Cisco XDR: Intelligence

Creates a new feed in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Generate the request payload
[] Request the feed be created
[] Check if the request was successful:
[]> If it was, extract the feed attributes and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-feed-adds-a-new-feed/

XDR - Intelligence - Create Feed

prod-nam

prod-eu

prod-apjc

Creates a new indicator in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Build the request payload
[] Request the indicator be created
[] Check if the request was successful:
[]> If it was, extract the indicator ID and set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-indicator-adds-a-new-indicator/

XDR - Intelligence - Create Indicator

Creates a new judgement in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
- Build the request payload
- Request the judgement be created
- Check if the request was successful:
  - If it was, extract the judgement ID and set the output variable
  - If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-judgement-adds-a-new-judgement/

XDR - Intelligence - Create Judgement

Creates a new relationship between two objects in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Build the request payload
[] Request the relationship be created
[] Check if the request was successful:
[]> If it was, extract the relationship ID and set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-relationship-adds-a-new-relationship/

XDR - Intelligence - Create Relationship

Creates a new sighting in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
- Build the request payload
- Request the sighting be created
- Check if the request was successful:
  - If it was, extract the sighting ID and set the output variable
  - If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-sighting-adds-a-new-sighting/

XDR - Intelligence - Create Sighting

Deletes a relationship in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Extract the simple relationship ID
[] Delete the relationship
[] Check if the request was successful:
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-relationship-delete-one-relationship/

XDR - Intelligence - Delete Relationship

Fetches the contents of a Cisco XDR threat intelligence feed.

Target: Private Intelligence API system target

Steps:
- Check which output format was provided:
  - If JSON, update the URL suffix
  - If something besides text or JSON, end the workflow
- Build the request query string
- Fetch the feed contents
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, return an error

More information about this API: https://private.intel.amp.cisco.com/index.html#/Feed/get_ctia_feed__id__view

XDR - Intelligence - Get Feed Contents

Searches for feeds in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Build the query string for the search
[] Request feeds from Cisco XDR
[] Check if the request was successful:
[]> If it was, extract the result count header and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-feed-search-for-a-feed-using-a-lucenees-query-string/

XDR - Intelligence - Search Feeds

Searches for indicators in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Build the query string for the search
[] Request indicators from Cisco XDR
[] Check if the request was successful:
[]> If it was, extract the result count header and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-indicator-search-for-indicator-entities-using-a-es-query-syntax-and-field-filters/

XDR - Intelligence - Search Indicators

Searches for relationships in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Request relationships from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-relationship-search-for-relationship-entities-using-a-es-query-syntax-and-field-filters/

XDR - Intelligence - Search Relationships

Searches for sightings in your Cisco XDR private intelligence store.

Target: Private Intelligence API

Steps:
[] Build the query string for the search
[] Request sightings from Cisco XDR
[] Check if the request was successful:
[]> If it was, extract the result count header and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/private-intelligence-api-sighting-search-for-sighting-entities-using-a-es-query-syntax-and-field-filters/