topic Re: Pulling updated hash values of unwanted softwares from unit 42. in Cortex XSOAR Discussions

Pulling updated hash values of unwanted softwares from unit 42.

NidhiK — Wed, 24 Apr 2024 07:21:18 GMT

Hi Everyone,

Is there any possibility within Cortex XSOAR to pull updated hash values of unwanted software from unit42?

Scenario: If we have a list of hash values of unwanted software (like Team viewer for eg) and we enrich the hash indicators using unit42. Now, in future if the software is updated, could we possible fetch the updated hash value of it through SOAR?

Any suggestions or insights would be helpful.

Thanks & Regards,

Nidhi Khandelwal

Re: Pulling updated hash values of unwanted softwares from unit 42.

ctopay — Wed, 05 Jun 2024 10:57:41 GMT

You can do this by importing the hash values as indicators. Depending on the type of resource you want to import/fetch, you can install and configure the necessary integrations from the marketplace:
CSV Feed
JSON Feed
Plain Text Feed

RSS Feed

TAXII Feed,

etc.

Depending on your license(TIM Module license), there is a limit on fetching. But you can control the fetching, extraction and enrichment operations using a Feed-based Job.