Skip to main content

Cyware Orchestrate

Cofense Triage

App Vendor: Cofense

App Category: Date Enrichment and Threat Intelligence

Connector Version: 1.0.0

API Version: 2.0.0

Cofense Triage application allows security teams to quickly catch the phishing emails that bypass your organization's email gateway. Cofense delivers the technology and advanced insight needed to rapidly detect, analyze, and auto-quarantine phishing attacks.

The Cofense Triage app for the Orchestrate allows security teams to connect with the Cofense Triage enterprise application to perform the below-listed actions.

Action Name

Description

Get All Reporters

This action retrieves all reporters in the system.

Get All URLs

This action retrieves all URLs from Cofense Triage.

Update Indicator

This action updates an indicator on Cofense Triage.

Create Indicator

This action creates an indicator on Cofense Triage.

Update Report Tag

This action updates a particular report's tag.

Get Specific Category

This action retrieves information about a particular category in Cofense Triage.

Get Categories

This action retrieves all categories in Cofense Triage.

Delete Indicator

This action deletes an indicator from Cofense Triage.

Get Specific Indicator

This action retrieves information regarding a specific indicator.

Get All Indicators

This action can be used to get all indicators from Cofense Triage.

Get URL Information

This action retrieves particular URLs stored in Cofense Triage.

Get Reporter Attributes

This action retrieves all attributes of a particular reporter.

Categorize Report

This action categorizes reports from Cofense Triage.

Download Preview

This action downloads a preview of the email as a PNG file.

Download Email

This action downloads the entire raw email report from Cofense Triage.

Get Specific Report

This action gets a specific report from Cofense Triage.

Get All Reports

This action gets all reports present in Cofense Triage.

Configuration Parameters

The following configuration parameters are required for the Cofense Triage app. The parameters can be configured by creating instances in the app.

Parameter

Description

Field Type

Required/Optional

Comments

Base URL

Enter the Base URL for the Cofense Triage application instance.

Text

Required

Client ID

Enter the client ID to authenticate with Cofense.

Text

Required

Client Secret

Enter the secret key for the client.

Password

Required

Action: Get All Reporters

This action retrieves all reporters in the system.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Limit

Enter the limit for responses.

Text

Optional

Page

Enter the page number to get the responses.

Text

Optional

Example Request
[
    {
    "limit":"30"
    "page":"10"
    }
]
Action: Get all URLs

This action retrieves all URLs from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Limit

Enter the limit for responses.

Text

Optional

Page

Enter the page number to get the responses.

Text

Optional

Example Request
[
    {
    "limit":"30"
    "page":"10"
    }
]
Action: Update Indicator

This action updates an indicator on Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Indicator ID

Enter the ID for the indicators to update.

Text

Required

Threat Level

Enter the Threat Level for the Indicator.

Text

Required

Allowed values:

  • Malicious

  • Suspicious

  • Benign

Threat Source

Enter the Threat Source for the Indicator.

Text

Required

Example Request
[
    {
        "indicator_id": "390",
        "threat_level": "Malicious",
        "threat_source": "New-Source-updated"
    }
]
Action: Create Indicator

This action creates an indicator on Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Threat Level

Enter the Threat Level for the Indicator.

Text

Required

Threat Type

Enter the Threat Type for the Indicator.

Text

Required

Allowed values:

  • Hostname

  • URL

  • MD5

  • SHA256

  • Header

Threat Value

Enter the Threat Value for the Indicator.

Text

Required

Threat Source

Enter the Threat Source for the Indicator.

Text

Required

Example Request
[
    {
        "threat_type": "URL",
        "threat_level": "Malicious",
        "threat_value": "https://www.thismightbeamaliciousite.com",
        "threat_source": "New-Source-1"
    }
]
Action: Update Report Tag

This action updates a particular report's tag.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Specify the report ID you need to update the tag.

Text

Required

Tags

Enter the list of Tags that need to be updated.

Any

Required

Example Request
[
    {
        "tags": "exmapleaddtagg",
        "report_id": "4"
    }
]
Action: Get Specific Category

This action retrieves information about a particular category in Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Category ID

Specify the category ID to get details.

Text

Required

Example Request
[
    {
        "category_id": "10"
    }
]
Action: Get Categories

This action retrieves all categories in Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Limit

Enter the limit for responses.

Text

Optional

Page

Enter the page number to get the responses.

Text

Optional

Example Request
[
    {
    "limit":"30"
    "page":"10"
    }
]
Action: Delete Indicator

This action deletes an indicator from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Indicator ID

Specify the Indicator ID to delete.

Text

Required

Example Request
[
    {
        "indicator_id": "390"
    }
]
Action: Get Specific Indicator

This action retrieves information regarding a specific indicator.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Indicator ID

Specify the Indicator ID to get the details.

Text

Required

Example Request
[
    {
        "indicator_id": "1"
    }
]
Action: Get All Indicators

This action retrieves all indicators from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Limit

Enter the limit for responses.

Text

Optional

Page

Enter the page number to get the responses.

Text

Optional

Example Request
[
    {
    "limit":"30"
    "page":"10"
    }
]
Action: Get URL Information

This action retrieves particular URLs stored in Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

URL ID

Enter the URL ID to get information about the URL.

Text

Required

Example Request
[
    {
        "url_id": "15"
    }
]
Action: Get Reporter Attributes

This action retrieves all attributes of a particular reporter.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Reporter ID

Enter the ID of the reporter to get attributes.

Text

Required

Example Request
[
    {
        "reporter_id": "4"
    }
]
Action: Categorize Report

This action categorizes reports from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Specify the report ID you want to categorize.

Text

Required

Category

Specify the category ID for categorizing the report.

Text

Required

Response ID

Specify the Response ID.

Text

Required

Example Request
[
    {
        "report_id": "4",
        "category_id": "2",
        "response_id": "1"
    }
]
Action: Download Preview

This action downloads a preview of the email as a PNG file

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Specify the report ID you want to download preview.

Text

Required

Example Request
[
    {
        "report_id": "4"
    }
]
Action: Download Email

This action downloads the entire raw email report from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Enter the report ID to download the email.

Text

Required

Example Request
[
    {
        "report_id": "4"
    }
]
Action: Get Specific Report

This action retrieves a specific report from Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Report ID

Enter the report ID to get details of the report.

Text

Required

Example Request
[
    {
        "report_id": "4"
    }
]
Action: Get all Reports

This action retrieves all reports present in Cofense Triage.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Limit

Enter the limit for responses.

Text

Optional

Page

Enter the page number to get the responses.

Text

Optional

Example Request
[
    {
    "limit":"30"
    "page":"10"
    }
]