RiskIQ Digital Footprint

Details
Content
Dependencies
Version History

RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall and provides you with the ability to add or update assets and analyze your digital footprint from the view of the global adversary.

RiskIQ Digital Footprint software provides an active, comprehensive inventory of all of your IPs, domains, and hosts. RiskIQ scans millions of web pages and IPs every day, collecting telemetric data to produce a map of the internet. Digital Footprint uncovers and inventories all digital assets appearing online that tie back to your organization and that you depend on for your digital presence. Digital Footprint enables your security team to manage assets outside your firewall, bring unknown assets under management, and survey your digital footprint from the view of the global adversary.

This RiskIQ Digital Footprint Pack includes following entities in order to provide the aforementioned functionalities.

Integration

RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall, by bringing its details, providing you to add or update assets and analyze your digital footprint from the view of the global adversary with the help of various commands that summarize the activities performed on your assets.

Playbooks

Enrich Incident With Asset Details - RiskIQ Digital Footprint
Update Or Remove Assets - RiskIQ Digital Footprint

Enrich Incident With Asset Details - RiskIQ Digital Footprint

This playbook helps perform the following functionalities:

Enriches the incident with asset details.
Enriches the asset with the incident URL on the RiskIQ Digital Footprint platform.
Sends an email containing the owner's information to the primary or secondary contact of the asset.
Provides the user with an opportunity to update or remove the asset.

Enrich Incident With Asset Details - RiskIQ Digital Footprint

Update Or Remove Assets - RiskIQ Digital Footprint

This playbook checks if the user wants to update or remove the asset using various user inputs and performs the respective actions.

Update Or Remove Assets - RiskIQ Digital Footprint

Layouts

RiskIQ Asset Management Incident New/Edit Form

RiskIQAssetManagement_Incident_New_or_Edit_Form_View

RiskIQ Asset Management Incident Summary

RiskIQAssetManagement_Incident_Summary_View

RiskIQ Asset Management Incident Quick View

RiskIQAssetManagement_Incident_Quick_View

As part of this pack, you will also get out-of-the-box RiskIQ Asset Management incident type, RiskIQAsset indicator type, incident & indicator fields, and incident layouts. All of these are easily customizable to suit the needs of your organization.

This RiskIQ Digital Footprint Pack includes following entities in order to provide the aforementioned functionalities.

Integration

Playbooks

Enrich Incident With Asset Details - RiskIQ Digital Footprint
Update Or Remove Assets - RiskIQ Digital Footprint

Enrich Incident With Asset Details - RiskIQ Digital Footprint

This playbook helps perform the following functionalities:

Enriches the incident with asset details.
Enriches the asset with the incident URL on the RiskIQ Digital Footprint platform.
Sends an email containing the owner's information to the primary or secondary contact of the asset.
Provides the user with an opportunity to update or remove the asset.

Enrich Incident With Asset Details - RiskIQ Digital Footprint

Update Or Remove Assets - RiskIQ Digital Footprint

This playbook checks if the user wants to update or remove the asset using various user inputs and performs the respective actions.

Update Or Remove Assets - RiskIQ Digital Footprint

Layouts

RiskIQ Asset Management Incident New/Edit Form

RiskIQAssetManagement_Incident_New_or_Edit_Form_View

RiskIQ Asset Management Incident Summary

RiskIQAssetManagement_Incident_Summary_View

RiskIQ Asset Management Incident Quick View

RiskIQAssetManagement_Incident_Quick_View

Automations

Name	Description
RiskIQDigitalFootprintAssetDetailsWidgetScript	Shows the detailed information of an asset identified as a "RiskIQAsset" type of indicator in the layout of the indicator.

Incident Fields

Name	Description
RiskIQ Auto Exclude Whitelisted IP Address	Automatically add the whitelisted IP Address(es) to the exclusions list. Select 'yes' to automatically exclude the IP Address(es) or 'no' otherwise.
RiskIQ Asset AWS Security Group Name	AWS Security Group Name for which the RiskIQAsset of the "IP Address" type is to be whitelisted.
RiskIQ Asset Name	The name of the asset. This field supports a single value only.
RiskIQ Skip Manual Tasks	Check this checkbox in order to skip the manual tasks of the "Enrich Incident With Asset Details" playbook.
RiskIQ Auto Whitelist IP Address	Automatically whitelist the IP Address(es). Select 'yes' to automatically start the process of whitelisting or 'no' otherwise.
RiskIQ Asset Owner	The owner of the asset fetched from the RiskIQ Digital Footprint asset details.
RiskIQ Asset GCP Firewall Name	GCP Firewall Name for which the RiskIQAsset of the "IP Address" type is to be whitelisted.
RiskIQ Asset Contact	The contact information of the asset fetched from the RiskIQ Digital Footprint asset details.
RiskIQ Support Contact	The contact email address of the support team from which manual inputs should be fetched.
RiskIQ Asset Okta Zone ID	Okta Zone ID for which the RiskIQAsset of the "IP Address" type is to be whitelisted.
RiskIQ Asset Type	The type of the asset.

Incident Types

Name	Description
RiskIQ Asset Management

Indicator Fields

Name	Description
RiskIQAsset UUID	Unique identifier of the asset on RiskIQ Digital Footprint.
RiskIQAsset Brands	Name(s) of the brand(s) applied to the asset.
RiskIQAsset Tags	Name(s) of the tag(s) applied to the asset.
RiskIQAsset Priority	Priority of the asset.
RiskIQAsset Organizations	Name(s) of the organization(s) applied to the asset.
RiskIQAsset CVEs	CVEs detected from the details of the RiskIQ Asset.
RiskIQAsset Type	The type of the asset.
RiskIQAsset Last Seen	Date and Time when the asset was most recently observed on RiskIQ Digital Footprint.
RiskIQAsset Confidence	Discovery confidence level of the asset.
RiskIQAsset Inventory Status	Inventory status of the asset.
RiskIQAsset Last Updated	Date and Time when the most recent update was performed on the asset by a user action on RiskIQ Digital Footprint.
RiskIQAsset Enterprise Asset	Has the asset been designated as an enterprise asset by RiskIQ Digital Footprint.
RiskIQAsset Added To Inventory	Date and Time when that asset was added to RiskIQ Digital Footprint inventory.
RiskIQAsset First Seen	Date and Time when the asset was first observed on RiskIQ Digital Footprint.

Integrations

Name	Description
RiskIQ Digital Footprint (Community Contribution)	The RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall. Using the integration, you can view asset details, add or update assets and analyze your digital footprint from the adversary's perspective.

Layouts

Name	Description
RiskIQ Asset Management Incident	RiskIQ Asset Management Incident Layout
RiskIQAsset Indicator	RiskIQAsset Indicator Layout

Playbooks

Name	Description
IP Whitelist And Exclusion - RiskIQ Digital Footprint	Adds the IP Address(es) to allow list after checking if it should be added to allow list according to the user inputs provided. This playbook also adds these IP Address indicators to the exclusion list and tags it with the "RiskIQ Whitelisted IP Address" tag.
Check IP Address For Whitelisting - RiskIQ Digital Footprint	Checks if the provided IP Address should be added to allow list and excluded or not. Use this playbook as a sub-playbook to loop over multiple IP Addresses to check if they should be added to allow list and excluded.
RiskIQAsset Basic Information Enrichment - RiskIQ Digital Footprint	This playbook receives indicators from its parent playbook and enriches the basic information and the detected CVEs for the "RiskIQAsset" type of indicators. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators. Supported Integrations: RiskIQ Digital Footprint VulnDB CVE Search IBM X-Force
Auto Update Or Remove Assets - RiskIQ Digital Footprint	This playbook automatically updates or removes the provided asset(s) from the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to update or remove multiple assets. Supported integration: RiskIQ Digital Footprint
Auto Add Assets - RiskIQ Digital Footprint	This playbook automatically adds the provided asset(s) to the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to add multiple assets. Supported integration: RiskIQ Digital Footprint
RiskIQAsset Enrichment - RiskIQ Digital Footprint	Enriches the "RiskIQAsset" type of indicators with basic information and CVEs detected for the asset, performs a vulnerability scan for "Host" and "IP Address" type of assets, and enriches received information in the context as well as provides the user to add to allow list a list of "IP Address" type of assets. This playbook also enriches the detected CVEs. To select the indicators you want to enrich, go to playbook inputs, choose "from indicators" and set your query. For example type:RiskIQAsset etc. The default playbook query is "type:RiskIQAsset". In case indicators with specific "riskiqassettype" are to be enriched, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators. Supported integrations: RiskIQ Digital Footprint Tenable.io Google Cloud Compute AWS - EC2 Okta v2
Update Or Remove Assets - RiskIQ Digital Footprint	Using various user inputs, this playbook checks if the user wants to update or remove an asset, and performs the respective actions. Supported integration: RiskIQ Digital Footprint
Add Unknown Indicators To Inventory - RiskIQ Digital Footprint	Adds the unknown indicators or updates/removes the indicators identified as a known asset in the RiskIQ Digital Footprint inventory according to the user inputs for each asset. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example reputation:None etc. The purpose of the playbook is to check if the indicators with the unknown reputation are known assets. The default playbook query is "reputation:None". In case indicators with different reputations are to be added to the inventory, the query must be edited accordingly. This playbook cannot be run in quiet mode. This playbook needs to be used with caution as it might use up the integration’s API license when running for large amounts of indicators. Supported integration: RiskIQ Digital Footprint
Enrich Incident With Asset Details - RiskIQ Digital Footprint	Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: RiskIQ Digital Footprint
Check Indicators For Unknown Assets - RiskIQ Digital Footprint	This playbook receives indicators from its parent playbook and checks if the indicator is an unknown or a known asset in the RiskIQ Digital Footprint inventory and gives out a list of the unknown as well as known assets. This playbook cannot be run in quiet mode. This playbook needs to be used with caution as it might use up the integration’s API license when running for large amounts of indicators. Supported integration: RiskIQ Digital Footprint
Vulnerability Scan - RiskIQ Digital Footprint - Tenable.io	Performs a vulnerability scan for an asset of type "Host" and "IP Address" using Tenable.io integration. Supported integration: Tenable.io

Indicator Types

Name	Description
RiskIQAsset

Automations

Name	Description
RiskIQDigitalFootprintAssetDetailsWidgetScript	Shows the detailed information of an asset identified as a "RiskIQAsset" type of indicator in the layout of the indicator.

Incident Fields

Name	Description
RiskIQ Asset Owner	The owner of the asset fetched from the RiskIQ Digital Footprint asset details.
RiskIQ Asset Name	The name of the asset. This field supports a single value only.
RiskIQ Auto Whitelist IP Address	Automatically whitelist the IP Address(es). Select 'yes' to automatically start the process of whitelisting or 'no' otherwise.
RiskIQ Asset Contact	The contact information of the asset fetched from the RiskIQ Digital Footprint asset details.
RiskIQ Asset Okta Zone ID	Okta Zone ID for which the RiskIQAsset of the "IP Address" type is to be whitelisted.
RiskIQ Asset Type	The type of the asset.
RiskIQ Skip Manual Tasks	Check this checkbox in order to skip the manual tasks of the "Enrich Incident With Asset Details" playbook.
RiskIQ Support Contact	The contact email address of the support team from which manual inputs should be fetched.
RiskIQ Asset AWS Security Group Name	AWS Security Group Name for which the RiskIQAsset of the "IP Address" type is to be whitelisted.
RiskIQ Auto Exclude Whitelisted IP Address	Automatically add the whitelisted IP Address(es) to the exclusions list. Select 'yes' to automatically exclude the IP Address(es) or 'no' otherwise.

Incident Types

Name	Description
RiskIQ Asset Management

Indicator Fields

Name	Description
RiskIQAsset Type	The type of the asset.
RiskIQAsset Enterprise Asset	Has the asset been designated as an enterprise asset by RiskIQ Digital Footprint.
RiskIQAsset Tags	Name(s) of the tag(s) applied to the asset.
RiskIQAsset Brands	Name(s) of the brand(s) applied to the asset.
RiskIQAsset Last Updated	Date and Time when the most recent update was performed on the asset by a user action on RiskIQ Digital Footprint.
RiskIQAsset Inventory Status	Inventory status of the asset.
RiskIQAsset First Seen	Date and Time when the asset was first observed on RiskIQ Digital Footprint.
RiskIQAsset Added To Inventory	Date and Time when that asset was added to RiskIQ Digital Footprint inventory.
RiskIQAsset Confidence	Discovery confidence level of the asset.
RiskIQAsset Organizations	Name(s) of the organization(s) applied to the asset.
RiskIQAsset UUID	Unique identifier of the asset on RiskIQ Digital Footprint.
RiskIQAsset Last Seen	Date and Time when the asset was most recently observed on RiskIQ Digital Footprint.
RiskIQAsset Priority	Priority of the asset.
RiskIQAsset CVEs	CVEs detected from the details of the RiskIQ Asset.

Integrations

Name	Description
RiskIQ Digital Footprint (Community Contribution)	The RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall. Using the integration, you can view asset details, add or update assets and analyze your digital footprint from the adversary's perspective.

Layouts

Name	Description
RiskIQAsset Indicator	RiskIQAsset Indicator Layout

Playbooks

Name	Description
Update Or Remove Assets - RiskIQ Digital Footprint	Using various user inputs, this playbook checks if the user wants to update or remove an asset, and performs the respective actions. Supported integration: RiskIQ Digital Footprint
Check Indicators For Unknown Assets - RiskIQ Digital Footprint	This playbook receives indicators from its parent playbook and checks if the indicator is an unknown or a known asset in the RiskIQ Digital Footprint inventory and gives out a list of the unknown as well as known assets. This playbook cannot be run in quiet mode. This playbook needs to be used with caution as it might use up the integration’s API license when running for large amounts of indicators. Supported integration: RiskIQ Digital Footprint
RiskIQAsset Enrichment - RiskIQ Digital Footprint	Enriches the "RiskIQAsset" type of indicators with basic information and CVEs detected for the asset, performs a vulnerability scan for "Host" and "IP Address" type of assets, and enriches received information in the context as well as provides the user to add to allow list a list of "IP Address" type of assets. This playbook also enriches the detected CVEs. To select the indicators you want to enrich, go to playbook inputs, choose "from indicators" and set your query. For example type:RiskIQAsset etc. The default playbook query is "type:RiskIQAsset". In case indicators with specific "riskiqassettype" are to be enriched, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators. Supported integrations: RiskIQ Digital Footprint Tenable.io Google Cloud Compute AWS - EC2 Okta v2
Enrich Alert With Asset Details - RiskIQ Digital Footprint	Enriches the alert with asset details, and enriches the asset with the alert URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: RiskIQ Digital Footprint
Check IP Address For Whitelisting - RiskIQ Digital Footprint	Checks if the provided IP Address should be added to allow list and excluded or not. Use this playbook as a sub-playbook to loop over multiple IP Addresses to check if they should be added to allow list and excluded.
IP Whitelist And Exclusion - RiskIQ Digital Footprint	Adds the IP Address(es) to allow list after checking if it should be added to allow list according to the user inputs provided. This playbook also adds these IP Address indicators to the exclusion list and tags it with the "RiskIQ Whitelisted IP Address" tag.
RiskIQAsset Basic Information Enrichment - RiskIQ Digital Footprint	This playbook receives indicators from its parent playbook and enriches the basic information and the detected CVEs for the "RiskIQAsset" type of indicators. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators. Supported Integrations: RiskIQ Digital Footprint VulnDB CVE Search IBM X-Force
Add Unknown Indicators To Inventory - RiskIQ Digital Footprint	Adds the unknown indicators or updates/removes the indicators identified as a known asset in the RiskIQ Digital Footprint inventory according to the user inputs for each asset. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example reputation:None etc. The purpose of the playbook is to check if the indicators with the unknown reputation are known assets. The default playbook query is "reputation:None". In case indicators with different reputations are to be added to the inventory, the query must be edited accordingly. This playbook cannot be run in quiet mode. This playbook needs to be used with caution as it might use up the integration’s API license when running for large amounts of indicators. Supported integration: RiskIQ Digital Footprint
Auto Update Or Remove Assets - RiskIQ Digital Footprint	This playbook automatically updates or removes the provided asset(s) from the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to update or remove multiple assets. Supported integration: RiskIQ Digital Footprint
Auto Add Assets - RiskIQ Digital Footprint	This playbook automatically adds the provided asset(s) to the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to add multiple assets. Supported integration: RiskIQ Digital Footprint
Vulnerability Scan - RiskIQ Digital Footprint - Tenable.io	Performs a vulnerability scan for an asset of type "Host" and "IP Address" using Tenable.io integration. Supported integration: Tenable.io

Indicator Types

Name	Description
RiskIQAsset

Required Content Packs (8)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
NIST	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
SANS	By: Cortex XSOAR

Optional Content Packs (4)

Pack Name	Pack By
AWS - EC2	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Okta	By: Cortex XSOAR
Tenable Vulnerability Management (formerly Tenable.io)	By: Cortex XSOAR

All level dependencies (11)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Base	By: Cortex XSOAR
NIST	By: Cortex XSOAR
SANS	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Brute Force	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

1.1.21 - R995825 (May 5, 2024)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.14.91134.

Related pull requests:
- 33675

Download

1.1.20 - 865088 (March 3, 2024)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.88772.

Related pull requests:
- 33184

Download

1.1.19 - R828628 (February 14, 2024)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 32837

Download

1.1.18 - 798475 (February 1, 2024)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32533

Download

1.1.17 - 757686 (January 11, 2024)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.84405.

Related pull requests:
- 32061

Download

1.1.16 - 722180 (December 28, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31828

Download

1.1.15 - 7149458 (December 13, 2023)

Scripts

RiskIQDigitalFootprintAssetDetailsWidgetScript

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31427

Download

1.1.14 - 6887992 (November 14, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.80014.

Related pull requests:
- 30882

Download

1.1.13 - 6746892 (October 30, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.78960.

Related pull requests:
- 30518

Download

1.1.12 - 6230967 (September 4, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.13.72123.

Related pull requests:
- 29417

Download

1.1.11 - 6094945 (August 19, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.12.68714.

Related pull requests:
- 29057

Download

1.1.10 - R6076227 (August 17, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.12.66339.

Related pull requests:
- 28742

Download

1.1.9 - R5866730 (July 25, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.12.65389.

Related pull requests:
- 28387

Download

1.1.8 - R5801668 (July 18, 2023)

Scripts

RiskIQDigitalFootprintAssetDetailsWidgetScript

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27975

Download

1.1.7 - R5692327 (July 5, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27520

Download

1.1.6 - 5380611 (May 27, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.11.61265.

Related pull requests:
- 27011

Download

1.1.5 - 5250319 (May 12, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.11.58411.

Related pull requests:
- 26472

Download

1.1.4 - R5170573 (May 2, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.10.51930.

Related pull requests:
- 25648

Download

1.1.3 - 4763226 (March 7, 2023)

Integrations

RiskIQ Digital Footprint

Updated the Docker image to: demisto/python3:3.10.10.48392.

Related pull requests:
- 25111

Download

1.1.2 - R4718798 (March 1, 2023)

This pack is no longer officially supported by RiskIQ.
The support level for this pack changed to community support.

Related pull requests:
- 24683

Download

1.1.1 - R4646022 (February 19, 2023)

Layouts

RiskIQ Asset Management Incident
This item is no longer supported in XSIAM.

Related pull requests:
- 24223

Download

1.1.0 - 2704575 (April 5, 2022)

Integrations

RiskIQ Digital Footprint

Fixed linter errors.

Download

1.0.14 - 2355875 (February 3, 2022)

Incident Fields

RiskIQ Asset GCP Firewall Name

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Community
Created	September 29, 2020
Last Release	May 5, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

Tenable Vulnerability Management (formerly Tenable.io)

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.