Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

CYFIRMA Cyber Intelligence

Voir sur GitHub ↗Fichier original ↗

Description

The CYFIRMA Cyber Intelligence data connector enables seamless log ingestion from the DeCYFIR API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR Alerts API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.
Statut déclaré
1
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

CyfirmaIndicators_CLCyfirmaThreatActors_CLCyfirmaCampaigns_CLCyfirmaMalware_CL

Permissions déclarées

Read and Write permissions are required.
Workspace
Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

CYFIRMA Cyber Intelligence
This connector provides the Indicators, Threat actors, Malware and Campaigns logs from CYFIRMA Cyber Intelligence. The connector uses the DeCYFIR API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.
CYFIRMA API URL
CYFIRMA API Key
Pull all IoC's Or Tailored IoC's
Set to true to pull all IoC's, set to false to pull tailoried IoC's
API Delta
Setting it to true returns only data added since the last API call, while false returns data from the last 24 hours.
Recommended Actions
Recommended Action can be any one of:All/Monitor/Block
Threat Actor Associated
Is any Threat Actor Associated with the IoC's

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques36
CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation RuleHighCYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation RuleHighCYFIRMA - High severity File Hash Indicators with Block Action and MalwareHighCYFIRMA - High severity File Hash Indicators with Block Action RuleHighCYFIRMA - High severity File Hash Indicators with Monitor Action and MalwareHighCYFIRMA - High severity File Hash Indicators with Monitor Action RuleHighCYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended RuleHighCYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended RuleHighCYFIRMA - High severity Malicious Network Indicators with Block Action RuleHighCYFIRMA - High severity Malicious Network Indicators with Monitor Action RuleHighCYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended RuleHighCYFIRMA - High severity Malicious Phishing Network Indicators - Monitor Recommended RuleHighCYFIRMA - High severity TOR Node Network Indicators - Block Recommended RuleHighCYFIRMA - High severity TOR Node Network Indicators - Monitor Recommended RuleHighCYFIRMA - High severity Trojan File Hash Indicators with Block Action RuleHighCYFIRMA - High severity Trojan File Hash Indicators with Monitor Action RuleHighCYFIRMA - High severity Trojan Network Indicators - Block Recommended RuleHighCYFIRMA - High severity Trojan Network Indicators - Monitor Recommended RuleHighCYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation RuleMediumCYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation RuleMediumCYFIRMA - Medium severity File Hash Indicators with Block Action and MalwareMediumCYFIRMA - Medium severity File Hash Indicators with Block Action RuleMediumCYFIRMA - Medium severity File Hash Indicators with Monitor Action and MalwareMediumCYFIRMA - Medium severity File Hash Indicators with Monitor Action RuleMediumCYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended RuleMediumCYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended RuleMediumCYFIRMA - Medium severity Malicious Network Indicators with Block Action RuleMediumCYFIRMA - Medium severity Malicious Network Indicators with Monitor Action RuleMediumCYFIRMA - Medium severity Malicious Phishing Network Indicators - Block Recommended RuleMediumCYFIRMA - Medium severity Malicious Phishing Network Indicators - Monitor Recommended RuleMediumCYFIRMA - Medium severity TOR Node Network Indicators - Block Recommended RuleMediumCYFIRMA - Medium severity TOR Node Network Indicators - Monitor Recommended RuleMediumCYFIRMA - Medium severity Trojan File Hash Indicators with Block Action RuleMediumCYFIRMA - Medium severity Trojan File Hash Indicators with Monitor Action RuleMediumCYFIRMA - Medium severity Trojan Network Indicators - Block Recommended RuleMediumCYFIRMA - Medium severity Trojan Network Indicators - Monitor Recommended RuleMedium
Solutions1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
CyfirmaCyberIntelligenceDC
Autres fichiers source 2Solutions/Cyfirma Cyber Intelligence/Data Connectors/CyfirmaCyberIntelligence_ccp/CyfirmaCyberIntel_DataConnectorDefinition.jsonsource ↗Solutions/Cyfirma Cyber Intelligence/Data/Solution_CyfirmaCyberIntel.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.