Fortinet FortiRecon ACI v2.0.0

About the connector

FortiRecon is a Digital Risk Protection Service (DRPS) product that provides an outside-the-network view to the risks posed to your enterprise.The Adversary Centric Intelligence (ACI) module leverages FortiGuard Threat Analysts to provide comprehensive coverage of dark web, open source, and technical threat intelligence, including threat actor insights. This information enables administrators to proactively assess risks, respond faster to incidents, better understand their attackers, and protect assets. This connector facilitates the automated operations related to ACI.

This document provides information about the Fortinet FortiRecon ACI Connector, which facilitates automated interactions, with a Fortinet FortiRecon ACI server using FortiSOAR™ playbooks. Add the Fortinet FortiRecon ACI Connector as a step in FortiSOAR™ playbooks and perform automated operations with Fortinet FortiRecon ACI.

Version information

Connector Version: 2.0.0

FortiSOAR™ Version Tested on: 7.6.1-5275

Authored By: Fortinet

Certified: Yes

Release Notes for version 2.0.0

Following enhancements have been made to the Fortinet FortiRecon ACI Connector in version 2.0.0:

• Added following new actions and their corresponding playbooks:
  • Get ICL Saved Searches
  • Get ICL Saved Searches By ID
  • Get Leaked Stealers Infections
  • Get Potential Ransomware Victims
  • Get Ransomware Group Information
  • Get Ransomware Intelligence Orgs Watchlist To Monitor
  • Get Ransomware Intelligence Stats
  • Get Ransomware Threat Campaign
  • Get Ransomware Vendors Added For Ransomware Intelligence Monitoring
  • Get Ransomware Vendors Matched
  • Get Ransomware Victim Details By ID
  • Get Ransomware Victims
  • Get Stealers Infections Leaked Count
  • Get Stealers Infections On Sale
  • Get Stealers Infections On Sale Count
  • Get The Matched Organizations For Ransomware Intelligence Monitoring
  • Get The Technical Indicators For The Given Ransomware Group
  • Get Vendor Details By ID
  • Get Vendor Exposures By Vendor ID
  • Get Vendor Watchlist
  • Get Vulnerability Intelligence CVEs
  • Get Vulnerability Intelligence CVEs By ID
  • Get Vulnerability Intelligence Stats For CVE ID
  • Get Vulnerability Intelligence hits By CVE ID
  • Get Vulnerability Intelligence vulnerable products
  • Get Vulnerability Intelligence vulnerable vendors
  • Update Stealers Leaked Status
  • Update Stealers On Sale Marketplaces Status
• The action Get Stealers Log is now deprecated and hence removed.
• Added a new parameter Get All Records in the action Get IOCs.
• The following playbooks have been added:
  • FortiSOAR Threat Intel Feeds Using Threat Intel Report > Create
  • Get FortiRecon ACI Threat Intel Report IOC
  • FortiRecon ACI Threat Intel Report > Fetch
• The following playbooks are now removed:
  • Get Stealers Log
  • Get FortiRecon ACI Report IOC
  • FortiRecon ACI Report > Fetch
  • FortiSOAR Threat Feeds Using FortiRecon ACI Report > Create
• Updated the data ingestion parameters.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-fortinet-fortirecon-aci

Prerequisites to configuring the connector

• You must have the URL of Fortinet FortiRecon ACI server to connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fortinet FortiRecon ACI server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiRecon ACI connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Get IOCs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "ioc": "",
            "ioc_type": "",
            "report_id": "",
            "report_title": ""
        },
        {
            "ioc": "",
            "ioc_type": "",
            "report_id": "",
            "report_title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Leaked Cards

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "bank_name": "",
            "base_name": "",
            "bg_code": "",
            "bin": "",
            "brand_name": "",
            "category": "",
            "city": "",
            "country": "",
            "expiry": "",
            "holder_name": "",
            "index_ts": "",
            "org_id": "",
            "price": "",
            "shop_name": "",
            "state": "",
            "type": "",
            "unique_id": "",
            "zip": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Widgets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "name": ""
        },
        {
            "id": "",
            "name": ""
        },
        {
            "id": "",
            "name": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get OSINT Feeds

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "content_snippet": "",
            "is_latest": "",
            "link": "",
            "publish_date": "",
            "tags": [
                "",
                ""
            ],
            "title": "",
            "widget_id": "",
            "widget_name": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Reports

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "adversary": [
                ""
            ],
            "geography": [
                ""
            ],
            "industry_tags": [
                ""
            ],
            "information_date": "",
            "information_reliability": "",
            "motivation": "",
            "publish_date": "",
            "relevance_rating": "",
            "report_id": "",
            "report_title": "",
            "report_type": "",
            "source_category": "",
            "source_name": "",
            "source_reliability": "",
            "status": "",
            "summary": "",
            "threat": [
                "",
                ""
            ],
            "tlp": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Reports With IOCs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "adversary": [
        ""
    ],
    "category": "",
    "customer_tag": "",
    "geography": [
        ""
    ],
    "industry_tags": [
        ""
    ],
    "information_date": "",
    "information_reliability": "",
    "ioc": [],
    "motivation": "",
    "publish_date": "",
    "relevance_rating": "",
    "report_id": "",
    "report_title": "",
    "source_name": "",
    "source_reliability": "",
    "status": "",
    "summary": "",
    "tags": [
        "",
        ""
    ],
    "tlp": "",
    "type": ""
}

operation: Get ICL Saved Searches

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "added_ts": "",
            "alert": "",
            "id": "",
            "query": "",
            "query_title": "",
            "query_type": "",
            "sources": []
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get ICL Saved Searches By ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get ICL Saved Searches Result Based On as Archived Forums:

{
    "hits": [
        {
            "content": "",
            "published_ts": "",
            "source_site": "",
            "title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Defacements:

{
    "hits": [
        {
            "author_name": "",
            "defaced_domain": "",
            "mirror_link": "",
            "published_ts": "",
            "source_site": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Forums:

{
    "hits": [
        {
            "author_name": "",
            "content": "",
            "published_ts": "",
            "source_site": "",
            "title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Leak Docs:

{
    "hits": [
        {
            "information_source": "",
            "published_ts": "",
            "title": "",
            "victim_company": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Osint Feeds:

{
    "hits": [
        {
            "content": "",
            "published_ts": "",
            "source_url": "",
            "title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Pastes:

{
    "hits": [
        {
            "author_name": "",
            "content": "",
            "published_ts": "",
            "source_url": "",
            "title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Ransomware:

{
    "hits": [
        {
            "content": "",
            "published_ts": "",
            "ransomware_name": "",
            "title": "",
            "victim_company": "",
            "victim_country": "",
            "victim_domains": "",
            "victim_sectors": []
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get ICL Saved Searches Result Based On as Telegram:

{
    "hits": [
        {
            "author_id": "",
            "author_name": "",
            "channel": "",
            "message": "",
            "published_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Stealers Infections Leaked Count

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Based On as Affiliated Domain:

{
    "count_by_affiliated_domain": {
        "aggregations": [
            {
                "count": "",
                "id": ""
            }
        ],
        "total": ""
    }
}

Output schema when you choose Based On as Status:

{
    "count_by_status": {
        "aggregations": [
            {
                "count": "",
                "id": ""
            }
        ],
        "total": ""
    }
}

Output schema when you choose Based On as Stealer:

{
    "count_by_stealer": {
        "aggregations": [
            {
                "count": "",
                "id": ""
            }
        ],
        "total": ""
    }
}

operation: Get Leaked Stealers Infections

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "country": "",
            "country_code": "",
            "id": "",
            "infection_ts": "",
            "ip": "",
            "status": "",
            "stealer_name": "",
            "url": "",
            "username": "",
            "user_type": "",
            "affiliated_domain": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vendor Exposures By Vendor ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get Exposures For as Attack Surface Exposure:

{
    "asset_distribution": [
        {
            "country": "",
            "severity": {},
            "total_assets": ""
        }
    ],
    "commonly_targeted_services": [
        {
            "count": "",
            "port_number": ""
        }
    ],
    "issues_by_severity": {
        "high": "",
        "low": "",
        "medium": ""
    },
    "risk_level": "",
    "security_issues": [
        {
            "asset_count": "",
            "issue_bucket": "",
            "issue_count": {
                "high": "",
                "low": "",
                "medium": ""
            },
            "sub_issues": [
                {
                    "asset_count": "",
                    "issue_name": ""
                }
            ]
        }
    ]
}

Output schema when you choose Get Exposures For as Darknet Exposure:

{
    "botnet_infections": {
        "compromised_employee": [
            {
                "count": "",
                "duration": ""
            }
        ],
        "compromised_user": [
            {
                "count": "",
                "duration": ""
            }
        ],
        "stealer_marketplace": [
            {
                "count": "",
                "duration": ""
            }
        ]
    },
    "credential_breaches": {
        "credex": [
            {
                "count": "",
                "duration": ""
            }
        ],
        "credex_indexed": [
            {
                "count": "",
                "duration": ""
            }
        ],
        "credex_names": [
            {
                "count": "",
                "name": ""
            }
        ]
    },
    "darknet_mentions": {
        "count": ""
    },
    "dataleak_mentions": {
        "count": ""
    },
    "risk_level": ""
}

Output schema when you choose Get Exposures For as Incidents:

{
    "fortirecon_reportings": {
        "count": "",
        "hits": [
            {
                "actor": "",
                "affected_domain": "",
                "timestamp": ""
            }
        ]
    },
    "ransomware_incidents": {
        "count": "",
        "hits": [
            {
                "affected_domain": "",
                "ransomware_name": "",
                "timestamp": ""
            }
        ]
    },
    "risk_level": ""
}

operation: Get Vendor Watchlist

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "vendor_id": "",
            "name": "",
            "domain": "",
            "website": "",
            "logo": "",
            "risk_level": "",
            "status": "",
            "approval_status": "",
            "last_refreshed_on": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vendor Details By ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "vendor_id": "",
    "alexa_rank": "",
    "approval_status": "",
    "continent": "",
    "country": "",
    "desc": "",
    "domain": "",
    "employee_count": "",
    "logo": "",
    "name": "",
    "revenue": "",
    "primary_industry": [],
    "status": "",
    "website": ""
}

operation: Get Vulnerability Intelligence CVEs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "cve_id": "",
            "is_active": "",
            "nvd_score": "",
            "status": "",
            "nvd_severity": "",
            "recon_score": "",
            "recon_severity": "",
            "year": "",
            "tags": "",
            "description": "",
            "products": [],
            "vendors": [],
            "iasm_affected_hosts": [],
            "easm_affected_hosts": [],
            "last_refreshed_ts": "",
            "created_ts": "",
            "published_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vulnerability Intelligence CVEs By ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "cve_id": "",
    "is_active": "",
    "status": "",
    "nvd_score": "",
    "nvd_severity": "",
    "recon_score": "",
    "recon_severity": "",
    "year": "",
    "vendors": [],
    "tags": [],
    "products": [],
    "description": "",
    "easm_affected_hosts": [],
    "iasm_affected_hosts": [],
    "last_refreshed_ts": "",
    "published_ts": "",
    "created_ts": "",
    "lookup_priority": "",
    "nvd_metadata": ""
}

operation: Get Vulnerability Intelligence vulnerable products

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "product": "",
            "count": "",
            "recon_severity": {
                "low": "",
                "medium": "",
                "critical": ""
            },
            "nvd_severity": {
                "medium": "",
                "high": "",
                "critical": "",
                "low": ""
            }
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vulnerability Intelligence vulnerable vendors

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "vendor": "",
            "count": "",
            "recon_severity": {
                "low": "",
                "medium": "",
                "critical": ""
            },
            "nvd_severity": {
                "medium": "",
                "high": "",
                "critical": "",
                "low": ""
            }
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vulnerability Intelligence hits By CVE ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get the CVE hits for a given CVE ID Based On as ACI Reporting:

{
    "hits": [
        {
            "report_id": "",
            "report_title": "",
            "summary": "",
            "publish_date": "",
            "relevance_rating": "",
            "_id": "",
            "adversary": "",
            "source_category": "",
            "motivation": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as Darknet Chatter:

{
    "hits": [
        {
            "published_ts": "",
            "is_topic": "",
            "source_site": "",
            "title": "",
            "thread_id": "",
            "thread_url": "",
            "content": "",
            "author_name": "",
            "_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as Working Exploits:

{
    "hits": [
        {
            "url": "",
            "published_ts": "",
            "repo_source": "",
            "author_name": "",
            "_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as POC Exploits:

{
    "hits": [
        {
            "html_url": "",
            "owner_username": "",
            "repo_name": "",
            "description": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as Security Blogs:

{
    "hits": [
        {
            "title": "",
            "description": "",
            "link": "",
            "author": "",
            "published_date": "",
            "is_trusted": "",
            "_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as Hacktivist Chatter:

{
    "hits": [
        {
            "channel": "",
            "message": "",
            "message_type": "",
            "image_url": "",
            "author_id": "",
            "author_name": "",
            "published_ts": "",
            "message_link": "",
            "sender_url": "",
            "_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get the CVE hits for a given CVE ID Based On as Social Media:

{
    "hits": [
        {
            "_id": "",
            "author_id": "",
            "author_name": "",
            "source_url": "",
            "content": "",
            "published_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Vulnerability Intelligence Stats For CVE ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get stats for the given CVE ID Based On as Data Source Distribution:

{
    "hits": [
        {
            "count": "",
            "label": ""
        }
    ]
}

Output schema when you choose Get stats for the given CVE ID Based On as Data Source Trend:

{
    "hits": [
        {
            "data": {
                "ACI Reporting": "",
                "Darknet Chatter": "",
                "FortiGuard Outbreak Alert": "",
                "Hacktivist Chatter": "",
                "POC Exploit": "",
                "Security Blogs": "",
                "Social Media": "",
                "Working Exploit": ""
            },
            "date": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

Output schema when you choose Get stats for the given CVE ID Based On as Score Trend:

{
    "hits": [
        {
            "date": "",
            "epss_score": "",
            "recon_score": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Stealers Infections On Sale Count

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Based On as Matched Domain:

{
    "count_by_matched_domain": {
        "aggregations": [
            {
                "count": "",
                "id": ""
            }
        ],
        "total": ""
    }
}

Output schema when you choose Based On as Stealer:

{
    "count_by_stealer": {
        "aggregations": [
            {
                "count": "",
                "id": ""
            }
        ],
        "total": ""
    }
}

operation: Get Stealers Infections On Sale

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "marketplace": "",
            "isp": "",
            "sites": [],
            "stealer_name": "",
            "country": "",
            "country_code": "",
            "state": "",
            "matched_domains": [],
            "price": "",
            "currency": "",
            "vendor": "",
            "status": "",
            "discovery_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Victims

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "title": "",
            "name": "",
            "domains": [],
            "revenue": "",
            "post_text": "",
            "sectors": [],
            "country": "",
            "continent": "",
            "ransomware_name": "",
            "description": "",
            "added_ts": "",
            "updated_ts": "",
            "collection_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Victim Details By ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "post_title": "",
    "post_text": "",
    "ransomware_name": "",
    "victim_domains": [],
    "victim_company": "",
    "victim_country": "",
    "victim_continent": "",
    "victim_sectors": [],
    "victim_description": "",
    "victim_parent_org": "",
    "victim_revenue_in_usd": [],
    "posted_ts": "",
    "updated_ts": "",
    "collection_ts": ""
}

operation: Get Ransomware Vendors Added For Ransomware Intelligence Monitoring

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "domain": "",
            "vendor_name": "",
            "added_ts": "",
            "updated_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Vendors Matched

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "domains": [],
            "name": "",
            "type": "",
            "collection_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Intelligence Stats

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get Ransomware Intelligence Stats For as Top Ransomware Victims By Sector:

{
    "items": [
        {
            "items": [
                {
                    "count": "",
                    "country": ""
                }
            ]
        }
    ],
    "sectors": "Manufacturing"
}

Output schema when you choose Get Ransomware Intelligence Stats For as Top Ransomware Victims By Revenue:

{
    "items": [
        {
            "data": [
                {
                    "name": "",
                    "ransomware_name": "",
                    "revenue": "",
                    "revenue_in_number": ""
                }
            ],
            "display_id": "",
            "label": ""
        }
    ]
}

Output schema when you choose Get Ransomware Intelligence Stats For as Top Ransomware Victims By Country:

{
    "items": [
        {
            "country": "",
            "items": [
                {
                    "count": "",
                    "sectors": ""
                }
            ]
        }
    ]
}

Output schema when you choose Get Ransomware Intelligence Stats For as Top Ransomware Groups:

{
    "date_range": "",
    "items": [
        {
            "count": "",
            "group": ""
        }
    ],
    "total": ""
}

Output schema when you choose Get Ransomware Intelligence Stats For as Ransomware Victims Over Time:

{
    "items": [
        {
            "count": "",
            "date": ""
        }
    ],
    "total": ""
}

Output schema when you choose Get Ransomware Intelligence Stats For as Latest Active Ransomware Groups:

{
    "items": [
        {
            "count": "",
            "group": "",
            "last_added": ""
        }
    ],
    "total": ""
}

operation: Get Ransomware Threat Campaign

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "actors": "",
            "id": "",
            "ransomware_name": "",
            "report_date": "",
            "report_id": "",
            "report_title": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Potential Ransomware Victims

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "actor": "",
            "collection_date": "",
            "country": "",
            "description": "",
            "domains": [],
            "id": "",
            "name": "",
            "report_id": "",
            "revenue": "",
            "sectors": [],
            "source": "",
            "updated_date": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Intelligence Orgs Watchlist To Monitor

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "domain": "",
            "org_name": "",
            "type": "",
            "added_ts": "",
            "updated_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get The Matched Organizations For Ransomware Intelligence Monitoring

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "domains": [],
            "name": "",
            "type": "",
            "collection_ts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get The Technical Indicators For The Given Ransomware Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "ioc": "",
            "ioc_type": "",
            "report_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Ransomware Group Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "first_seen": "",
    "total_victims": "",
    "victim_countries": [
        {
            "count": "",
            "country": ""
        }
    ],
    "victim_sectors": [
        {
            "count": "",
            "sector": ""
        }
    ]
}

operation: Update Stealers Leaked Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "message": ""
}

operation: Update Stealers On Sale(Marketplaces) Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "message": ""
}

Included playbooks

The Sample - Fortinet FortiRecon ACI - 2.0.0 playbook collection comes bundled with the Fortinet FortiRecon ACI connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiRecon ACI connector.

• FortiRecon ACI Threat Intel Report > Fetch
• FortiSOAR Threat Intel Feeds Using Threat Intel Report > Create
• Get FortiRecon ACI Threat Intel Report IOC
• Get ICL Saved Searches
• Get ICL Saved Searches By ID
• Get IOCs
• Get Leaked Cards
• Get Leaked Stealers Infections
• Get OSINT Feeds
• Get Potential Ransomware Victims
• Get Ransomware Group Information
• Get Ransomware Intelligence Orgs Watchlist To Monitor
• Get Ransomware Intelligence Stats
• Get Ransomware Threat Campaign
• Get Ransomware Vendors Added For Ransomware Intelligence Monitoring
• Get Ransomware Vendors Matched
• Get Ransomware Victim Details By ID
• Get Ransomware Victims
• Get Reports
• Get Reports With IOCs
• Get Stealers Infections Leaked Count
• Get Stealers Infections On Sale
• Get Stealers Infections On Sale Count
• Get The Matched Organizations For Ransomware Intelligence Monitoring
• Get The Technical Indicators For The Given Ransomware Group
• Get Vendor Details By ID
• Get Vendor Exposures By Vendor ID
• Get Vendor Watchlist
• Get Vulnerability Intelligence CVEs
• Get Vulnerability Intelligence CVEs By ID
• Get Vulnerability Intelligence Stats For CVE ID
• Get Vulnerability Intelligence hits By CVE ID
• Get Vulnerability Intelligence vulnerable products
• Get Vulnerability Intelligence vulnerable vendors
• Get Widgets
• Map Adversary to MITRE Groups/Techniques/Softwares
• On Create > Map Adversary to MITRE Groups/Techniques/Softwares
• On Update > Map Adversary to MITRE Groups/Techniques/Softwares
• Update Stealers Leaked Status
• Update Stealers On Sale Marketplaces Status

NOTE: In the Threat Intel Management Solution Pack's Threat Intel Report module we fetch reports containing indicators whose source category is Technical Intelligence.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling reports from Fortinet FortiRecon ACI. Currently, reports in Fortinet FortiRecon ACI are mapped to Threat Intel Management in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming FortiRecon ACI reports to Threat Intel Management in FortiSOAR™.

The Data Ingestion Wizard enables you to configure scheduled pulling of data from FortiRecon ACI into FortiSOAR™. It also lets you pull some sample data from FortiRecon ACI using which you can define the mapping of data between FortiRecon ACI Reports and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users mostly require to only map any custom fields that are added to the FortiRecon ACI reports.

1. To begin configuring data ingestion, click Configure Data Ingestion on the FortiRecon ACI connector's Configurations page.
   Click Let's Start by fetching some data, to open the Fetch Sample Data screen.
   
   Sample data is required to create a field mapping between FortiRecon ACI reports and FortiSOAR™ Threat Intel Management. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch reports from FortiRecon ACI. You can specify the Pull Reports Created in Past X Hours reports from FortiRecon ACI. The fetched data is used to create a mapping between the FortiRecon ACI reports and FortiSOAR™ Threat Intel Management.
   
   Once you have completed specifying the configurations, click Fetch Data.

3. On the Field Mapping screen, map the fields of a FortiRecon ACI reports to the fields of Threat Intel Management present in FortiSOAR™.
   
   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed mapping fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to FortiRecon ACI, so that the content gets pulled from the FortiRecon ACI integration into FortiSOAR™.
   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.
   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, if you want to pull data from FortiRecon ACI every 5 minutes, click Every X Minute and in the minute box enter */5. This would mean that based on the configuration you have set up, data, i.e., indicators will be pulled from FortiRecon ACI every 5 minutes.
   
   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.