Skip to main content

Intel471 Actors Feed

This Integration is part of the Intel471 Feed Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

"Intel 471's Actors feed is an actor-centric intelligence feature. It combines both a field-based intelligence collection and a headquartered-based intelligence analysis component. This feed allows getting data out of closed sources (typically referred to as the deep and dark web) where threat actors collaborate, communicate, and plan cyber attacks."

Configure Intel471 Actors Feed on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Intel471 Actors Feed.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    credentialsUsernameTrue
    feedFetch indicatorsFalse
    feedReputationIndicator ReputationFalse
    feedReliabilitySource ReliabilityTrue
    tlp_colorTraffic Light Protocol ColorFalse
    feedExpirationPolicyFalse
    feedExpirationIntervalFalse
    feedFetchIntervalFeed Fetch IntervalFalse
    actorFree text actor search (all fields included)False
    fetch_timeFirst fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)False
    feedTagsTags
    feedBypassExclusionListBypass exclusion listFalse
    proxyUse system proxy settingsFalse
    insecureTrust any certificate (not secure)False
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

intel471-actors-get-indicators#


Gets the feed indicators.

Base Command#

intel471-actors-get-indicators

Input#

Argument NameDescriptionRequired
limitThe maximum number of results to return. Default is 50.Optional

Context Output#

There is no context output for this command.

Command Example#

!intel471-actors-get-indicators limit=10

Indicators#

valuetyperawJSON
h.m.15STIX Threat ActorlastUpdated: 1611219975088
handles: h.m.15
links: {"forums": [{"name": "unknowncheats", "actorHandle": "h.m.15", "uid": "4671aeaf49c792689533b00664a5c3ef"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 1}
activeFrom: 1078774740000
activeUntil: 1078774740000
uid: 7d1da0f4f0b26f3fb777fdd662c5cc68
bradleykinsSTIX Threat ActorlastUpdated: 1611219676493
handles: bradleykins
links: {"forums": [{"name": "unknowncheats", "actorHandle": "bradleykins", "uid": "4671aeaf49c792689533b00664a5c3ef"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 1}
activeFrom: 1080079020000
activeUntil: 1080079020000
uid: b6c4bf36d66d7892244bd56572704982
EleethalSTIX Threat ActorlastUpdated: 1611299774949
handles: Eleethal
links: {"forums": [{"name": "unknowncheats", "actorHandle": "Eleethal", "uid": "4671aeaf49c792689533b00664a5c3ef"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 502}
activeFrom: 1090467720000
activeUntil: 1090467720000
uid: 482c379b7a0bda6574bf0b5ca63532e6
jag4lifeSTIX Threat ActorlastUpdated: 1611214277667
handles: jag4life
links: {"forums": [{"name": "unknowncheats", "actorHandle": "jag4life", "uid": "4671aeaf49c792689533b00664a5c3ef"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 1}
activeFrom: 1098304440000
activeUntil: 1098304440000
uid: 0e6cee474206abe743b748ca36fc62eb
ice-killerSTIX Threat ActorlastUpdated: 1611246675557
handles: ice-killer
links: {"forums": [{"name": "mazafaka", "actorHandle": "ice-killer", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 28}
activeFrom: 1099041900000
activeUntil: 1099041900000
uid: bf012aa908bd8d4464c9ab52cf088d3f
GobLinSTIX Threat ActorlastUpdated: 1611246675557
handles: GobLin
links: {"forums": [{"name": "mazafaka", "actorHandle": "GobLin", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 10}
activeFrom: 1099423620000
activeUntil: 1099423620000
uid: 09a6110f39478e39eda6c95138d7e723
SveSTevNSTIX Threat ActorlastUpdated: 1611252975381
handles: SveSTevN
links: {"forums": [{"name": "mazafaka", "actorHandle": "SveSTevN", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 13}
activeFrom: 1099443060000
activeUntil: 1099443060000
uid: debbb920e2f6a94f875c6384af99ec35
ThomasSTIX Threat ActorlastUpdated: 1611253575408
handles: Thomas
links: {"forums": [{"name": "mazafaka", "actorHandle": "Thomas", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 1}
activeFrom: 1099781940000
activeUntil: 1099781940000
uid: 2b9b3d1530d0cb2364053cce822297eb
PetrovichSTIX Threat ActorlastUpdated: 1611252674936
handles: Petrovich
links: {"forums": [{"name": "mazafaka", "actorHandle": "Petrovich", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 3}
activeFrom: 1099939140000
activeUntil: 1099939140000
uid: db1aa88e2f0c2d120d3f0930a0a2e9ed
PoFigisTSTIX Threat ActorlastUpdated: 1611252675579
handles: PoFigisT
links: {"forums": [{"name": "mazafaka", "actorHandle": "PoFigisT", "uid": "fc221309746013ac554571fbd180e1c8"}], "forumTotalCount": 1, "instantMessageChannelTotalCount": 0, "forumPrivateMessageTotalCount": 0, "reportTotalCount": 0, "instantMessageTotalCount": 0, "instantMessageServerTotalCount": 0, "forumPostTotalCount": 17}
activeFrom: 1100332920000
activeUntil: 1100332920000
uid: 9c16382ba5454e06919e087959046f12