Skip to main content

Github Feed

This Integration is part of the GitHub Feed Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

This is the Feed GitHub integration for getting started with your feed integration. This integration was integrated and tested with version 1.0.0 of Github Feed.

Configure Github Feed on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Github Feed.

  3. Click Add instance to create and configure a new integration instance.

    Fetch indicatorsFalse
    Base URLThe URL to the GitHub API.True
    API TokenFalse
    Trust any certificate (not secure)False
    OwnerUsername of the repository ownerTrue
    Repository / Path to fetchThe name of the repositoryTrue
    Feed typePredefined list of indicator types:
    - YARA: Parses YARA rules from the feed. The Yara pack is required for this type
    - STIX: Parses STIX data from the feed.
    - IOCs: Parses Indicators of Compromise (IOCs) using regex patterns.
    Branch nameThe name of the main branch to which to compare.True
    Files extensions to fetchThe extension for the file names to target.True
    Source ReliabilityReliability of the source providing the intelligence data.True
    Traffic Light Protocol ColorThe Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.False
    First fetch timeFirst commit date of first published indicators to bring. e.g., "1 min ago","2 weeks ago","3 months ago".False
    Feed Fetch IntervalFalse
    Bypass exclusion listWhen selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.False
    Use system proxy settingsFalse
    TagsInsert as a comma-separated list.False
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Gets indicators from the feed within a specified date range and up to a maximum limit..

Base Command#



Argument NameDescriptionRequired
sinceThe start date from which to fetch indicators. Accepts date strings like "7 days ago", "2 weeks ago", etc. Default is 7 days.Optional
untilThe end date until which to fetch indicators. Accepts date strings like "now", "2023-05-19", etc.Optional
limitThe maximum number of results to return. Default is 50.Optional

Context Output#

There is no context output for this command.