Package Documentation
Storm Package: synapse-cybera
The following Commands are available from this package. This documentation is generated for version 0.1.0 of the package.
Storm Commands
This package implements the following Storm Commands.
cybera.config.add
Add a Synapse-Cybera configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
cybera.config.add global_config apikey1234
// Add a configuration for the current user
cybera.config.add --scope self my_config apikey5678
Endpoints:
(user-configured base URL)
/intel/fiat : Retrieve the Premium FIAT money-mule account feed.
Usage: cybera.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Cybera. (default: rep.cybera)
--no-check-apikey : Do not perform API key validation against the Cybera API.
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.config.del
Delete a Synapse-Cybera configuration.
Examples:
// Delete the "fooconfig" configuration
cybera.config.del fooconfig
Usage: cybera.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.config.list
Display the list of Synapse-Cybera configurations you have access to.
Usage: cybera.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.config.migrate
Migrate options for all Synapse-Cybera configurations.
API key validation is skipped when running this command.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Migrate the tag prefix for all configurations
cybera.config.migrate --tag-prefix my.tagpref
Usage: cybera.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Cybera. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.admin
cybera.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
cybera.config.show
// Show a configuration by name
cybera.config.show myconfig
Usage: cybera.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.config.update
Update the configuration of a defined Synapse-Cybera configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the
// "fooconfig" configuration
cybera.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
cybera.config.update fooconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "fooconfig"
cybera.config.update fooconfig --ssl-verify (false)
// Change the name of the "fooconfig" configuration to "barconfig"
cybera.config.update fooconfig --name barconfig
Endpoints:
(user-configured base URL)
/intel/fiat : Retrieve the Premium FIAT money-mule account feed.
Usage: cybera.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level, or None to remove the permission.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Cybera. (default: None)
--no-check-apikey : Do not perform API key validation against the Cybera API.
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.intel.evidence
Ingest the CYBERA evidence package for a mule account.
Accepts a bkac_ report id, or operates on inbound risk:attack nodes.
The id lives on the attack because CYBERA mints one per report, so an
account reported several times has one attack per report and each may
carry its own evidence package.
Evidence includes the scam-bait correspondence, the entities the scammer
referenced with the context in which each was used, and the other mule
accounts provided during the same engagement. Those entities hang off the
risk:attack as uses edges, and off the operator risk:threat, so either
one reaches everything the scam invoked.
Those other accounts are the operator's, so all of the reports naming
each other resolve to one risk:threat on :actor, keyed on whichever of
them reached it first and carrying the rest on :ext:ids.
Reports fed with --no-evidence each got a risk:threat of their own,
since nothing before this command knows they belong together. The run
keeps one of them and points the rest at it with :merged:isnow, which is
how a replaced threat stays reachable rather than orphaned.
An account with no evidence package is reported and skipped; this is a
normal answer from the vendor rather than an error.
The files attached to the evidence are downloaded into the Axon, one
request each, and parsed with Synapse-FileParser when it is available.
Parsing the raw .eml of a message produces a second inet:email:message
node beside the one built from the vendor's JSON, so expect two nodes
per message sharing a :bytes. They are kept separate deliberately:
CYBERA sanitizes the recipient, and Synapse-FileParser reads the message
itself rather than the vendor's rendering of it, so the two can disagree.
Use --no-fileparser for the vendor's view alone.
The evidence payload is stored as nodedata under the "cybera:evidence"
key on the risk:attack node, alongside the feed's "cybera:record".
Examples:
// Ingest evidence for a specific report id
cybera.intel.evidence bkac_v1h04og3gwwbs9u1
// Ingest evidence for reports already in the Cortex
risk:attack:reporter:name=cybera | cybera.intel.evidence
// Every report for a given mule account
econ:bank:account:number=40630262974066296 <(uses)- risk:attack | cybera.intel.evidence
Endpoints:
(user-configured base URL)
/intel/fiat/{id}/evidence : Retrieve the evidence package for a single mule account.
/intel/artifact/{uuid} : Download an evidence artifact file.
Usage: cybera.intel.evidence [options] <id>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--no-fileparser : Do not hand the downloaded evidence files to Synapse-FileParser.
--config <config> : Override the default config with the provided name.
Arguments:
[id] : The CYBERA report id to fetch evidence for.
Inputs:
risk:attack : risk:attack nodes
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
cybera.intel.feed
Ingest money-mule bank account records from the CYBERA Premium FIAT feed.
Records are deconflicted on the bank account identifier and issuing bank,
so re-running the command updates existing nodes rather than creating
duplicates. The raw record is stored as nodedata under the "cybera:record"
key on the risk:attack node, which is one-to-one with the CYBERA id.
Date filters apply to the vendor's dateRecorded field, which is the date
CYBERA first ingested the record. They do not filter on when the scam
activity was observed.
--size cannot be combined with --since-last. The feed is ordered newest
first, so a capped run reads the newest records and stops; moving the
checkpoint past what it reached would skip the rest permanently. Use the
date filters to bound a backfill instead.
The evidence package for each record is ingested by default, along with
the files attached to it. That is one request per record on top of the
feed pages, plus one per attached file, so use --no-evidence for a large
or exploratory pull.
The package is also what names the other reports one operator is behind,
which is what lets those reports share a single risk:threat on :actor.
With --no-evidence there is nothing to group on, so each record gets a
risk:threat of its own.
Synapse-FileParser also parses each downloaded .eml, which produces a
second inet:email:message node beside the one built from the vendor's
JSON. See cybera.intel.evidence for why both are kept.
Examples:
// Ingest the entire feed
cybera.intel.feed
// Ingest everything recorded since the last --since-last run
cybera.intel.feed --since-last
// Ingest a bounded date range and yield the accounts
cybera.intel.feed --start-date 2026-05-01 --end-date 2026-05-31 --yield
// Ingest the accounts only, without a request per record for evidence
cybera.intel.feed --no-evidence
// Run the incremental pull on a schedule
cron.add --name cybera.intel.feed --period daily@02:00 { cybera.intel.feed --since-last }
Endpoints:
(user-configured base URL)
/intel/fiat : Retrieve the Premium FIAT money-mule account feed.
Usage: cybera.intel.feed [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--no-fileparser : Do not hand the downloaded evidence files to Synapse-FileParser.
--no-evidence : Do not fetch the evidence package for each record.
--since-last : Only ingest records recorded since the last --since-last run. The
checkpoint is written once the pull completes, so this cannot be
combined with --size.
--start-date <start_date> : Only ingest records recorded on or after this date. (default: None)
--end-date <end_date> : Only ingest records recorded on or before this date. (default: None)
--size <size> : Limit the number of records ingested to the given size. Cannot be
used with --since-last, which needs the pull to run to the end
before it can record where it got to. Use --start-date and
--end-date to bound a backfill instead.
(default: None)
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.cybera.adminpower-ups.cybera.user
Storm Modules
This package does not export any Storm APIs.