Cyble-ThreatIntelligence-Ingest-Playbook
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook imports IoC lists from Cyble and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on Cyble-ThreatIntelligence-Ingest that need to be installed manually before installing this playbook.
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| GetExistingIoCs |
post |
/queryData |
— |
| Action |
Method |
Endpoint |
Other |
| Upload_Indicators_v2 |
post |
/V2/ThreatIntelligence/@{encodeURIComponent(parameters('WorkspaceID'))}/UploadIndicators/ |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| HTTP_Get_IOC_Data |
GET |
@concat('https://api.cyble.ai/engine/api/v2/y/iocs?sortBy=last_seen&order=desc&limit=100&startDate=', variables('StartDateTimeFull'), '&endDate=', variables('EndDateTimeFull')) |
— |
| HTTP_Get_Iocs_Per_Page |
GET |
@concat('https://api.cyble.ai/engine/api/v2/y/iocs?sortBy=last_seen&order=desc&limit=', string(variables('Limit')), '&page=', string(variables('PageNumber')), '&startDate=', variables('StartDateTimeFull'), '&endDate=', variables('EndDateTimeFull')) |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks · Back to Cyble Vision