Skip to main content

June Content Digest

Discover new integrations, steps, and improvements.

We've added the following new integrations, steps, and improvements:

  • New integrations:

    • Criminal IP

    • Mattermost

    • Opsin

    • Sekoia CTI

    • Vega

  • New steps and improvements:

    • Cortex Xpanse

    • GreyNoise

    • OX Security

    • Recorded Future

    • Slack

    • XM Cyber

    • Utility steps:

      • Cryptographic Utils

New Templates

We've added the following templates to the template library:

New integrations

Criminal IP

A new Criminal IP steps integration is now available on the Integrations page. The following steps are available:

  • Get IP Summary

  • Get IP DNS Server Safety

  • Get Domain Report

  • Get Suspicious IP

  • Get Malicious IP

  • Search Banners

  • Get IP Privacy Threat

  • Get IP Report Summary

  • Search Assets

  • List Domain Reports

  • Get IP VPN

Mattermost

A new Mattermost steps integration is now available on the Integrations page. The following steps are available:

  • Get users by usernames

  • Get a team

  • Create a team

  • Create a direct message channel

  • Get current user

  • Find Users

Opsin

A new Opsin steps integration is now available on the Integrations page. The following steps are available:

  • Get Agent

  • List Actors

  • Get AI Activity

  • List Assessment Users

  • List Issues

  • List Assets

  • Get Assessment

  • Comment on Alert

  • Get Interaction Prompt

  • List Tags

  • Comment on Issue

  • Get Issue

  • List Assessments

  • Create Assessment

The List AI Activity step has several new optional parameters:

  • Filter alert ID: Filter results by a specified alert ID.

  • Order by: Field to sort by.

  • Filter actor display name: Actor display name to filter by.

  • Filter data category: Filter results by a specified data category.

  • Filter agent ID: Agent ID (UUID).

  • Filter interaction ID: Filter results by a specified interaction ID.

  • Filter interaction time from: Filter results by a specified time from parameter.

  • Filter interaction time to: Filter results by a specified time to parameter.

  • Filter risk type: Filter results by a specified risk type.

  • Filter sensitive data type: Filter results by a specified data type.

  • Filter issue ID: Issue ID (UUID).

  • Filter real usage: Filter to violations with real usage only.

  • Filter status: Filter results by a specified status.

  • Filter time from: Start of interaction time window (ISO 8601).

  • Filter severities: Violation severity.

  • Order direction: The order direction of the returned results.

The List Issues View step has several new optional parameters:

  • Filter agent risk type: Filter by the agent risk type.

  • Filter agent scan ID: Filter by the agent scan ID.

Sekoia CTI

A new Sekoia CTI steps integration is now available on the Integrations page. The following steps are available:

  • List Feed Objects

  • Get Object by ID

  • Get Indicator Context

  • Look Up IOC

Vega

A new Vega steps integration is now available on the Integrations page. The following steps are available:

  • Get Detection

  • Get Alerts Events

  • Update Incidents

  • Update Static Lookup Table

  • Federated Query Results

  • Run Federated Query

  • List Detections

  • Set Detections State

  • Run GraphQL Query

  • Get Alert

New steps and improvements

Cortex Xpanse

A new step was added to the Cortex Xpanse integration:

  • Get Case Artifacts

GreyNoise

Several new steps were added to the GreyNoise integration:

  • IP Context Lookup (v3)

  • GNQL Metadata Query (v3)

  • Multi IP Context Lookup (v3)

  • IP Timeline Field Summary

  • GNQL Query (v3)

OX Security

Several new steps were added to the OX Security integration:

  • Run GraphQL Query

  • Get Applications

  • Get Issue

  • Get All Tags

  • Get SBOM Vulnerable Libraries

  • Get Artifacts

  • Get App Owners

  • Check Scan in Progress

  • Get CICD Issues

  • Get API Security Items

  • Get Single Application Info

The Get Issues step has several new optional parameters:

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the `HTTPS_PROXY` environment variable to `socks5://...`.

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the `HTTP_PROXY` environment variable to `socks5://...`.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

  • Retry delay: Initial delay before retry attempts in seconds, exponential backoff calculation will be applied over this value.

  • Max retries: The maximum number of times a step will be retried. By default (-1), the step will keep retrying for up to 50 seconds.

  • Retry on status: If set, the step will automatically retry the request on the specified status codes. The maximum retry duration is 50 seconds.

  • Skip SSL verification: If set, request will not verify SSL certificates. Where applicable, it might be better to provide a self-signed certificate using the Custom certificates PEM parameter.

  • Timeout: Timeout for request in seconds. By default, timeout is 30 seconds.

Recorded Future

A new step was added to the Recorded Future integration:

  • Get Hits

The Search Alerts step has several new optional parameters:

  • Fields to return: Fields to include in the response. If no specific fields are requested, all available fields are included in the response. Values should be separated by comma. Available fields are ai_insights, enriched_entities, hits, id, log, owner_organisation_details, review, rule, title, triggered_by, type, url.

  • Include text tags: Include text tags in the response.

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the `HTTPS_PROXY` environment variable to `socks5://...`.

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the `HTTP_PROXY` environment variable to `socks5://...`.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

  • Skip SSL verification: If set, request will not verify SSL certificates. Where applicable, it might be better to provide a self-signed certificate using the Custom certificates PEM parameter.

  • Timeout: Timeout for request in seconds. By default, timeout is 30 seconds.

Slack

The Send Message, Invite Users to Channel, Send Block Form, Upload File, Get User Details by Email, and List User Groups steps have a new optional parameter:

  • API base URL: Your Slack base API URL.

XM Cyber

Several new steps were added to the XM Cyber integration:

  • Get Access Token

  • Create a Label

  • List Entities in Inventory

  • Suppress Entities

  • List VRM Products

  • Watch Entity

  • Get Label

  • List Security Scores

  • Get Entity Types

The List Exposures, List Choke Point Entities, and List Entities steps have a new optional parameter:

  • Base URL: The base URL for the XM Cyber API.

The Get Exposure Affected Entities and Get Exposure Affected Critical Assets and Choke Points steps have a new optional parameter:

  • Page: The page to retrieve. Default is 1.

Utility Steps

A new utility step is now available:

  • Cryptographic Utils:

    • Get TLS Certificate Information — Skip SSL verification parameter added

Related Articles
Did this answer your question?