Skip to main content

Expanse (Deprecated)

Marketplace
Expanse (Deprecated)

Details
Content
Version History

Deprecated - Use the Expanse v2 integration instead. The Expanse App for Demisto leverages the Expander API to retrieve network exposures and create incidents in Demisto.

PUBLISHER

Expanse

INFO

Certification	Certified	Read more
Supported By	Partner
Created	July 22, 2020
Last Release	April 8, 2021

WORKS WITH THE FOLLOWING INTEGRATIONS:

Expanse (Deprecated)

AutoFocus Daily Feed

AutoFocus Feed

Palo Alto AutoFocus

Palo Alto AutoFocus (Deprecated)

Palo Alto Networks AutoFocus v2

Whois

VirusTotal

VirusTotal (API v3)

VirusTotal - Premium (API v3)

HelloWorld

HelloWorld Feed

IBM X-Force Exchange (Deprecated)

IBM X-Force Exchange v2

AbuseIPDB

Recorded Future v2

MISP v2

CrowdStrike Falcon Intel

CrowdStrike Falcon Intel (Deprecated)

CrowdStrike Falcon Intel v2

AlienVault OTX v2

Zscaler

ThreatConnect

ThreatConnect (Deprecated)

ThreatConnect v2

Anomali ThreatStream

Anomali ThreatStream v2

Cybersixgill DVE Feed Threat Intelligence

Sixgill DarkFeed Enrichment

Sixgill DarkFeed Threat Intelligence

IPinfo v2

ipinfo

Chronicle

PassiveTotal

PassiveTotal (Deprecated)

PassiveTotal v2

iDefense

iDefense (Deprecated)

iDefense Feed

iDefense v2

Analyst1

illuminate

illuminate (Deprecated)

Maltiverse

TruSTAR

TruSTAR (Deprecated)

TruSTAR v2

ThreatExchange

CyberTotal

Recorded Future

APIVoid

ThreatMiner

Cofense Intelligence

Flashpoint

PolySwarm

ThreatQ v2

ThreatQ_Beta

Expanse Expander Feed

Expanse v2

MaxMind GeoIP2

Shodan v2

SlashNext Phishing Incident Response

Palo Alto Networks Threat Vault

EclecticIQ Platform

TCPIPUtils

TCPIPUtils (Deprecated)

FireEye iSIGHT

ipstack

Symantec Deepsight Intelligence (Beta)

Awake Security

Threat Crowd

Threat Crowd (Deprecated)

Threat Crowd v2

Spamcop

Synapse

Pulsedive

Barracuda Reputation Block List (BRBL)

XM Cyber

GreyNoise

GreyNoise Community

RST Cloud - Threat Feed API

Cyware Threat Intelligence eXchange

IPQualityScore

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Incident Fields

Name	Description
ExpanseRawJSONEvent
Expanse Behavior Rule	Expanse Behavior rule that incident violates
Expanse Business Unit	Business Unit for Incident
Expanse Exposure Type
Expanse Severity

Incident Types

Name	Description
Expanse Appearance
Expanse Behavior

Integrations

Name	Description
Expanse (Deprecated) (Partner Contribution)	Deprecated. Use the Expanse v2 integration instead. The Expanse App for Demisto leverages the Expander API to retrieve network exposures and risky flows to create incidents in Demisto. This application also allows for IP, Domain, Certificate, Behavior, and Exposure enrichment, retrieving assets and exposures information drawn from Expanse’s unparalleled view of the Internet.

Layouts

Name	Description
Expanse Appearance Incident
Expanse Behavior Incident

Playbooks

Name	Description
Expanse Behavior Severity Update	This playbook updates the severity of an Expanse Behavior incident based on the presence of other active Exposures for the IP address.
Expanse Incident Playbook	Parses incident from Expanse in raw json to readable output

Automations

Name	Description
ExpanseParseRawIncident	Parses incident from Expanse in raw json to readable output

1.2.0 - 324089 (April 8, 2021)

Integrations

Expanse (Deprecated)

This integration is now deprecated. Please use the Expanse V2 integration instead.
Upgraded the Docker image to demisto/python3:3.9.2.18414.

1.1.4 - R271056 (December 22, 2020)

Incident Fields

Updated the following incident fields to conform to the new schema:

Expanse Exposure Type
Expanse Severity
ExpanseRawJSONEvent
Expanse Business Unit
Expanse Behavior Rule

1.1.3 - R180529 (November 9, 2020)

Integrations

Expanse

Addressed issue where domains command failed in some circumstances.
Updated docker image from 3.8.5.10845 to 3.8.6.12176.

1.1.2 - 133044 (October 3, 2020)

Pack has been Certified

1.1.1 - R124496 (September 23, 2020)

Integrations

Expanse

Updated the version number in the user-agent header

1.1.0 - R71118 (July 22, 2020)

Classifiers

Expanse

Updated Classifier to include mappings for all relevant Expanse Incident Fields

Incident Fields

Expanse Exposure Type

New added incident field for Expanse Exposure Type

ExpanseRawJSONEvent

New added incident field for Expanse Raw JSON

Expanse Business Unit

New added incident field for Expanse Business Unit

Expanse Behavior Rule

New added incident field for Expanse Behavior Rule

Expanse Severity

New added incident field for Expanse Severity

Layouts

Expanse Behavior

A new Layout was added for Expanse Behavior Incidents

Expanse Appearance

The Layout for Expanse Appearance Incidents was updated to include new Incident Fields

Integration

Expanse

An update was made to respect the configured page limit when fetching new incidents

Playbook

Expanse Behavior Severity Update

Added and Example Expanse Behavior Playbook