diff --git a/_shared_content/automate/library/sekoia-io.md b/_shared_content/automate/library/sekoia-io.md index ddb76729f6..802dcb41ff 100644 --- a/_shared_content/automate/library/sekoia-io.md +++ b/_shared_content/automate/library/sekoia-io.md @@ -149,6 +149,7 @@ Get all non-revoked objects from Sekoia.io Intelligence feed | Name | Type | Description | | --------- | ------- | --------------------------- | | `feed_id` | `string` | ID of the Sekoia.io feed to get data from | +| `to_file` | `boolean` | Whether the event should be saved in a file or sent directly | **Outputs** @@ -156,6 +157,7 @@ Get all non-revoked objects from Sekoia.io Intelligence feed | Name | Type | Description | | --------- | ------- | --------------------------- | | `stix_objects` | `object` | STIX objects returned by the feed | +| `stix_objects_path` | `string` | Filepath of the STIX objects fetched from the collection | ### Feed IOC Consumption @@ -167,6 +169,7 @@ Get all valid IOCs from Sekoia.io Intelligence feed | Name | Type | Description | | --------- | ------- | --------------------------- | | `feed_id` | `string` | ID of the Sekoia.io feed to get data from | +| `to_file` | `boolean` | Whether the event should be saved in a file or sent directly | **Outputs** @@ -174,6 +177,7 @@ Get all valid IOCs from Sekoia.io Intelligence feed | Name | Type | Description | | --------- | ------- | --------------------------- | | `stix_objects` | `object` | IOCs returned by the feed (STIX objects) | +| `stix_objects_path` | `string` | Filepath of the STIX objects fetched from the collection | ### Any Alert Update @@ -245,6 +249,19 @@ Mark as active a countermeasure | `assignee` | `string` | UUID of the profile assigned to the progress of the countermeasure | | `created_at` | `string` | Date the countermeasure was created | +### Add IOC to IOC Collection + +Add indicators to an IOC Collection + +**Arguments** + +| Name | Type | Description | +| --------- | ------- | --------------------------- | +| `indicators` | `array` | List of indicators to add to an IOC collection | +| `indicators_path` | `string` | Path of the indicators file to add to an IOC collection | +| `ioc_collection_id` | `string` | Identifier of the IOC collection | +| `indicator_type` | `string` | Type of IOC | + ### Add attribute to Asset Add an attribute to an asset @@ -483,6 +500,17 @@ Retrieve the definition of an alert | `title` | `string` | | | `target` | `string` | | +### Get context + +Get reports from a specific term + +**Arguments** + +| Name | Type | Description | +| --------- | ------- | --------------------------- | +| `sort` | `string` | | +| `term` | `string` | | + ### Get Event Field Common Values Get the most common values of fields observed under a specific query @@ -495,6 +523,7 @@ Get the most common values of fields observed under a specific query | `earliest_time` | `string` | The earliest time of the time range of the search | | `latest_time` | `string` | The latest time of the time range of the search | | `fields` | `string` | Fields to compute the most common values (use a coma between fields) | +| `limit` | `number` | Maximum number of events to retrieve | **Outputs** @@ -514,6 +543,7 @@ Query events | `query` | `string` | Event search query | | `earliest_time` | `string` | The earliest time of the time range of the search | | `latest_time` | `string` | The latest time of the time range of the search | +| `limit` | `number` | Maximum number of events to retrieve | **Outputs** @@ -852,4 +882,4 @@ Triggers an action on an alert to update its status ## Extra -Module **`Sekoia.io` v2.43** \ No newline at end of file +Module **`Sekoia.io` v2.56.1** \ No newline at end of file diff --git a/docs/assets/playbooks/library/sekoia-io.svg b/docs/assets/playbooks/library/sekoia-io.svg index 6750360ef6..b8bb04344b 100644 --- a/docs/assets/playbooks/library/sekoia-io.svg +++ b/docs/assets/playbooks/library/sekoia-io.svg @@ -1,3 +1,3 @@ - - + + diff --git a/mkdocs.yml b/mkdocs.yml index 7ab32dab97..0ab335c9bf 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -298,6 +298,7 @@ nav: - RiskIQ: xdr/features/automate/library/riskiq.md - STIX: xdr/features/automate/library/stix.md - Sekoia.io: xdr/features/automate/library/sekoia-io.md + - Sekoia.io: xdr/features/automate/library/sekoia-io.md - SentinelOne: xdr/features/automate/library/sentinelone.md - ServiceNow: xdr/features/automate/library/servicenow.md - Shodan: xdr/features/automate/library/shodan.md @@ -473,6 +474,7 @@ nav: - RiskIQ: tip/features/automate/library/riskiq.md - STIX: tip/features/automate/library/stix.md - Sekoia.io: tip/features/automate/library/sekoia-io.md + - Sekoia.io: tip/features/automate/library/sekoia-io.md - SentinelOne: tip/features/automate/library/sentinelone.md - ServiceNow: tip/features/automate/library/servicenow.md - Shodan: tip/features/automate/library/shodan.md @@ -547,14 +549,14 @@ plugins: integrations/aws_flow_logs.md: xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md integrations/aws_s3_logs.md: xdr/features/collect/integrations/cloud_and_saas/aws/aws_s3_logs.md integrations/azure-ad.md: xdr/features/collect/integrations/cloud_and_saas/azure/intra_id.md - integrations/azure-linux.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md integrations/azure-files.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_files.md + integrations/azure-linux.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md integrations/azure-mysql.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_mysql.md integrations/azure-network-watcher.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_network_watcher.md integrations/azure-windows.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_windows.md + integrations/azure_files.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_files.md integrations/azure_front_door.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_front_door.md integrations/azure_linux.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md - integrations/azure_files.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_files.md integrations/azure_mysql.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_mysql.md integrations/azure_network_watcher.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_network_watcher.md integrations/azure_windows.md: xdr/features/collect/integrations/cloud_and_saas/azure/azure_windows.md