Playbook Download YAML

Cypho Threat Feed for Cortex XSOAR

The Cypho Threat Feed integration imports Cypho indicators of compromise (IOCs) into Cortex XSOAR Threat Intel. It supports IP addresses, domains, hostnames, URLs, and file hashes.

Download CyphoThreatFeed.yml

Customers install the integration manually from the YAML file. The file does not contain an API key or other customer-specific credentials.

Before you begin

You need:

  • A Cortex XSOAR account with permission to import and configure integrations
  • A Cypho API key
  • Outbound HTTPS access from XSOAR to https://api.cypho.io/external/v1
  • The downloaded CyphoThreatFeed.yml file

File checksum (SHA-256):

23363360cebd13d77a801465a85cc232820a027702011c59e502b1b20e92e4e2

Install the integration

  1. Download CyphoThreatFeed.yml to your computer.
  2. Sign in to Cortex XSOAR.
  3. Open the integrations management page. In many XSOAR versions, this is Settings → Integrations → Servers & Services.
  4. Select the option to upload or import an integration.
  5. Choose CyphoThreatFeed.yml and confirm the import.
  6. Find Cypho Threat Feed in the integrations list and add an instance.
  7. Enter the required connection settings described below.
  8. Test the instance, save it, and make sure Fetch indicators is enabled.

The exact menu and button names can differ between Cortex XSOAR versions, but the imported integration and its configuration fields remain the same.

Configure an example instance

The following values match the example configuration shown in XSOAR. Replace only the API key and, when applicable, the tenant name with customer-specific values.

Connection and synchronization

XSOAR field Example value How to fill it
Server URL https://api.cypho.io/external/v1 Use the Cypho External API base URL exactly as shown.
API Key Customer's Cypho API key Paste the API key into the protected password field. The value is masked after entry and is sent in the X-Auth-Token header. Do not put the key in the YAML file.
Tenant (child company name) Leave empty Leave this field empty when retrieving IOCs for the company that owns the API key. Enter the child-company name only for a multi-tenant integration.
Fetch indicators Enabled Enable this option so XSOAR runs the feed automatically.
Fetch indicators added after 1 year Retrieves indicators first added during the last year on the initial backfill. Values such as 6 months, 90 days, and RFC 3339 timestamps are also accepted.
Watermark overlap (minutes) 5 Rewinds the incremental watermark by five minutes to protect against clock differences and timing gaps.
Duplicate-detection cache size 20000 Keeps the 20,000 most recently seen indicator IDs in the integration context for duplicate detection.
Indicators per fetch run (batch size) 10000 Allows one scheduled run to consume up to 10,000 indicators before saving its progress.
API page size 1000 Requests 1,000 indicators per API call. This is the maximum supported API page size.

Filtering, reputation, and schedule

XSOAR field Example value How to fill it
IOC type filter all Retrieves all supported IOC types. Select ip, domain, hostname, url, or hash to restrict the feed.
Minimum confidence score 0 Does not exclude any indicator based on its Cypho confidence score.
Malicious score threshold 70 Marks an indicator with a score of 70 or higher as Bad in XSOAR.
Suspicious score threshold 40 Marks an indicator with a score from 40 through 69 as Suspicious. Lower scores receive no DBot reputation score.
Indicator Reputation Unknown Use the value shown unless your XSOAR policy requires a fixed reputation override.
Source Reliability B - Usually reliable Select this required reliability value for the feed source.
Traffic Light Protocol Color Not selected Leave unselected unless your organization's handling policy requires a TLP value.
Indicator Expiration Method Indicator Type Uses XSOAR's expiration policy for each indicator type.
Feed Fetch Interval 00 Hours / 04 Minutes The example runs the feed every four minutes. Adjust the interval when your production polling policy requires a different cadence.

Fields not listed above can remain at their platform defaults. Keep Trust any certificate (not secure) disabled in production. Enable Use system proxy settings only when the XSOAR environment requires its configured proxy.

How synchronization works

The integration synchronizes indicators in two phases:

  1. Historical backfill: XSOAR retrieves indicators from the configured Fetch indicators added after boundary. Each scheduled run imports up to 10,000 indicators by default, saves its cursor, and continues during the next run.
  2. Incremental updates: After the backfill is complete, the integration switches automatically to retrieving only newly added indicators.

The incremental watermark overlaps by five minutes by default to protect against clock differences and timing gaps. A small number of indicators may therefore be fetched again; XSOAR de-duplicates them. The integration also keeps a recent-ID cache to avoid repeats across runs.

Advanced synchronization defaults:

Setting Default Notes
Indicators per fetch run 10000 Maximum number consumed during one scheduled run.
API page size 1000 Indicators requested per API call; 1,000 is the API maximum.
Watermark overlap 5 minutes Rewinds the incremental boundary to avoid missed indicators.
Duplicate-detection cache size 20000 Number of recently seen indicator IDs retained in the integration context.

Verify the integration

After saving the instance:

  1. Run the instance test and confirm that XSOAR can authenticate to the Cypho API.

  2. In the XSOAR War Room, preview a small batch without writing it to Threat Intel:

    !cypho-get-indicators limit=10

  3. Check synchronization progress:

    !cypho-feed-status

  4. Confirm that Cypho indicators appear in Threat Intel after a scheduled fetch.

The integration also provides commands to retrieve one indicator, inspect the IOC catalog, and view aggregate feed statistics.

Restart the historical import

The integration stores its phase, cursor, watermark, and duplicate-detection state in the XSOAR integration context. If you intentionally need to clear that state and restart the backfill, run:

!cypho-feed-reset confirm=true

You can add start_from="6 months" or another supported relative or RFC 3339 value to choose a new boundary. Use this command carefully because the following run begins a new historical import.

Troubleshooting

Problem What to check
Authentication fails Confirm that the API key is current and belongs to the intended Cypho company. If Tenant is set, confirm the child-company name.
No indicators are imported Confirm Fetch indicators is enabled. Review the start boundary, IOC type filter, minimum score, and fetch schedule.
The initial import takes several runs This is expected for large datasets. The integration saves its cursor and continues the backfill on the next scheduled run.
A few indicators are fetched more than once This can occur because of the watermark overlap. XSOAR and the integration's recent-ID cache handle de-duplication.
TLS validation fails Verify the XSOAR trust store and network path. Do not enable Trust any certificate in production.
A proxy is required Enable Use system proxy settings and verify the XSOAR system proxy configuration.

Security recommendations

  • Store the API key only in the protected XSOAR credential field.
  • Keep Trust any certificate (not secure) disabled in production.
  • Limit access to integration configuration and logs according to your organization's security policy.
  • Rotate the Cypho API key if it is exposed or no longer needed.