Package Documentation
Storm Package: synapse-intel471
The following Commands are available from this package. This documentation is generated for version 3.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
intel471.breach.search
Search for breach alerts matching filter criteria.
At least one of --breachalert, --actor, or --victim must be specified
to perform the search.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Free text search for alerts
intel471.breach.search --breachalert Communications
// Search by victim and filter using a time range
intel471.breach.search --victim "BCN Telecom" --from "-30days"
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.breach.search`` command instead.
Deprecated: "intel471.breach.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.breach.search [options]
Options:
--help : Display the command usage.
--breachalert <breachalert> : Free text search for breach alerts.
--actor <actor> : Search by actor or actor group names.
--victim <victim> : Search by victim name.
--confidence <confidence> : Specify a confidence level (high, medium, low).
--gir <gir> : Specify a General Intel Requirement.
--from <from> : Search for breach alerts created after a specified time.
--until <until> : Search for breach alerts created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for breach alerts updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for breach alerts updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--filterbygirset <filterbygirset>: Specify a GIR set ("my_girs" or "company_pirs").
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.credential.search
Search for credentials matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for credentials by domain and yield the results
intel471.credential.search --yield --domain "example.com" --size 10
// Search for credentials by login
intel471.credential.search --yield --credentiallogin "user@example.com"
// Search for a specific credential by uid and fetch accessed URLs
intel471.credential.search --yield --credentialuid "abc123" --fetch-accessed-url
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.credentials.search`` command instead.
Deprecated: "intel471.credential.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.credential.search [options]
Options:
--help : Display the command usage.
--credentialuid <credentialuid>: Search by credential uid.
--domain <domain> : Search by credential domain (detection domain).
--credentiallogin <credentiallogin>: Search by credential login.
--fetch-accessed-url : Fetch the accessed URL for each credential.
--gir <gir> : Specify a General Intel Requirement.
--filterbygirset <filterbygirset>: Specify a GIR set ("my_girs" or "company_pirs"). (choices: my_girs, company_pirs)
--from <from> : Search for credentials created after a specified time.
--until <until> : Search for credentials created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for credentials updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for credentials updated before a specified time.
--sort <sort> : Specify sort order. (default: relevance, choices: relevance, earliest, latest)
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.dataleak.post.search
Search for data leak blog posts matching filter criteria.
At least one of --post, --postsbythreaduid, or --blog must be specified
to perform the search.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search by blog and filter using a time range
intel471.dataleak.post.search --blog "Blackout RaaS operator(s)" --from "-30days"
// Free text search for data leak posts and do not download file listing archives
intel471.dataleak.post.search --post financial --skip-attachments
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.dataleak.search`` command instead.
Deprecated: "intel471.dataleak.post.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.dataleak.post.search [options]
Options:
--help : Display the command usage.
--post <post> : Search text in data leak posts and topics.
--postsbythreaduid <postsbythreaduid>: Search data leak posts by thread uid.
--blog <blog> : Search data leak posts in a given data leak blog.
--from <from> : Search for data leak posts created after a specified time.
--until <until> : Search for data leak posts created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for data leak posts updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for data leak posts updated before a specified time.
--sort <sort> : Specify sort order. (default: relevance, choices: relevance, earliest, latest)
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--skip-attachments : Skip downloading file listing archives included in results (if present).
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.forum.message.search
Search for forum private messages matching filter criteria.
At least one of --privatemessage, --privatemessagesubject, --actor, or
--forum must be specified to perform the search.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search text in private messages
intel471.forum.message.search --privatemessage hacked
// Search by forum and filter using a time range
intel471.forum.message.search --forum opensc.ws --from "-30days"
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.forum.search --type message`` command instead.
Deprecated: "intel471.forum.message.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.forum.message.search [options]
Options:
--help : Display the command usage.
--privatemessage <privatemessage>: Search text in private messages.
--privatemessagesubject <privatemessagesubject>: Search text in subjects of private messages.
--actor <actor> : Search messages authored or recieved by a given actor handle.
--forum <forum> : Search messages in a given forum.
--from <from> : Search for messages created after a specified time.
--until <until> : Search for messages created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for messages updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for messages updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.forum.post.search
Search for forum posts matching filter criteria.
At least one of --post, --postsbythreaduid, or --forum must be specified
to perform the search.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search text in posts and topics
intel471.forum.post.search --post hacked
// Search by forum and filter using a time range
intel471.forum.post.search --forum opensc.ws --from "-30days"
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.forum.search --type post`` command instead.
Deprecated: "intel471.forum.post.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.forum.post.search [options]
Options:
--help : Display the command usage.
--post <post> : Search text in posts and topics.
--postsbythreaduid <postsbythreaduid>: Search posts by thread uid.
--actor <actor> : Search posts authored by given actor handle.
--forum <forum> : Search posts in a given forum.
--from <from> : Search for posts created after a specified time.
--until <until> : Search for posts created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for posts updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for posts updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.girs.sync
Download and populate Intel471 GIR definitions.
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.girs.sync`` command instead.
Examples:
// Download and populate the GIR definitions.
intel471.girs.sync
Deprecated: "intel471.girs.sync" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.girs.sync [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.global.search
Perform a global search for results matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Currently this command will ingest results of following types:
iocs - Indicator of Compromise
indicators - Malware Intelligence Indicators
cveReports - Vulnerability Reports
breachAlerts - Breach Alerts
posts - Forum Posts
privateMessages - Forum Private Messages
dataLeakPosts - Data Leak Blog Posts
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for malicious domains with specific text
intel471.global.search --yield (iocType, MaliciousDomain) (text, vertex)
NOTE: This is an Intel471 Titan API command with no Verity replacement.
Intel471's Verity API has no unified global search endpoint; this is a
capability their platform redesign removed, not a Synapse gap. This
command will continue to work against Titan until its retirement.
Deprecated: "intel471.global.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.global.search [options] <params>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
Arguments:
[<params> ...] : Query parameters as tuples of (param_name, value).
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.indicators.search
Search for malware indicators matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for an IP
intel471.indicators.search --indicator 188.130.163.218
// Filter using a time range
intel471.indicators.search --from "-30days" --until "-7days"
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.indicators.search`` command instead.
Deprecated: "intel471.indicators.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.indicators.search [options]
Options:
--help : Display the command usage.
--indicator <indicator> : Free text search for indicators.
--indicatortype <indicatortype>: Specify an indicator type.
--threattype <threattype> : Specify a threat type.
--threatuid <threatuid> : Specify a threat uid.
--malwarefamily <malwarefamily>: Specify a malware family.
--malwarefamilyprofileuid <malwarefamilyprofileuid>: Specify a malware family profile uid.
--confidence <confidence> : Specify a confidence level (high, medium, low).
--gir <gir> : Specify a General Intel Requirement.
--filterbygirset <filterbygirset>: Specify a GIR set ("my_girs" or "company_pirs").
--from <from> : Search for IOCs created after a specified time.
--until <until> : Search for IOCs created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for IOCs updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for IOCs updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.inforeport.get
Retrieve an information or fintel report by UID.
This command takes an information or fintel report UID as input and queries the Intel471
API to retrieve the report. An incomplete media:news node created by other Intel471
commands may also be used as input to populate the full report details.
Examples:
// Retrieve a report by UID
intel471.inforeport.get ce1c92f84040f1ad008b55665bfde326
// Use media:news nodes to retrieve reports
media:news:publisher:name=intel471 | intel471.inforeport.get
// Retrieve a report by UID and do not download attachments
intel471.inforeport.get ce1c92f84040f1ad008b55665bfde326 --skip-attachments
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.inforeport.get`` command instead.
Deprecated: "intel471.inforeport.get" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.inforeport.get [options] <uid>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--skip-attachments : Skip downloading files attached to reports.
Arguments:
[uid] : The report identifier to retrieve.
Inputs:
media:news : media:news nodes
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.inforeport.search
Search for information or fintel reports matching filter criteria.
By default this command will query the Intel471 API to retrieve the full
report for each summary in the search results. The --skip-detail argument can be
used to skip retrieving the full report for each result and only ingest the
summary results.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for 10 results related to "malware" and yield the results
intel471.inforeport.search --yield --report malware --size 10
// Search for 100 results related to "malware" and do not retrieve each full report
intel471.inforeport.search --yield --report malware --size 100 --skip-detail
// Search for 2 results related to "ccweb" and skip downloading attachments
intel471.inforeport.search --yield --report ccweb --size 2 --skip-attachments')
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.inforeport.get`` command for report retrieval.
Deprecated: "intel471.inforeport.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.inforeport.search [options]
Options:
--help : Display the command usage.
--report <report> : Search text in reports, subjects, and entities.
--reportlocation <reportlocation>: Search reports by country or region.
--reporttag <reporttag> : Search reports by tag.
--reportadmiraltycode <reportadmiraltycode>: Search reports by admiralty code.
--reporttitle <reporttitle> : Search reports by title.
--victim <victim> : Search reports by purported victim.
--documenttype <documenttype>: Search reports by document type.
--documentfamily <documentfamily>: Search reports by document family.
--gir <gir> : Specify a General Intel Requirement.
--filterbygirset <filterbygirset>: Specify a GIR set. (choices: my_girs, company_pirs)
--from <from> : Search for reports created after a specified time.
--until <until> : Search for reports created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for reports updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for reports updated before a specified time.
--sort <sort> : Specify sort order. (default: relevance, choices: relevance, earliest, latest)
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--skip-detail : Only ingest data returned by the initial search, do not retrieve detailed reports or
attachments for each result.
--skip-attachments : Skip downloading files attached to detailed reports.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.iocs.search
Search for indicators of compromise matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Valid IOC types:
MaliciousURL
MaliciousDomain
IpAddress
AutonomousSystem
MD5
SHA256
SHA1
FileType
FileSize
FileName
SSLCertificate
SSLCertificateID
SSLCertificateFingerprint
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for an IP
intel471.iocs.search --yield 188.130.163.218
// Filter using a time range
intel471.iocs.search --from "-30days" --until "-7days" .com
NOTE: This is an Intel471 Titan API command with no Verity replacement.
Intel471's Verity API has no unified IOC search endpoint; this is a
capability their platform redesign removed, not a Synapse gap. This
command will continue to work against Titan until its retirement.
Deprecated: "intel471.iocs.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.iocs.search [options] <query>
Options:
--help : Display the command usage.
--ioctype <ioctype> : Specify an IOC type.
--from <from> : Search for IOCs created after a specified time.
--until <until> : Search for IOCs created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for IOCs updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for IOCs updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
Arguments:
<query> : The query string.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.message.search
Search for instant messages matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Instant messages are available for the following services:
- telegram
- discord
- irc
- whats_app
- qq
- icq
- matrix
- signal
Examples:
// Search for instant messages and yield the results
intel471.message.search --yield --message "credit card"
// Search for instant messages by actor
intel471.message.search --yield --actor Jacob
// Search for instant messages in a given service
intel471.message.search --yield --service telegram
// Search for instant messages in a given channel
intel471.message.search --yield --channel anon-ops
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.message.search`` command instead.
Deprecated: "intel471.message.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.message.search [options]
Options:
--help : Display the command usage.
--message <message> : Search text in instant messages.
--actor <actor> : Search instant messages by actor name.
--service <service> : Search instant messages in a given service. (choices: telegram, discord, irc,
whats_app, qq, icq, matrix, signal)
--channel <channel> : Search instant messages in a given channel.
--from <from> : Search for instant messages created after a specified time.
--until <until> : Search for instant messages created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for instant messages updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for instant messages updated before a specified time.
--sort <sort> : Specify sort order. (default: relevance, choices: relevance, earliest, latest)
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.setup.apikey
Manage the Intel471 user email and API key.
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.config.add`` command to configure credentials.
Examples
// Configure global Intel471 credentials
intel471.setup.apikey test@gmail.com abcd1234
// Configure Intel471 credentials for the current user
intel471.setup.apikey --self test@gmail.com abcd1234
// Display the scope of the current credentials
intel471.setup.apikey --show-scope
// Display the current credentials.
intel471.setup.apikey --show-apikey
// Remove the current global credentials.
intel471.setup.apikey --remove
// Remove the per-user credentials for the current user.
intel471.setup.apikey --self --remove
Deprecated: "intel471.setup.apikey" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.setup.apikey [options] <email> <apikey>
Options:
--help : Display the command usage.
--self : Set or remove the credentials as a user variable. If not used, set them globally.
--show-scope : Display the credentials scope in use (global vs self).
--show-apikey : Display the credentials (requires admin perms or a "self" scope key).
--remove : Remove the configured credentials. May be used with --self.
Arguments:
[email] : Email address for authentication.
[apikey] : The API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.setup.tagprefix
Set the tag prefix used when recording Intel471 data as tags.
The default tag prefix is "rep.intel471" if not specified.
Any tags provided by the Intel471 API will be added within the given namespace.
For example, the item "foo" would result in "#rep.intel471.foo". Any
characters incompatible with tag names are replaced with "_".
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.config.add``/``.update`` commands to set a tag prefix.
Deprecated: "intel471.setup.tagprefix" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.setup.tagprefix [options] <tagname>
Options:
--help : Display the command usage.
Arguments:
<tagname> : The tag prefix to use.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.breach.search
Search for Intel471 Verity breach alert reports matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Free text search for alerts
intel471.verity.breach.search --text "Communications"
Usage: intel471.verity.breach.search [options]
Options:
--help : Display the command usage.
--text <text> : Free text search for breach alerts.
--gir <gir> : Specify a General Intel Requirement.
--from <from> : Search for breach alerts created after a specified time.
--until <until> : Search for breach alerts created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.config.add
Add a Synapse-Intel471 Verity configuration.
Examples:
// Add a global configuration
intel471.verity.config.add global_config myclientid myclientsecret
// Add a configuration for the current user
intel471.verity.config.add --scope self my_config myclientid myclientsecret
Usage: intel471.verity.config.add [options] <name> <client-id> <client-secret>
Options:
--help : Display the command usage.
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Intel471 Verity. (default: rep.intel471)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<client_id> : The Intel471 Verity Client ID string.
<client_secret> : The Intel471 Verity Client Secret string.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.config.del
Delete a Synapse-Intel471 Verity configuration.
Examples:
// Delete the "fooconfig" configuration
intel471.verity.config.del fooconfig
Usage: intel471.verity.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.config.list
Display the list of Synapse-Intel471 Verity configurations you have access to.
Usage: intel471.verity.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.config.show
Show the details of a Synapse-Intel471 Verity configuration.
Examples:
// Show the in-use configuration for the current user
intel471.verity.config.show
// Show a configuration by name
intel471.verity.config.show myconfig
Usage: intel471.verity.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.config.update
Update the configuration of a defined Synapse-Intel471 Verity configuration.
Examples:
// Set the permission level for user "myuser" to "admin" on the "fooconfig"
// configuration
intel471.verity.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
intel471.verity.config.update fooconfig --perm role all deny
// Change the name of the "fooconfig" configuration to "barconfig"
intel471.verity.config.update fooconfig --name barconfig
Usage: intel471.verity.config.update [options] <config>
Options:
--help : Display the command usage.
--client-id <client_id> : The Intel471 Verity Client ID string. (default: None)
--client-secret <client_secret>: The Intel471 Verity Client Secret string. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Intel471 Verity. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level, or None to remove the permission.
(default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.credentials.search
Search for Intel471 Verity credentials matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Search for credentials by domain
intel471.verity.credentials.search --domain "example.com"
Usage: intel471.verity.credentials.search [options]
Options:
--help : Display the command usage.
--domain <domain> : Search by credential domain.
--credentiallogin <credentiallogin>: Search by credential login.
--credentialsetid <credentialsetid>: Search by credential set id.
--gir <gir> : Specify a General Intel Requirement.
--from <from> : Search for credentials created after a specified time.
--until <until> : Search for credentials created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.dataleak.search
Search for Intel471 Verity data leak site posts matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Free text search for data leak posts
intel471.verity.dataleak.search --text financial
Usage: intel471.verity.dataleak.search [options]
Options:
--help : Display the command usage.
--text <text> : Search text in data leak posts and topics.
--threadid <threadid> : Search data leak posts by thread id.
--websiteid <websiteid> : Search data leak posts by website id.
--from <from> : Search for data leak posts created after a specified time.
--until <until> : Search for data leak posts created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.forum.search
Search for Intel471 Verity forum posts and/or private messages matching
filter criteria.
Use --type to select which forum content to search; if omitted, both
posts and private messages are searched.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Search forum posts by forum title
intel471.verity.forum.search --type post --forum opensc.ws
// Search forum private messages by text
intel471.verity.forum.search --type message --text hacked
Usage: intel471.verity.forum.search [options]
Options:
--help : Display the command usage.
--type [<type> ...] : Limit the search to specific forum content types; searches all by default. (choices:
post, message)
--text <text> : Search text in posts, topics, and private messages.
--threadid <threadid> : Search forum posts by thread id (post type only).
--subject <subject> : Search text in subjects of private messages (message type only).
--forum <forum> : Search in a given forum (by title).
--from <from> : Search for content created after a specified time.
--until <until> : Search for content created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.girs.sync
Download and populate Intel471 Verity GIR definitions.
Examples:
// Download and populate the GIR definitions.
intel471.verity.girs.sync
Usage: intel471.verity.girs.sync [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.indicators.search
Search for Intel471 Verity malware indicators matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Search for a free-text term
intel471.verity.indicators.search --text Georgia
// Filter using a time range
intel471.verity.indicators.search --from "-30days" --until "-7days"
Usage: intel471.verity.indicators.search [options]
Options:
--help : Display the command usage.
--text <text> : Free text search for indicators.
--indicatortype <indicatortype>: Specify an indicator type. (choices: domain, email, file, ipv4, url, yara)
--threattype <threattype> : Specify a threat type. (choices: malware, bulletproof_hosting)
--confidence <confidence> : Specify a confidence level. (choices: high, medium, low)
--malwareid <malwareid> : Specify a malware id.
--malwarefamilyid <malwarefamilyid>: Specify a malware family id.
--malwarefamilyname <malwarefamilyname>: Specify a malware family name.
--gir <gir> : Specify a General Intel Requirement ("my_girs" or "company_pirs" or a GIR path).
--from <from> : Search for indicators created after a specified time.
--until <until> : Search for indicators created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.inforeport.get
Retrieve an Intel471 Verity report by UID.
This command takes a report UID as input and tries each of the typed
report endpoints (info, fintel, malware, spot, breach-alert,
vulnerability) in turn until the report is found. An incomplete
media:news node created by other Intel471 Verity commands may also be
used as input to populate the full report details.
Examples:
// Retrieve a report by UID
intel471.verity.inforeport.get vulnerability--527c3004-241f-599d-9dbd-00ac1d6d52f6
// Use media:news nodes to retrieve reports
media:news:publisher:name=intel471 | intel471.verity.inforeport.get
Usage: intel471.verity.inforeport.get [options] <uid>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Arguments:
[uid] : The report identifier to retrieve.
Inputs:
media:news : media:news nodes
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.message.search
Search for Intel471 Verity instant messages matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Search for instant messages
intel471.verity.message.search --text "credit card"
Usage: intel471.verity.message.search [options]
Options:
--help : Display the command usage.
--text <text> : Search text in instant messages.
--roomid <roomid> : Search instant messages in a given room.
--from <from> : Search for instant messages created after a specified time.
--until <until> : Search for instant messages created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.vulns.get
Retrieve an Intel471 Verity vulnerability report by UID.
Examples:
// Retrieve a report by UID
intel471.verity.vulns.get vulnerability--527c3004-241f-599d-9dbd-00ac1d6d52f6
Usage: intel471.verity.vulns.get [options] <uid>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Arguments:
[uid] : The vulnerability report identifier to retrieve.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.verity.vulns.search
Search for Intel471 Verity vulnerability reports matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Examples:
// Search for a CVE
intel471.verity.vulns.search --text "CVE-2019-9621"
Usage: intel471.verity.vulns.search [options]
Options:
--help : Display the command usage.
--text <text> : Free text search for vulnerability reports.
--gir <gir> : Specify a General Intel Requirement.
--from <from> : Search for reports created after a specified time.
--until <until> : Search for reports created before a specified time.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.vulns.get
Retrieve a vulnerability report by UID.
This command takes a vulnerability report UID as input and queries the Intel471
API to retrieve the report.
Examples:
// Retrieve a report by UID
intel471.vulns.get ce1c92f84040f1ad008b55665bfde326
// Use risk:vuln nodes to retrieve reports
risk:vuln:_intel471:uid | intel471.vulns.get :_intel471:uid
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.vulns.get`` command instead.
Deprecated: "intel471.vulns.get" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.vulns.get [options] <uid>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
Arguments:
[uid] : The vulnerability report identifier to retrieve.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
intel471.vulns.search
Search for vulnerability reports matching filter criteria.
This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
Note:
Intel471 queries return a maximum of 1100 items.
Examples:
// Search for a CVE
intel471.vulns.search --cvename "CVE-2015-6435"
// Filter using a time range
intel471.vulns.search --from "-30days" --until "-7days"
NOTE: This is an Intel471 Titan API command. Verity users should use the
``intel471.verity.vulns.search`` command instead.
Deprecated: "intel471.vulns.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Usage: intel471.vulns.search [options]
Options:
--help : Display the command usage.
--cvereport <cvereport> : Free text search for CVE reports.
--cvetype <cvetype> : Specify a CVE type.
--cvestatus <cvestatus> : Specify a CVE status.
--cvename <cvename> : Specify a CVE name.
--risklevel <risklevel> : Specify a CVE risk level (high, medium, or low).
--patchstatus <patchstatus> : Specify a CVE patch status (available, some_available, or unavailable).
--vendorname <vendorname> : Specify a CVE vendor name.
--productname <productname> : Specify a CVE product name.
--gir <gir> : Specify a General Intel Requirement.
--filterbygirset <filterbygirset>: Specify a GIR set ("my_girs" or "company_pirs").
--from <from> : Search for CVEs created after a specified time.
--until <until> : Search for CVEs created before a specified time.
--lastupdatedfrom <lastupdatedfrom>: Search for CVEs updated after a specified time.
--lastupdateduntil <lastupdateduntil>: Search for CVEs updated before a specified time.
--sort <sort> : Specify sort order (relevance, earliest, or latest).
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
The command is accessible to users with one or more of the following permissions:
power-ups.intel471.adminpower-ups.intel471.user
Storm Modules
This package does not export any Storm APIs.