Cypho Threat Intelligence

Details
Content
Dependencies
Version History

The Cypho-XSOAR Content Pack automates incident management between Cypho and Cortex XSOAR. It includes 7 automations, 1 playbook, 23 incident types, and 72 incident fields, enabling users to assign incidents, add comments, update severity, approve or dismiss issues, download attachments, and fetch incidents from Cypho. This content pack ensures incidents in XSOAR accurately reflect the current state of Cypho tickets, streamlines workflows, reduces manual effort, and improves operational efficiency and compliance.

Cypho is a security incident management platform, and this content pack automates the management of Cypho incidents within Cortex XSOAR. Incidents in Cypho can include alerts, issues, and tickets that require tracking, updates, and collaboration.

This Cypho content pack contains the Cortex XSOAR integration with Cypho that provides commands to assign incidents, add comments, update severity, approve or dismiss issues, download attachments, and fetch existing incidents from Cypho. It also includes a playbook to orchestrate these automations and manage incident workflows efficiently.

What does this pack do?

The integration included in this pack allows you to manage and update Cypho incidents directly from XSOAR, providing visibility and control over incident status, attachments, and assignees.

The playbook and automations included in this pack help you save time and automate repetitive tasks associated with incident management, such as:

⦁ Assigning incidents to the appropriate user or team.
⦁ Adding comments to track updates and actions on incidents.
⦁ Updating incident severity to reflect changing risk levels.
⦁ Approving or dismissing issues based on their relevance or resolution status.
⦁ Downloading attachments securely while ensuring only assigned incidents can be accessed.
⦁ Fetching incidents from Cypho into XSOAR for analysis and monitoring.

This content pack is designed to streamline incident management workflows, reduce manual effort, and improve operational efficiency while maintaining alignment with Cypho incident data.

Cypho is a security incident management platform, and this content pack automates the management of Cypho incidents within Cortex. Incidents in Cypho can include alerts, issues, and tickets that require tracking, updates, and collaboration.

This Cypho content pack contains the Cortex integration with Cypho that provides commands to assign incidents, add comments, update severity, approve or dismiss issues, download attachments, and fetch existing incidents from Cypho. It also includes a playbook to orchestrate these automations and manage incident workflows efficiently.

What does this pack do?

The integration included in this pack allows you to manage and update Cypho incidents directly from XSOAR, providing visibility and control over incident status, attachments, and assignees.

The playbook and automations included in this pack help you save time and automate repetitive tasks associated with incident management, such as:

This content pack is designed to streamline incident management workflows, reduce manual effort, and improve operational efficiency while maintaining alignment with Cypho incident data.

Automations

Name	Description
CyphoAdjustTimeToAssignmentAndRemediationSLAs
CyphoApproveIssue
CyphoAssignToMeButton	Assigns the current Incident to the Cortex XSOAR user who clicked the button.
CyphoServerityChange
CyphoDismissIssue
CyphoAddCommentButton
CyphoDownloadAttachments

Classifiers

Name	Description
Cypho Threat Intelligence Issue Classifier	Classifies Cypho Threat Intelligence incidents.
Cypho Threat Intelligence Incoming Mapper	Maps incoming Cypho Threat Intelligence incidents fields.

Dashboards

Name	Description
Cypho Incident Dashboard

Incident Fields

Name	Description
Cypho Threat Intelligence Similarity Rate
Cypho Threat Intelligence Confidence Score
Cypho Threat Intelligence Login Name
Cypho Threat Intelligence Detected Http Request Method
Cypho Threat Intelligence Detected Phishing Domain Name
Cypho Threat Intelligence Tenant Name
Cypho Threat Intelligence Host Path
Cypho Threat Intelligence Detected URL
Cypho Threat Intelligence Detected Old Record IP
Cypho Threat Intelligence Subject Common Name
Cypho Threat Intelligence Detected Host
Cypho Threat Intelligence Risk Level
Cypho Threat Intelligence Product Name
Cypho Threat Intelligence Detected Payload
Cypho Threat Intelligence Detected CVE ID
Cypho Threat Intelligence Detected Package Name
Cypho Threat Intelligence Detection Source
Cypho Threat Intelligence Detected Port
Cypho Threat Intelligence Detected Content
Cypho Threat Intelligence Recommendation
Cypho Threat Intelligence Title
Cypho Threat Intelligence Updated at Time
Cypho Threat Intelligence Detected Service Version
Cypho Threat Intelligence Detected Request Body
Cypho Threat Intelligence Not Parked Factor Score
Cypho Threat Intelligence Detected CPEs
Cypho Threat Intelligence Detected Attack Type
Cypho Threat Intelligence Attachments
Cypho Threat Intelligence Detected Response Headers
Cypho Threat Intelligence Time to Assignment
Cypho Threat Intelligence Detected CVE Score
Cypho Threat Intelligence Detected Content Title
Cypho Threat Intelligence Detected Content Page Count
Cypho Threat Intelligence Description
Cypho Threat Intelligence Detected Domains
Cypho Threat Intelligence Status Reason
Cypho Threat Intelligence Status
Cypho Threat Intelligence Asset
Cypho Threat Intelligence Comments
Cypho Threat Intelligence Detected New Record IP
Cypho Threat Intelligence Remediation SLA
Cypho Threat Intelligence Detected Service Name
Cypho Threat Intelligence Detected CVE Severity
Cypho Threat Intelligence Category Name
Cypho Threat Intelligence Checker
Cypho Threat Intelligence Date Detected by Cypho
Cypho Threat Intelligence Detected IP
Cypho Threat Intelligence Threat Intelligence Created at Time
Cypho Threat Intelligence Detected New Record
Cypho Threat Intelligence Detected Developer
Cypho Threat Intelligence Detected Targeted Brand Name
Cypho Threat Intelligence Detected Serial Number
Cypho Threat Intelligence Detected Base Name
Cypho Threat Intelligence Threat Intelligence Impact
Cypho Threat Intelligence Ticket Id
Cypho Threat Intelligence Target Type
Cypho Threat Intelligence Domain Same As Company Keyword Score
Cypho Threat Intelligence Detected Request Headers
Cypho Threat Intelligence SSL/TLS Certificate Expire Date
Cypho Threat Intelligence Detected Content Author Name
Cypho Threat Intelligence Detected Parameter
Cypho Threat Intelligence Detected GitHub Owner Name
Cypho Threat Intelligence Searching keyword
Cypho Threat Intelligence Subject Alternative Names
Cypho Threat Intelligence Detected Old Record
Cypho Threat Intelligence ID
Cypho Threat Intelligence Messages
Cypho Threat Intelligence Date of Exposure
Cypho Threat Intelligence Detail
Cypho Threat Intelligence Detected Password
Cypho Threat Intelligence Detected Repository Name

Incident Types

Name	Description
Cypho SSL Certificate Expiry Monitoring
Cypho SSL Certificate Hostname Mismatch Monitoring
Cypho Exploitable Ports Monitoring
Cypho Insecure Subdomains Monitoring
Cypho URL and Domain Analysis Services Monitoring
Cypho PII Exposure Monitoring
Cypho Social Media Account Impersonation Monitoring
Cypho Dark Web Exposure Monitoring
Cypho Critical Ports Monitoring
Cypho Injection Attacks
Cypho Rogue Mobile Application Detection
Cypho File Sharing Services Monitoring
Cypho IM Platform Suspicious Content
Cypho Security Misconfiguration
Cypho Phishing Monitoring
Cypho Sensitive Data Exposure Monitoring
Cypho Under Review Issues
Cypho Improper Access Control
Cypho Email Dns Records Monitoring
Cypho Dns Information Monitoring
Cypho Github Secrets Monitoring
Cypho Unclassified Incident
Cypho Malware Analysis Services Monitoring

Integrations

Name	Description
Cypho Threat Intelligence (Community Contribution)	This integration enables your organization to efficiently collect, analyze, and respond to actionable cyber alerts generated within the Cypho platform enhancing visibility, automation, and overall security posture.

Layouts

Name	Description
Cypho Thread Intelligence Layout

Playbooks

Name	Description
Cypho Default	The Silent Cypho Default Playbook is designed for use in Cortex XSOAR to silently process incoming Cypho security alerts and maintain incident lifecycle parity. The playbook performs automated classification of issues, assigns SLA tracking for governance metrics, and enforces incident ownership validation to ensure that no automated response actions (approve, dismiss, severity change, comments, or attachment extraction) run without an analyst being assigned first. It leverages only built-in Condition Tasks and the native setIncident command module, ensuring full compatibility with XSOAR Marketplace standards while preserving accurate SOC performance KPIs, including MTTR (Mean Time To Resolve), MTTD (Mean Time To Detect), and owner attribution in the incident timeline. This removes the risk of silent automations overwriting incident responsibility, enables reliable KPI calculations, and reduces manual effort for repeated updates.

Name

Description

Cypho Default

The Silent Cypho Default Playbook is designed for use in Cortex XSOAR to silently process incoming Cypho security alerts and maintain incident lifecycle parity. The playbook performs automated classification of issues, assigns SLA tracking for governance metrics, and enforces incident ownership validation to ensure that no automated response actions (approve, dismiss, severity change, comments, or attachment extraction) run without an analyst being assigned first. It leverages only built-in Condition Tasks and the native setIncident command module, ensuring full compatibility with XSOAR Marketplace standards while preserving accurate SOC performance KPIs, including MTTR (Mean Time To Resolve), MTTD (Mean Time To Detect), and owner attribution in the incident timeline. This removes the risk of silent automations overwriting incident responsibility, enables reliable KPI calculations, and reduces manual effort for repeated updates.

Automations

Name	Description
CyphoAddCommentButton
CyphoDismissIssue
CyphoApproveIssue
CyphoAssignToMeButton	Assigns the current Incident to the Cortex user who clicked the button.
CyphoAdjustTimeToAssignmentAndRemediationSLAs
CyphoServerityChange
CyphoDownloadAttachments

Classifiers

Name	Description
Cypho Threat Intelligence Issue Classifier	Classifies Cypho Threat Intelligence incidents.
Cypho Threat Intelligence Incoming Mapper	Maps incoming Cypho Threat Intelligence incidents fields.

Incident Fields

Name	Description
Cypho Threat Intelligence Similarity Rate
Cypho Threat Intelligence Searching keyword
Cypho Threat Intelligence Detected Developer
Cypho Threat Intelligence Detected Host
Cypho Threat Intelligence Checker
Cypho Threat Intelligence Status
Cypho Threat Intelligence Detected Content
Cypho Threat Intelligence Detected Phishing Domain Name
Cypho Threat Intelligence Detected New Record
Cypho Threat Intelligence Detected Service Name
Cypho Threat Intelligence Detected Repository Name
Cypho Threat Intelligence Date Detected by Cypho
Cypho Threat Intelligence Detected Port
Cypho Threat Intelligence Status Reason
Cypho Threat Intelligence Detected Password
Cypho Threat Intelligence Confidence Score
Cypho Threat Intelligence Updated at Time
Cypho Threat Intelligence Subject Common Name
Cypho Threat Intelligence Detected Attack Type
Cypho Threat Intelligence Subject Alternative Names
Cypho Threat Intelligence Detected URL
Cypho Threat Intelligence Threat Intelligence Created at Time
Cypho Threat Intelligence Detected New Record IP
Cypho Threat Intelligence Detected CVE Score
Cypho Threat Intelligence Target Type
Cypho Threat Intelligence Detected Http Request Method
Cypho Threat Intelligence Login Name
Cypho Threat Intelligence Detail
Cypho Threat Intelligence Detected Content Title
Cypho Threat Intelligence Description
Cypho Threat Intelligence Detected CVE Severity
Cypho Threat Intelligence Detected Payload
Cypho Threat Intelligence Detected Package Name
Cypho Threat Intelligence Detected Content Page Count
Cypho Threat Intelligence Detected Old Record IP
Cypho Threat Intelligence Detected Serial Number
Cypho Threat Intelligence Not Parked Factor Score
Cypho Threat Intelligence SSL/TLS Certificate Expire Date
Cypho Threat Intelligence Attachments
Cypho Threat Intelligence Detected GitHub Owner Name
Cypho Threat Intelligence Detected Parameter
Cypho Threat Intelligence Time to Assignment
Cypho Threat Intelligence Messages
Cypho Threat Intelligence Detected Request Body
Cypho Threat Intelligence Ticket Id
Cypho Threat Intelligence Threat Intelligence Impact
Cypho Threat Intelligence ID
Cypho Threat Intelligence Detected Service Version
Cypho Threat Intelligence Product Name
Cypho Threat Intelligence Detected CPEs
Cypho Threat Intelligence Tenant Name
Cypho Threat Intelligence Detected Content Author Name
Cypho Threat Intelligence Detected Old Record
Cypho Threat Intelligence Comments
Cypho Threat Intelligence Recommendation
Cypho Threat Intelligence Remediation SLA
Cypho Threat Intelligence Detection Source
Cypho Threat Intelligence Host Path
Cypho Threat Intelligence Detected IP
Cypho Threat Intelligence Title
Cypho Threat Intelligence Detected CVE ID
Cypho Threat Intelligence Detected Request Headers
Cypho Threat Intelligence Detected Targeted Brand Name
Cypho Threat Intelligence Date of Exposure
Cypho Threat Intelligence Detected Domains
Cypho Threat Intelligence Detected Response Headers
Cypho Threat Intelligence Category Name
Cypho Threat Intelligence Asset
Cypho Threat Intelligence Domain Same As Company Keyword Score
Cypho Threat Intelligence Risk Level
Cypho Threat Intelligence Detected Base Name

Incident Types

Name	Description
Cypho Malware Analysis Services Monitoring
Cypho Sensitive Data Exposure Monitoring
Cypho IM Platform Suspicious Content
Cypho SSL Certificate Expiry Monitoring
Cypho Phishing Monitoring
Cypho Critical Ports Monitoring
Cypho Improper Access Control
Cypho URL and Domain Analysis Services Monitoring
Cypho Dark Web Exposure Monitoring
Cypho Insecure Subdomains Monitoring
Cypho File Sharing Services Monitoring
Cypho Github Secrets Monitoring
Cypho Injection Attacks
Cypho Rogue Mobile Application Detection
Cypho Under Review Issues
Cypho Email Dns Records Monitoring
Cypho Social Media Account Impersonation Monitoring
Cypho Dns Information Monitoring
Cypho PII Exposure Monitoring
Cypho Unclassified Incident
Cypho Exploitable Ports Monitoring
Cypho SSL Certificate Hostname Mismatch Monitoring
Cypho Security Misconfiguration

Integrations

Name	Description
Cypho Threat Intelligence (Community Contribution)	This integration enables your organization to efficiently collect, analyze, and respond to actionable cyber alerts generated within the Cypho platform enhancing visibility, automation, and overall security posture.

Layouts

Name	Description
Cypho Thread Intelligence Layout

Playbooks

Name	Description
Cypho Default	The Silent Cypho Default Playbook is designed for use in Cortex to silently process incoming Cypho security alerts and maintain alert lifecycle parity. The playbook performs automated classification of issues, assigns SLA tracking for governance metrics, and enforces alert ownership validation to ensure that no automated response actions (approve, dismiss, severity change, comments, or attachment extraction) run without an analyst being assigned first. It leverages only built-in Condition Tasks and the native setAlert command module, ensuring full compatibility with XSOAR Marketplace standards while preserving accurate SOC performance KPIs, including MTTR (Mean Time To Resolve), MTTD (Mean Time To Detect), and owner attribution in the alert timeline. This removes the risk of silent automations overwriting alert responsibility, enables reliable KPI calculations, and reduces manual effort for repeated updates.

Name

Description

Cypho Default

The Silent Cypho Default Playbook is designed for use in Cortex to silently process incoming Cypho security alerts and maintain alert lifecycle parity. The playbook performs automated classification of issues, assigns SLA tracking for governance metrics, and enforces alert ownership validation to ensure that no automated response actions (approve, dismiss, severity change, comments, or attachment extraction) run without an analyst being assigned first. It leverages only built-in Condition Tasks and the native setAlert command module, ensuring full compatibility with XSOAR Marketplace standards while preserving accurate SOC performance KPIs, including MTTR (Mean Time To Resolve), MTTD (Mean Time To Detect), and owner attribution in the alert timeline. This removes the risk of silent automations overwriting alert responsibility, enables reliable KPI calculations, and reduces manual effort for repeated updates.

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Supported By	Community
Created	January 18, 2026
Last Release	January 18, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

Palo Alto Networks Cortex XDR - Investigation and Response

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.