Sixgill DarkFeed Enrichment

This Integration is part of the Sixgill Darkfeed - Annual Subscription Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Leverage the power of Sixgill to supercharge Cortex XSOAR with real-time Threat Intelligence indicators. Enrich IOCs such as domains, URLs, hashes, and IP addresses straight from XSOAR platform. This integration was integrated and tested with sixgill-clients

Configure Sixgill_Darkfeed_Enrichment in Cortex#

Parameter	Description	Required
client_id	Sixgill API client ID	True
client_secret	Sixgill API client secret	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip#

Returns information and a reputation for each IP in the input list.

Base Command#

ip

Input#

Argument Name	Description	Required
ip	A comma-separated list of IPs to check.	Required
skip	The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The score of the indicator.
DBotScore.Type	String	Indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
SixgillDarkfeed.IP.created	Date	The timestamp when the indicator was created.
SixgillDarkfeed.IP.id	String	The unique ID of the indicator.
SixgillDarkfeed.IP.description	String	The description of the indicator.
SixgillDarkfeed.IP.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.IP.modified	Date	The timestamp when the indicator was last modified.
SixgillDarkfeed.IP.pattern	String	The indicator IP address.
SixgillDarkfeed.IP.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.IP.sixgill_confidence	Number	The indicator confidence score.
SixgillDarkfeed.IP.sixgill_feedid	String	The indicator subfeed ID.
SixgillDarkfeed.IP.sixgill_feedname	String	The indicator subfeed name.
SixgillDarkfeed.IP.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.IP.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.IP.sixgill_severity	Number	The indicator severity score.
SixgillDarkfeed.IP.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.IP.spec_version	String	The STIX specification version.
SixgillDarkfeed.IP.type	String	The STIX object type.
SixgillDarkfeed.IP.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.IP.labels	Unknown	The indicative labels of the indicator.
SixgillDarkfeed.IP.external_reference	Unknown	Link to the IOC on VirusTotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
IP.Address	String	The indicator IP address.

Command Example#

Human Readable Output#

domain#

Returns information and a reputation for each domain name in the input list.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command#

domain

Input#

Argument Name	Description	Required
domain	A comma-separated list of domain names to check.	Required
skip	The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The score of the indicator.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
SixgillDarkfeed.Domain.created	Date	The timestamp when the indicator was created.
SixgillDarkfeed.Domain.id	String	The unique ID of the indicator.
SixgillDarkfeed.Domain.description	String	The description of the indicator.
SixgillDarkfeed.Domain.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.Domain.modified	Date	The timestamp when the indicator was last modified.
SixgillDarkfeed.Domain.pattern	String	The indicator domain name.
SixgillDarkfeed.Domain.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.Domain.sixgill_confidence	Number	The indicator confidence score.
SixgillDarkfeed.Domain.sixgill_feedid	String	The indicator subfeed ID.
SixgillDarkfeed.Domain.sixgill_feedname	String	The indicator subfeed name.
SixgillDarkfeed.Domain.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.Domain.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.Domain.sixgill_severity	Number	The indicator severity score.
SixgillDarkfeed.Domain.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.Domain.spec_version	String	The STIX specification version.
SixgillDarkfeed.Domain.type	String	The STIX object type.
SixgillDarkfeed.Domain.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.Domain.labels	Unknown	The indicative labels of the indicator.
SixgillDarkfeed.Domain.external_reference	Unknown	Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
Domain.Name	String	The indicator domain name.

Command Example#

Human Readable Output#

url#

Returns information and a reputation for each URL in the input list.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command#

url

Input#

Argument Name	Description	Required
url	A comma-separated list of URLs to check.	Required
skip	The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The score of the indicator.
DBotScore.Type	String	Indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
SixgillDarkfeed.URL.created	Date	The timestamp when the indicator was created.
SixgillDarkfeed.URL.id	String	The unique ID of the indicator.
SixgillDarkfeed.URL.description	String	The description of the indicator.
SixgillDarkfeed.URL.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.URL.modified	Date	The timestamp when the indicator was last modified.
SixgillDarkfeed.URL.pattern	String	The indicator URL.
SixgillDarkfeed.URL.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.URL.sixgill_confidence	Number	The indicator confidence score.
SixgillDarkfeed.URL.sixgill_feedid	String	The indicator subfeed ID.
SixgillDarkfeed.URL.sixgill_feedname	String	The indicator subfeed name.
SixgillDarkfeed.URL.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.URL.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.URL.sixgill_severity	Number	The indicator severity score.
SixgillDarkfeed.URL.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.URL.spec_version	String	The STIX specification version.
SixgillDarkfeed.URL.type	String	The STIX object type.
SixgillDarkfeed.URL.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.URL.labels	Unknown	The indicative labels of the indicator.
URL.Data	string	The indicator URL.
SixgillDarkfeed.URL.external_reference	Unknown	Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.

Command Example#

Human Readable Output#

file#

Returns information and a reputation for each file hash in the input list.

Base Command#

file

Input#

Argument Name	Description	Required
file	A comma-separated list of file hashes to check.	Required
skip	The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The score of the indicator.
DBotScore.Type	String	Indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
SixgillDarkfeed.File.created	Date	The timestamp when the indicator was created.
SixgillDarkfeed.File.id	String	The unique ID of the indicator.
SixgillDarkfeed.File.description	String	The description of the indicator.
SixgillDarkfeed.File.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.File.modified	Date	The timestamp when the indicator was last modified.
SixgillDarkfeed.File.pattern	String	The indicator file hash (hashes include MD5, SHA-1 and SHA-256 when possible).
SixgillDarkfeed.File.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.File.sixgill_confidence	Number	The indicator confidence score.
SixgillDarkfeed.File.sixgill_feedid	String	The indicator subfeed ID.
SixgillDarkfeed.File.sixgill_feedname	String	The indicator subfeed name.
SixgillDarkfeed.File.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.File.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.File.sixgill_severity	Number	The indicator severity score.
SixgillDarkfeed.File.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.File.spec_version	String	The STIX specification version.
SixgillDarkfeed.File.type	String	The STIX object type.
SixgillDarkfeed.File.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.File.labels	Unknown	The indicative labels of the indicator.
SixgillDarkfeed.File.external_reference	Unknown	Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
File.SHA256	string	The SHA256 file hash.
File.SHA512	string	The SHA512 file hash.
File.SHA1	string	The SHA1 file hash.
File.MD5	string	The MD5 file hash.

Command Example#

Human Readable Output#

sixgill-get-actor#

Returns information and a reputation for each actor in the input list.

Base Command#

sixgill-get-actor

Input#

Argument Name	Description	Required
actor	A comma-separated list of actors to check.	Required
skip	The number of outputs per actor to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
SixgillDarkfeed.Actor.created	Date	The timestamp when the actor shared their first IOC.
SixgillDarkfeed.Actor.id	String	The unique ID of the actor.
SixgillDarkfeed.Actor.description	String	The description of the actor.
SixgillDarkfeed.Actor.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.Actor.modified	Date	The timestamp when the actor was last modified.
SixgillDarkfeed.Actor.pattern	String	A list of the IOCs shared by the actor.
SixgillDarkfeed.Actor.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.Actor.sixgill_confidence	Number	The confidence score of the actor.
SixgillDarkfeed.Actor.sixgill_feedid	String	The Subfeed ID of the actor.
SixgillDarkfeed.Actor.sixgill_feedname	String	The Subfeed name of the actor.
SixgillDarkfeed.Actor.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.Actor.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.Actor.sixgill_severity	Number	The severity score of the actor.
SixgillDarkfeed.Actor.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.Actor.spec_version	String	The STIX specification version.
SixgillDarkfeed.Actor.type	String	The STIX object type.
SixgillDarkfeed.Actor.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.Actor.labels	Unknown	The indicative labels of the actor.
SixgillDarkfeed.Actor.external_reference	Unknown	Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.

Command Example#

Human Readable Output#

sixgill-get-post-id#

Returns information and a reputation for each post ID in the input list.

Base Command#

sixgill-get-post-id

Input#

Argument Name	Description	Required
post_id	A comma-separated list of post IDs to check.	Required
skip	The number of outputs per post ID to be skipped when returning the result set. Default is 0. Default is 0.	Optional

Context Output#

Path	Type	Description
SixgillDarkfeed.Postid.created	Date	The timestamp when an IOC was first included in the post.
SixgillDarkfeed.Postid.id	String	The unique ID of the post.
SixgillDarkfeed.Postid.description	String	The description of the post ID.
SixgillDarkfeed.Postid.lang	String	The language of the original post in the Sixgill portal.
SixgillDarkfeed.Postid.modified	Date	The timestamp when the post ID information was last modified.
SixgillDarkfeed.Postid.pattern	String	A list of the IOCs included in the post.
SixgillDarkfeed.Postid.sixgill_actor	String	The actor of the original post on the dark web.
SixgillDarkfeed.Postid.sixgill_confidence	Number	The confidence score of the post ID.
SixgillDarkfeed.Postid.sixgill_feedid	String	The Subfeed ID of the post ID.
SixgillDarkfeed.Postid.sixgill_feedname	String	The Subfeed name of the post ID.
SixgillDarkfeed.Postid.sixgill_postid	String	The ID of the post in the Sixgill portal.
SixgillDarkfeed.Postid.sixgill_posttitle	String	The title of the post in the Sixgill portal.
SixgillDarkfeed.Postid.sixgill_severity	Number	The severity score of the post ID.
SixgillDarkfeed.Postid.sixgill_source	String	The source of the post in the Sixgill portal.
SixgillDarkfeed.Postid.spec_version	String	The STIX specification version.
SixgillDarkfeed.Postid.type	String	The STIX object type.
SixgillDarkfeed.Postid.valid_from	Date	The creation date of the post in the Sixgill portal.
SixgillDarkfeed.Postid.labels	Unknown	The indicative labels of the post ID.
SixgillDarkfeed.Postid.external_reference	Unknown	Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.