyberInt Tags
CyberInt Ticket ID
CyberInt Description
CyberInt Closure reason Description
CyberInt Type

Incident Types

Name	Description
Cyberint Incident

Integrations

Name	Description
Cyberint (Partner Contribution)	Cyberint provides intelligence-driven digital risk protection. This integration will help your enterprise effectively consume actionable cyber alerts to increase your security posture.

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.1.4 - 1748140 (December 4, 2024)

Integrations

Cyberint

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

1.1.3 - R1681986 (November 21, 2024)

Classifiers

Cyberint - Classifier

Updated the integration clarifier to support mirroring.

Incident Fields

Fixed an issue where CyberInt Related Entity was not mapped properly in CyberInt (mapper).
New: CyberInt Closure reason
New: CyberInt Closure reason Description
CyberInt Credentials Exposed CSV
New: CyberInt Status
New: CyberInt Alert Data

Integrations

Cyberint

Added support for the updated_date_from and the updated_date_to arguments in the cyberint-fetch-alert-list command.
Added support for the closure_reason and the closure_reason_description arguments in the cyberint-alerts-status-update command.
Added support for mirroring.
Updated the Docker image to: demisto/python3:3.10.13.82076.

Layouts

Cyberint Incident Layout
Updated the integration incident layout.

Mappers

CyberInt (mapper)

Updated the integration mapper to support mirroring.

New: CyberInt Outgoing (mapper)

New: Added outgoing mapper to support mirror out.

Related pull requests:
- 31252
- 30493
- 25523

Download

1.1.2 - R6950398 (November 21, 2023)

Integrations

Cyberint

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27848

Download

1.1.1 - R5170573 (May 2, 2023)

Integrations

Cyberint

Updated the Docker image to: demisto/python3:3.10.11.54132.

Related pull requests:
- 25970

Download

1.1.0 - 4851609 (March 19, 2023)

Classifiers

Cyberint - Classifier

New classifier for the CSV data.

Incident Fields

New: CyberInt Credentials Exposed CSV
New: CyberInt File Type
New: CyberInt Payment Card Exposed CSV
CyberInt Alert ID
CyberInt Attachments
CyberInt Closure reason
CyberInt Confidence
CyberInt Created date
New: CyberInt Credentials Exposed CSV
CyberInt Description
CyberInt Expert Analysis
New: CyberInt File Type
New: CyberInt Impacts
New: CyberInt Descriptors
New: CyberInt Targeted Brands
New: CyberInt Related Entity
New: CyberInt Targeted Vectors
New: CyberInt Payment Card Exposed CSV
CyberInt Recommendation
CyberInt Related IOCs
CyberInt Source
CyberInt Source category
CyberInt Status
CyberInt Threat Actor
CyberInt Ticket ID
CyberInt Title
CyberInt Type
CyberInt Vulnerable CName Record
Cyberint Category
CyberInt Targeted Vector
New: CyberInt Payment Card Exposed CSV
New: CyberInt File Type
CyberInt Tags
CyberInt Related entities
New: CyberInt Credentials Exposed CSV
CyberInt Targeted Brand
CyberInt Impact

Incident Types

Cyberint Incident

Integrations

Cyberint

Updated the Docker image to: demisto/python3:3.10.10.49934.
Improve fetch-incident to fetch the alert CSV records data.

Layouts

Cyberint Incident Layout
New incident layout for the CSV data.

Mappers

CyberInt (mapper)

New mapper for the CSV data.

Related pull requests:
- 25375
- 24853

Download

1.0.17 - 4727595 (March 2, 2023)

Integrations

Cyberint

Updated the Docker image to: demisto/python3:3.10.10.48392.

Related pull requests:
- 24986

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	January 27, 2021
Last Release	December 4, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.