Cyware Orchestrate

The Cisco Talos security intelligence and research group (Talos) consists of leading threat researchers supported by sophisticated systems to create threat intelligence for Cisco products. Talos threat intelligence provides detailed information about what is happening broadly across the threat landscape, acting on that data rapidly and meaningfully, and driving protection against threats. This unique visibility delivers greater context from many data points during an occurring incident or campaign. This, along with other resources like open-source communities and internal vulnerability discovery, creates a massive amount of threat data that translates directly into better protection.

The Cisco Talos Intelligence app is configured with the Orchestrate application to perform the following actions:

Configuration parameters are not required for the Cisco Talos Intelligence app to communicate with the Cisco Talos Intelligence application. The app can function after creating instances in the app.

This action checks the details of a blacklisted IOC from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "ioc_type": "ipaddr",
        "ioc_value": "68.183.31.66"
    }
]

This action checks the reputation of a domain from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "limt": 50,
        "domain": "mail.example.com",
        "offset": 0,
        "filters": "location"
     }
]

This action checks the reputation of an IP address from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "limit": 10,
        "offset": 10,
        "filters": "location",
        "ip_address": "68.183.31.66"
    }
]

This action checks the mail server details of a domain from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "domain": "mail.example.com",
        "offset": 8
    }
]

This action checks an organization's details by domain name from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "limit": 5,
        "domain": "cyware.com",
        "offset": 3
    }
]

This action checks the reputation of an URL from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "url": "http://validaciondemensaje.b-perv.com"
    }
]

This action runs a remote IOC lookup for reputation on IP address, URL in the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "ioc_type": "ip",
        "ioc_value": "68.183.31.66"
    }
]

This action retrieves different types of reputation center feeds from the Cisco Talos Intelligence application.

Action Input Parameters

Example Request

[
    {
        "duration": "lastday",
        "sender_type": "spam_country"
    }
]