topic Re: Adding result of new custom Integration as Threat indicators results in Cortex XSOAR Discussions

Adding result of new custom Integration as Threat indicators results

oDarweesh2 — Thu, 17 Nov 2022 15:23:52 GMT

Dears,

I made a custom Integration that get the verdict of (URLs) like (Malicious - Benign). Now I have a question How to add the name and result of this integration like the prebuilt Integrations which are in the screenshots (virus total - urlscan - etc..)..

kindly find the screenshot for claridication

Re: Adding result of new custom Integration as Threat indicators results

jfernandes1 — Fri, 18 Nov 2022 00:40:04 GMT

Hi @oDarweesh2, Your post did not contain a screenshot so I'm making an assumption that you were talking about reputation sources. When returning the indicator you need to specify the vendor. Example screenshots of code and output below.

Re: Adding result of new custom Integration as Threat indicators results

oDarweesh2 — Sun, 20 Nov 2022 08:44:07 GMT

Yes that what I am talking about.

But how to reflect it as you here put (indicator_value) in script. i replaced the values as you mentioned and when i ran it from command line. nothing changed.

Kindly find my code below in screenshot.

Re: Adding result of new custom Integration as Threat indicators results

jfernandes1 — Mon, 21 Nov 2022 00:48:01 GMT

Hi @oDarweesh2, The example that I provided cannot be run inside a warroom. Depending on the way your server is setup it may not work. Try the below method. For more information refer - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/understand-indicators/indicator-reputation/reputation-scripts.

The script I've attached below (Change extension from xml to yml) should be added as a Reputation Script inside the indicator type object.

- Go to Settings -> Object Setup -> Indicators -> Types

- Select an Indicator type and click the Edit button. Screenshot below for reference.

Depending on your server setup you can then call indicator enrichment. Try !Print value=6.6.6.6 auto-extract=inline.