Skip to content

Commit

Permalink
Private upload mode - docs #2 (#28619)
Browse files Browse the repository at this point in the history
* Updated Docs

* Added RNs

* updated RN

* updated known words

* updated known words

* updated Mandiant RNs

* Updated CTIX .pack-ignore
  • Loading branch information
darkushin authored Aug 7, 2023
1 parent eee00bd commit a85937b
Show file tree
Hide file tree
Showing 25 changed files with 93 additions and 8 deletions.
1 change: 1 addition & 0 deletions Packs/CTIX/.pack-ignore
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,5 @@ ignore=RM104
[known_words]
cyware
ctix
eXchange

8 changes: 7 additions & 1 deletion Packs/CTIX/Integrations/CTIX/CTIX_description.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,10 @@
b. Endpoint URL: Enter the endpoint URL of your CTIX Instance. The Endpoint URL can be generated by a licensed user from the CTIX application. For example, https://<domain_name>/ctixapi/openapi/
c. Access Key: Enter the Access Key from the CTIX application. The Access Key can be generated by a licensed user from the CTIX application. For example, “74xxxxx7-xxxb-4xxa-xxxx-0xxxxxxxxxx2“.
d. Secret Key: Enter the Secret Key from the CTIX application. The Secret Key can be generated by a licensed user from the CTIX application. For example, “0xxxxxx8-xxxx-4xx4-xxx6-5xxxxxxxxxxc”.
5. After finishing, click the “Test“ button to validate the URL, Token, and Connection.
5. After finishing, click the “Test“ button to validate the URL, Token, and Connection.


Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.
4 changes: 4 additions & 0 deletions Packs/CTIX/Integrations/CTIX/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,8 @@ Return IP Details.
***
Return Domain Details.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down Expand Up @@ -418,6 +420,8 @@ Return Domain Details.
***
Return URL Details.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down
7 changes: 6 additions & 1 deletion Packs/CTIX/Integrations/CTIXv3/CTIXv3_description.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,9 @@
b. Endpoint URL: Enter the endpoint URL of your CTIX Instance. The Endpoint URL can be generated by a licensed user from the CTIX application. For example, https://<domain_name>/ctixapi/openapi/
c. Access Key: Enter the Access Key from the CTIX application. The Access Key can be generated by a licensed user from the CTIX application. For example, “74xxxxx7-xxxb-4xxa-xxxx-0xxxxxxxxxx2“.
d. Secret Key: Enter the Secret Key from the CTIX application. The Secret Key can be generated by a licensed user from the CTIX application. For example, “0xxxxxx8-xxxx-4xx4-xxx6-5xxxxxxxxxxc”.
5. After finishing, click the “Test“ button to validate the URL, Token, and Connection.
5. After finishing, click the “Test“ button to validate the URL, Token, and Connection.

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.
4 changes: 4 additions & 0 deletions Packs/CTIX/Integrations/CTIXv3/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -1645,6 +1645,8 @@ Gets or creates threat data
***
Lookup domain threat data

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

`domain`
Expand Down Expand Up @@ -2013,6 +2015,8 @@ Lookup file threat data
***
Lookup url threat data

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

`url`
Expand Down
10 changes: 10 additions & 0 deletions Packs/CTIX/ReleaseNotes/2_2_12.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@

#### Integrations

##### Cyware Threat Intelligence eXchange

Documentation and metadata improvements.

##### CTIX v3

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/CTIX/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "CTIX",
"description": "Cyware Threat Intelligence eXchange",
"support": "partner",
"currentVersion": "2.2.11",
"currentVersion": "2.2.12",
"author": "Cyware Labs",
"url": "https://cyware.com/",
"email": "[email protected]",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,3 +22,8 @@ You can modify the severity levels of any disposition received from CheckPhish.
- Bad = cryptojacking, phish, likely_phish, scam\

**Note**: The worst category in which a label is included will be the effective one.

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***CheckPhish-check-urls***
See the vendor’s documentation for more details.
4 changes: 4 additions & 0 deletions Packs/CheckPhish/Integrations/CheckPhish/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ After you successfully execute a command, a DBot message appears in the War Room
***
Checks URLs against the CheckPhish database and returns the results.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down Expand Up @@ -94,6 +96,8 @@ Checks URLs against the CheckPhish database and returns the results.
***
Retrieves URL information from CheckPhish.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


#### Base Command

Expand Down
6 changes: 6 additions & 0 deletions Packs/CheckPhish/ReleaseNotes/1_0_19.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### CheckPhish

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/CheckPhish/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "CheckPhish",
"description": "Check any URL to detect supsicious behavior.",
"support": "xsoar",
"currentVersion": "1.0.18",
"currentVersion": "1.0.19",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,5 @@ Execute queries on URLs and IP addresses, and get information for domains.

**API Token**
The credentials entered here should be those created in the [JsonWhoIs site](https://jsonwhois.com/) for REST API.

Notice: Submitting indicators using the ***whois*** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details.
3 changes: 3 additions & 0 deletions Packs/JsonWhoIs/Integrations/JsonWhoIs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ You can execute these commands from the Cortex XSOAR CLI, as part of an automati

Returns enriched data for Domains, URLs, and IP addresses.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.


##### Base Command

`whois`
Expand Down
6 changes: 6 additions & 0 deletions Packs/JsonWhoIs/ReleaseNotes/1_0_21.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### JsonWhoIs

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/JsonWhoIs/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "JsonWhoIs",
"description": "Provides data enrichment for domains and IP addresses.",
"support": "xsoar",
"currentVersion": "1.0.20",
"currentVersion": "1.0.21",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
2 changes: 2 additions & 0 deletions Packs/MandiantAdvantageThreatIntelligence/.pack-ignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[known_words]
Mandiant
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,9 @@ Mandiant Advantage Threat Intelligence Integration
### Get Credentials
- Log into `advantage.mandiant.com`
- Navigate to `Settings`, then scroll down to `APIv4 Access and Key`
- Click `Get Key ID and Secret`
- Click `Get Key ID and Secret`

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.
Original file line number Diff line number Diff line change
Expand Up @@ -1528,6 +1528,8 @@ Retrieve information about an IP Address from Mandiant
***
Retrieve information about a URL from Mandiant

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

`url`
Expand Down Expand Up @@ -1643,6 +1645,8 @@ Retrieve information about a URL from Mandiant
***
Retrieve information about an FQDN from Mandiant

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

`domain`
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Mandiant Advantage Threat Intelligence

Documentation and metadata improvements.
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Mandiant Advantage Threat Intelligence",
"description": "Integrate your Mandiant Advantage Threat Intelligence data with Cortex XSOAR",
"support": "partner",
"currentVersion": "1.0.6",
"currentVersion": "1.0.7",
"author": "Mandiant",
"hidden": false,
"url": "https://www.mandiant.com/support",
Expand Down
2 changes: 2 additions & 0 deletions Packs/McAfee_Advanced_Threat_Defense/.pack-ignore
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,5 @@ ignore=BA108,BA109,IN124
[file:McAfee_Advanced_Threat_Defense_image.png]
ignore=IM111

[known_words]
McAfee
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,5 @@ To use the full capabilities of this integration, make sure your user has the fo
The user must also have the "Allow Multiple Logins" capability.
Go to Manage -> ATD Configuration -> ATD Users -> User Configuration
Enable the "Allow Multiple Logins" checkbox for the relevant user.

Notice: Submitting indicators using the ***atd-file-upload*** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details.
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@
<h3 id="h_53523308371535891435690">1. Upload a file</h3>
<hr>
<p>Upload a file or Web URL for dynamic analysis using the specified Analyzer Profile. You can only submit a single file or Web URL in each command.</p>
<p>Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
</p>
<h5>Base Command</h5>
<p><code>atd-file-upload</code></p>
<h5>Input</h5>
Expand Down
6 changes: 6 additions & 0 deletions Packs/McAfee_Advanced_Threat_Defense/ReleaseNotes/1_0_25.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### McAfee Advanced Threat Defense

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/McAfee_Advanced_Threat_Defense/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "McAfee Advanced Threat Defense",
"description": "Integrated advanced threat detection: Enhancing protection from network edge to endpoint",
"support": "xsoar",
"currentVersion": "1.0.24",
"currentVersion": "1.0.25",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down

0 comments on commit a85937b

Please sign in to comment.