Skip to content

Commit 53a9179

Browse files
sodle-splunksodle-splunk
authored
Merge pull request #2 from splunk-soar-connectors/next
Merging next to main for release 1.0.1
2 parents 6203814 + 0cbd0b8 commit 53a9179

33 files changed

+1199
-10
lines changed

‎.github/workflows/linting.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linting
22
on: [push, pull_request]
33
jobs:
4-
lint:
4+
lint:
55
# Run per push for internal contributers. This isn't possible for forked pull requests,
66
# so we'll need to run on PR events for external contributers.
77
# String comparison below is case insensitive.

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.vscode/

‎.pre-commit-config.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
repos:
22
- repo: https://github.com/phantomcyber/dev-cicd-tools
3-
rev: v1.13
3+
rev: v1.23
44
hooks:
55
- id: org-hook
66
- id: package-app-dependencies
77
- repo: https://github.com/Yelp/detect-secrets
8-
rev: v1.2.0
8+
rev: v1.5.0
99
hooks:
1010
- id: detect-secrets
11-
args: ['--no-verify']
11+
args: ['--no-verify', '--exclude-files', '^gsgmail.json$']

‎LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@
186186
same "printed page" as the copyright notice for easier
187187
identification within third-party archives.
188188

189-
Copyright 2024 Splunk Inc.
189+
Copyright (c) 2024 Splunk Inc.
190190

191191
Licensed under the Apache License, Version 2.0 (the "License");
192192
you may not use this file except in compliance with the License.

‎README.md

Lines changed: 134 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,138 @@
1-
# Splunk> Phantom
1+
[comment]: # "Auto-generated SOAR connector documentation"
2+
# Cisco Talos Intelligence
23

3-
Welcome to the open-source repository for Splunk> Phantom's talosintelligencev2 App.
4+
Publisher: Splunk
5+
Connector Version: 1.0.1
6+
Product Vendor: Cisco
7+
Product Name: Talos Intelligence
8+
Product Version Supported (regex): ".\*"
9+
Minimum Product Version: 6.3.0
410

5-
Please have a look at our [Contributing Guide](https://github.com/Splunk-SOAR-Apps/.github/blob/main/.github/CONTRIBUTING.md) if you are interested in contributing, raising issues, or learning more about open-source Phantom apps.
11+
This app provides investigative actions for Cisco Talos Intelligence
612

7-
## Legal and License
13+
[comment]: # " File: README.md"
14+
[comment]: # "Copyright (c) 2024 Splunk Inc."
15+
[comment]: # ""
16+
[comment]: # "Licensed under the Apache License, Version 2.0 (the 'License');"
17+
[comment]: # "you may not use this file except in compliance with the License."
18+
[comment]: # "You may obtain a copy of the License at"
19+
[comment]: # ""
20+
[comment]: # " http://www.apache.org/licenses/LICENSE-2.0"
21+
[comment]: # ""
22+
[comment]: # "Unless required by applicable law or agreed to in writing, software distributed under"
23+
[comment]: # "the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,"
24+
[comment]: # "either express or implied. See the License for the specific language governing permissions"
25+
[comment]: # "and limitations under the License."
26+
[comment]: # ""
27+
## Cisco Talos Intelligence license for Splunk SOAR (Cloud)
828

9-
This Phantom App is licensed under the Apache 2.0 license. Please see our [Contributing Guide](https://github.com/Splunk-SOAR-Apps/.github/blob/main/.github/CONTRIBUTING.md#legal-notice) for further details.
29+
The Cisco Talos Intelligence license is included with your Splunk SOAR (Cloud) license.
30+
31+
## Overview
32+
33+
This app uses the Cisco Talos API that specializes in identifying, analyzing, and mitigating cybersecurity threats.
34+
35+
For additional details, see the [Cisco Talos Intelligence article](https://docs.splunk.com/Documentation/SOAR/current/Playbook/Talos) in the Splunk SOAR documentation.
36+
37+
**Note:** The Cisco Talos Intelligence asset is already configured in your Splunk SOAR (Cloud) deployment.
38+
39+
### Supported Actions
40+
[test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration
41+
[ip reputation](#action-ip-reputation) - Look up Cisco Talos threat intelligence for a given IP address
42+
[domain reputation](#action-domain-reputation) - Look up Cisco Talos threat intelligence for a given domain
43+
[url reputation](#action-url-reputation) - Look up Cisco Talos threat intelligence for a given URL
44+
45+
## action: 'test connectivity'
46+
Validate the asset configuration for connectivity using supplied configuration
47+
48+
Type: **test**
49+
Read only: **True**
50+
51+
Action uses the URS API to get a list of the AUP categories used to classify website content.
52+
53+
#### Action Parameters
54+
No parameters are required for this action
55+
56+
#### Action Output
57+
No Output
58+
59+
## action: 'ip reputation'
60+
Look up Cisco Talos threat intelligence for a given IP address
61+
62+
Type: **investigate**
63+
Read only: **True**
64+
65+
Provides information on an IP address's reputation, so you can take appropriate action against untrusted or unwanted resources.
66+
67+
#### Action Parameters
68+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
69+
--------- | -------- | ----------- | ---- | --------
70+
**ip** | required | IP to query | string | `ip` `ipv6`
71+
72+
#### Action Output
73+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
74+
--------- | ---- | -------- | --------------
75+
action_result.parameter.ip | string | `ip` `ipv6` |
76+
action_result.status | string | |
77+
action_result.message | string | |
78+
summary.total_objects | numeric | |
79+
summary.total_objects_successful | numeric | |
80+
action_result.data.\*.Observable | string | |
81+
action_result.data.\*.Threat_Level | string | |
82+
action_result.data.\*.Threat_Categories | string | |
83+
action_result.data.\*.AUP | string | |
84+
action_result.summary.message | string | | 72.163.4.185 has a Favorable threat level
85+
86+
## action: 'domain reputation'
87+
Look up Cisco Talos threat intelligence for a given domain
88+
89+
Type: **investigate**
90+
Read only: **True**
91+
92+
Provides information on a domain's reputation, so you can take appropriate action against untrusted or unwanted resources.
93+
94+
#### Action Parameters
95+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
96+
--------- | -------- | ----------- | ---- | --------
97+
**domain** | required | Domain to query | string | `domain`
98+
99+
#### Action Output
100+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
101+
--------- | ---- | -------- | --------------
102+
action_result.parameter.domain | string | `domain` |
103+
action_result.status | string | |
104+
action_result.message | string | |
105+
summary.total_objects | numeric | |
106+
summary.total_objects_successful | numeric | |
107+
action_result.data.\*.Observable | string | |
108+
action_result.data.\*.Threat_Level | string | |
109+
action_result.data.\*.Threat_Categories | string | |
110+
action_result.data.\*.AUP | string | |
111+
action_result.summary.message | string | | splunk.com has a Favorable threat level
112+
113+
## action: 'url reputation'
114+
Look up Cisco Talos threat intelligence for a given URL
115+
116+
Type: **investigate**
117+
Read only: **True**
118+
119+
Provides information on a URL's reputation, so you can take appropriate action against untrusted or unwanted resources.
120+
121+
#### Action Parameters
122+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
123+
--------- | -------- | ----------- | ---- | --------
124+
**url** | required | URL to query | string | `url`
125+
126+
#### Action Output
127+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
128+
--------- | ---- | -------- | --------------
129+
action_result.parameter.url | string | `url` |
130+
action_result.status | string | |
131+
action_result.message | string | |
132+
summary.total_objects | numeric | |
133+
summary.total_objects_successful | numeric | |
134+
action_result.data.\*.Observable | string | |
135+
action_result.data.\*.Threat_Level | string | |
136+
action_result.data.\*.Threat_Categories | string | |
137+
action_result.data.\*.AUP | string | |
138+
action_result.summary.message | string | | https://splunk.com has a Favorable threat level

‎__init__.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# File: __init__.py
2+
#
3+
# Copyright (c) 2024 Splunk Inc.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software distributed under
12+
# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
13+
# either express or implied. See the License for the specific language governing permissions
14+
# and limitations under the License.

0 commit comments

Comments
 (0)