Guillaume BOURGEOIS
fcf516ca82
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
85 lines
3.2 KiB
YAML
85 lines
3.2 KiB
YAML
id: recorded_future_asi
|
|
name: Recorded Future ASI
|
|
version: 1.0.0
|
|
description: "Recorded Future Attack Surface Intelligence (SecurityTrails) — fetch attack-surface risk issues for a project (ingestion), and query recent added issues globally or grouped by host."
|
|
changelog: "1.0.0 — Initial release: project issue ingestion (project_issues) with an OCSF mapper, plus recent-issues and recent-issues-by-host queries."
|
|
category: enrichment
|
|
|
|
# Per-instance configuration. The SecurityTrails ASI API is authenticated with an
|
|
# API key sent in the APIKEY header and scoped to a project.
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "SecurityTrails / ASI API key"
|
|
x-soar-sensitive: true
|
|
project_id:
|
|
type: string
|
|
description: "ASI Project ID to fetch issues from"
|
|
min_severity:
|
|
type: string
|
|
description: "Minimum issue severity to fetch: Informational, Moderate or Critical (default Moderate)"
|
|
default: Moderate
|
|
required:
|
|
- api_key
|
|
- project_id
|
|
|
|
auth:
|
|
- id: apikey
|
|
type: api_key
|
|
in: header
|
|
name: APIKEY
|
|
value_template: "{{secret}}"
|
|
secret_field: api_key
|
|
|
|
commands:
|
|
# ── Ingestion ───────────────────────────────────────────────────────────────
|
|
- id: project_issues
|
|
name: asi-project-issues
|
|
description: "Fetch the current attack-surface risk issues for the project. Used for ingestion: results path = data. Issues below the configured minimum severity are filtered out."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
snapshot: { type: string, description: "Snapshot to read (default 'recent')" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: data
|
|
dedup_key: name
|
|
|
|
- id: recent_issues
|
|
name: asi-recent-issues
|
|
description: "List risk issues added to the project since a given time, filtered by the configured minimum severity."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start: { type: string, description: "Lower bound: a timestamp or snapshot date" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: recent_issues_by_host
|
|
name: asi-recent-issues-by-host
|
|
description: "List hosts with risk issues added since a given time, with per-host risk-score changes."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
last_checked: { type: string, description: "Lower bound: a timestamp or snapshot date" }
|
|
limit: { type: number, description: "Maximum number of hosts to return (default 200)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Connectivity test ─────────────────────────────────────────────────────
|
|
- id: test_connection
|
|
name: asi-test-connection
|
|
description: "Verify connectivity, credentials and project access (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: project_issues
|
|
mapper: project_issues
|
|
default_incident_type: "Recorded Future ASI Issue"
|