KELA RaDark

Details
Content
Dependencies
Version History

This content pack enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.

This content pack was created to allow KELA's customers an integration with RaDark.

What does this pack do?

Fetches incidents from RaDark into your Cortex XSOAR.
Supports enrichment for existing data from RaDark.
Manages incidents in RaDark from your Cortex XSOAR.

The content pack consists of several content items including mappers, classifiers, incident types, incident fields, and layouts which provide a playbook for RaDark items. These create a complete pack that supports full integration with KELA's RaDark platform.

Classifiers

Name	Description
RaDark - Incoming Mapper	Map incident data to RaDark incident fields.

Incident Fields

Name	Description
KELA RaDark Table Vulnerable Services SCADA
KELA RaDark Table Russian Market
KELA RaDark Table Vulnerable Services Database
KELA RaDark Table Vulnerable Services Insecure Network Services
KELA RaDark Table Vulnerable Technologies
KELA RaDark Table Vulnerable Services Remote Control
KELA RaDark Table Leaked Credentials From Hacking Discussions
KELA RaDark Table Vulnerable Services File Sharing
KELA RaDark Details
KELA RaDark Table Information Disclosure
KELA RaDark Table Web Applications Vulnerabilities
KELA RaDark Table Agressor
KELA RaDark Table Sensitive Hosts
KELA RaDark Sub Type
KELA RaDark Table Credit Cards
KELA RaDark Table Botnets
KELA RaDark Table TwoEasy
KELA RaDark Table Leaked Credentials From Citadel
KELA RaDark Table Leaked Credentials From Dump
KELA RaDark Monitor ID	The monitor ID in RaDark.
KELA RaDark Table Credit Cards From Instant Messaging
KELA RaDark Table Hacking Discussions
KELA RaDark Table Vulnerable Services Message Broker
KELA RaDark Incident URL	The URL of the incident in RaDark.
KELA RaDark Table Leaked Credentials From Instant Messaging

Layouts

Name	Description
RaDark Layout	A specific layout for RaDark incidents.

Incident Types

Name	Description
RaDark

Automations

Name	Description
MapRaDarkIncidentDetails	Map details to an RaDark incident.

Playbooks

Name	Description
Set RaDark Grid For Credit Cards	Set grid for RaDark - Credit Cards incidents.
Set RaDark Grid For Network Vulnerabilities	Set grid for RaDark - Network Vulnerabilities incidents.
Set RaDark Grid For Leaked Credentials	Set grid for RaDark - Leaked Credentials incidents.
Get RaDark Detailed Items	Enriches RaDark incident with detailed items.
Set RaDark Grid For Hacking Discussions	Set grid for RaDark - Hacking Discussions incidents.
Set RaDark Grid For Compromised Accounts	Set grid for RaDark - Compromised Accounts incidents.

Integrations

Name	Description
RaDark (Partner Contribution)	This integration enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.

Classifiers

Name	Description
RaDark - Incoming Mapper	Map incident data to RaDark incident fields.

Incident Fields

Name	Description
KELA RaDark Table Vulnerable Services SCADA
KELA RaDark Table Russian Market
KELA RaDark Table Vulnerable Services Database
KELA RaDark Table Vulnerable Services Insecure Network Services
KELA RaDark Table Vulnerable Technologies
KELA RaDark Table Vulnerable Services Remote Control
KELA RaDark Table Leaked Credentials From Hacking Discussions
KELA RaDark Table Vulnerable Services File Sharing
KELA RaDark Details
KELA RaDark Table Information Disclosure
KELA RaDark Table Web Applications Vulnerabilities
KELA RaDark Table Agressor
KELA RaDark Table Sensitive Hosts
KELA RaDark Sub Type
KELA RaDark Table Credit Cards
KELA RaDark Table Botnets
KELA RaDark Table TwoEasy
KELA RaDark Table Leaked Credentials From Citadel
KELA RaDark Table Leaked Credentials From Dump
KELA RaDark Monitor ID	The monitor ID in RaDark.
KELA RaDark Table Credit Cards From Instant Messaging
KELA RaDark Table Hacking Discussions
KELA RaDark Table Vulnerable Services Message Broker
KELA RaDark Incident URL	The URL of the incident in RaDark.
KELA RaDark Table Leaked Credentials From Instant Messaging

Incident Types

Name	Description
RaDark

Automations

Name	Description
MapRaDarkIncidentDetails	Map details to an RaDark incident.

Playbooks

Name	Description
Set RaDark Grid For Credit Cards	Set grid for RaDark - Credit Cards incidents.
Set RaDark Grid For Network Vulnerabilities	Set grid for RaDark - Network Vulnerabilities incidents.
Set RaDark Grid For Leaked Credentials	Set grid for RaDark - Leaked Credentials incidents.
Get RaDark Detailed Items	Enriches RaDark incident with detailed items.
Set RaDark Grid For Hacking Discussions	Set grid for RaDark - Hacking Discussions incidents.
Set RaDark Grid For Compromised Accounts	Set grid for RaDark - Compromised Accounts incidents.

Integrations

Name	Description
RaDark (Partner Contribution)	This integration enables you to fetch incidents and manage your RaDark monitor from Cortex XSIAM.

Required Content Packs (2)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Phishing	By: Cortex XSOAR

All level dependencies (3)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

1.1.1 - R4718798 (March 1, 2023)

Layouts

RaDark Layout
This item is no longer supported in XSIAM.

Related pull requests:
- 24223

Download

1.1.0 - R3994332 (November 8, 2022)

Integrations

RaDark

Updated the Docker image to: demisto/python3:3.9.8.24399.
- You can now fetch Network Vulnerabilities, Credit Cards and Hacking Discussions incident
  type from RaDark.
- Added Network Vulnerabilities, Credit Cards and Hacking Discussions options to
  incident_types parameter in the instance installation.
- Added new outputs to radark-incident-get-items command to support Network Vulnerabilities, Credit Cards and Hacking Discussions incident type:
  - Radark.itemDetails.items.ip
  - Radark.itemDetails.items.hostname
  - Radark.itemDetails.items.port
  - Radark.itemDetails.items.technology
  - Radark.itemDetails.items.cve_details
  - Radark.itemDetails.items.details
  - Radark.itemDetails.items.type
  - Radark.itemDetails.items.description
  - Radark.itemDetails.items.date
  - Radark.itemDetails.items.bin
  - Radark.itemDetails.items.number
  - Radark.itemDetails.items.tags
  - Radark.itemDetails.items.link
  - Radark.itemDetails.items.context

Playbooks

Get RaDark Detailed Items

Added 5 new sub-playbooks to make the Get RaDark Detailed Items playbook more clear. Each sub-playbook handle the grid setting base on incident sub-types:
- Set RaDark Grid For Credit Cards
- Set RaDark Grid For Network Vulnerabilities
- Set RaDark Grid For Compromised Accounts
- Set RaDark Grid For Leaked Credentials
- Set RaDark Grid For Hacking Discussions

Incident Fields

KELA RaDark Table Credit Cards
KELA RaDark Table Credit Cards From Instant Messaging
KELA RaDark Table Hacking Discussions
KELA RaDark Table Information Disclosure
KELA RaDark Table Sensitive Hosts
KELA RaDark Table TwoEasy
KELA RaDark Table Vulnerable Services Database
KELA RaDark Table Vulnerable Services File Sharing
KELA RaDark Table Vulnerable Services Insecure Network Services
KELA RaDark Table Vulnerable Services Message Broker
KELA RaDark Table Vulnerable Services Remote Control
KELA RaDark Table Vulnerable Services SCADA
KELA RaDark Table Vulnerable Technologies
KELA RaDark Table Web Applications Vulnerabilities
KELA RaDark Details
KELA RaDark Incident URL
KELA RaDark Monitor ID
KELA RaDark Sub Type
KELA RaDark Table Agressor
KELA RaDark Table Botnets
KELA RaDark Table Leaked Credentials From Citadel
KELA RaDark Table Leaked Credentials From Dump
KELA RaDark Table Leaked Credentials From Hacking Discussions
KELA RaDark Table Leaked Credentials From Instant Messaging
KELA RaDark Table Russian Market
#####

Layouts

RaDark Layout

Attach new incident fields to items tab to support displayment for all Network Vulnerabilities,
Credit Cards and Hacking Discussions incident sub-types.

Scripts

MapRaDarkIncidentDetails

Docker image updated to demisto/python3:3.9.8.24399.
-Credit Cards and Hacking Discussions incident sub-types.

Related pull requests:
- 15991
- 15829

Download

1.0.1 - 1775750 (October 10, 2021)

Integrations

RaDark

Fixed an issue in which the radark-item-purchase command failed to run because of authorization error.

Download

1.0.0 - 1773929 (September 29, 2021)

This content pack enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.

Download

PUBLISHER

KELA

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	September 29, 2021
Last Release	March 1, 2023

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.