ZeroFox provides cloud-based software as a service for organizations to detect risks found on social media and digital channels, such as phishing, malware, scams, impersonator accounts, piracy, counterfeit and more.

Connect ZeroFox with LogicHub

1. Navigate to Automations > Integrations.
2. Search for ZeroFox.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • API Token: API Token for accessing Zerofox servers.
4. After you've entered all the details, click Connect.

Actions for ZeroFox

Get Alerts

Returns alerts matching given/default filters and parameters. By default, no filters are applied and results are sorted by timestamp.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Alerts Data

{
   "alert_type":"search query",
   "asset":{
      "entity_group":{
         "id":4660,
         "name":"Default"
      },
      "id":9284920,
      "image":"",
      "labels":[
         
      ],
      "name":"Test"
   },
   "asset_term":{
      "deleted":false,
      "id":326992,
      "name":"TestData"
   },
   "assignee":"",
   "business_network":null,
   "content_created_at":"2018-01-01T00:00:00+00:00",
   "darkweb_term":null,
   "entity":{
      "entity_group":{
         "id":4660,
         "name":"Default"
      },
      "id":578470,
      "image":"",
      "labels":[
         
      ],
      "name":"Test"
   },
   "entity_account":null,
   "entity_email_receiver_id":null,
   "entity_term":{
      "deleted":false,
      "id":326992,
      "name":"TestData"
   },
   "error":null,
   "escalated":false,
   "has_error":false,
   "id":154182828,
   "last_modified":"2021-10-04T03:37:28Z",
   "logs":[
      {
         "action":"invalidate",
         "actor":"Platform Specialist",
         "id":345634,
         "subject":"",
         "timestamp":"2021-10-04T03:37:28+00:00"
      },
      {
         "action":"open",
         "actor":"",
         "id":76542,
         "subject":"",
         "timestamp":"2021-09-26T08:27:32+00:00"
      }
   ],
   "metadata":"",
 	 "network":"test",
   "notes":"",
   "offending_content_url":"https://test.com",
   "perpetrator":{
      "content":"",
      "display_name":"4r25a",
      "id":245625444,
      "name":"f2345",
      "network":"test",
      "timestamp":"2018-01-01T00:00:00+00:00",
      "type":"page",
      "url":"https://test.com"
   },
   "protected_locations":null,
   "protected_social_object":"testData",
   "reviewed":true,
   "reviews":[
      
   ],
   "rule_group_id":1460,
   "rule_id":37572,
   "rule_name":"credentials test",
   "severity":4,
   "status":"Closed",
   "tags":[
      
   ],
   "timestamp":"2021-09-26T08:27:32+00:00"
}

Get Alerts By Asset

Retrieves metrics on an Enterprise's alerts, grouped by entity

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Alerts By Asset Data

{
   "count":3,
   "display_name":"TestData",
   "has_error":false,
   "error":null,
   "entity":535235
}

Get Alerts By Timerange

Retrieves metrics on an Enterprise's alerts, grouped by timerange.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Alerts By Timerange Data

{
   "begin":"2021-09-26T07:58:30.996000+02:00",
   "count":1,
   "has_error":false,
   "error":null,
   "end":"2021-09-26T09:58:30.996000+02:00"
}

Get Labels

List all valid labels for a review

Input

Choose a connection that you have previously created complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Labels Data

{
   "result":[
      "NOT_HELPFUL",
      "DUPLICATE",
      "FALSE_POSITIVE",
      "IRRELEVANT",
      "VERIFIED"
   ],
   "error":null,
   "has_error":false
}

Get Alert Types

List all possible alert types

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of results:

• has_error: True/False
• error: message/null
• result: Get Alert Types Data

{
   "count":15,
   "previous":null,
   "has_error":false,
   "results":[
      {
         "id":1,
         "name":"location"
      },
      {
         "id":5,
         "name":"query"
      },
      {
         "id":6,
         "name":"test data"
      }
   ],
   "error":null,
   "next":null
}

Get Alert Type By ID

View an individual Alert Type.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Alert Type By ID Data

{
   "id":1,
   "name":"location test",
   "error":null,
   "has_error":false
}

Get Alert By ID

Fetches an alert by ID

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Alert By ID Data

{
   "alert":{
      "alert_type":"test search query",
      "logs":[
         {
            "id":238611,
            "timestamp":"2021-09-01T02:35:01+00:00",
            "actor":"Sample Platform Specialist",
            "subject":"",
            "action":"modify tags"
         },
         {
            "id":4518610,
            "timestamp":"2021-09-01T02:35:00+00:00",
            "actor":"",
            "subject":"",
            "action":"open"
         }
      ],
      "offending_content_url":"https://testurl.com",
      "asset_term":null,
      "assignee":"",
      "entity":{
         "id":2345,
         "name":"Web Domains Test",
         "image":"",
         "labels":[
            
         ],
         "entity_group":{
            "id":4660,
            "name":"Default"
         }
      },
      "entity_term":null,
      "content_created_at":"2017-01-10T11:00:00+00:00",
      "id":150764339,
      "protected_account":null,
      "severity":2,
      "perpetrator":{
         "name":"test",
         "display_name":"test",
         "id":3424,
         "url":"https://testurl.com",
         "content":"Variation of protected domain",
         "type":"page",
         "timestamp":"2017-01-10T11:00:00+00:00",
         "network":"domains"
      },
      "rule_group_id":457,
      "asset":{
         "id":24356,
         "name":"Web Domains Test",
         "image":"",
         "labels":[
            
         ],
         "entity_group":{
            "id":12341,
            "name":"Default"
         }
      },
      "metadata":"",
      "status":"Open",
      "timestamp":"2021-09-01T02:35:00+00:00",
      "rule_name":"Domain Analysis",
      "last_modified":"2021-09-01T02:35:01Z",
      "protected_locations":null,
      "darkweb_term":null,
      "business_network":null,
      "reviewed":false,
      "escalated":false,
      "network":"domains",
      "protected_social_object":null,
      "notes":"",
      "reviews":[
         
      ],
      "content_actions":[
         
      ],
      "rule_id":2345,
      "entity_account":null,
      "entity_email_receiver_id":null,
      "tags":[
         "a-record",
         "live-domain"
      ]
   },
   "error":null,
   "has_error":false
}

Get Reviews for Alert

Lists all of the alert's current reviews.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Reviews for Alert Data

{
   "result":[
      {
         "id":23451,
         "label":"DUPLICATE",
         "alert":123454,
         "created_by":"",
         "timestamp":"2021-10-06T15:09:54Z"
      }
   ],
   "error":null,
   "has_error":false
}

Create Alert Review

Creates a custom, user-defined alert review on the company of the authorized user.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Create Alert Review Data

{
   "result":[
      ....review data
   ],
   "error":null,
   "has_error":false
}

Get Review by ID

Fetches information about a given alerts review.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Review by ID Data

{
   "result":[
      {
         "id":123454,
         "label":"DUPLICATE",
         "alert":13452,
         "created_by":"",
         "timestamp":"2021-10-06T15:09:54Z"
      }
   ],
   "error":null,
   "has_error":false
}

Get Subscriptions

List of subscriptions associated with an Alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Get Subscriptions Data

{
   "error":null,
   "has_error":false
}

Execute Action on Alert

Performs an action on an alert. Redundant actions (defined as actions that do not change alert status) cannot be performed

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Execute Action on Alert Data

{
   "result":"Successfully executed the action",
   "error":null,
   "has_error":false
}

Create Alert Tag Changeset

Create an Alert Tag Changeset to bulk modify Alert Tags for a set of Alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Create Alert Tag Changeset Data

{
   "result":[
      ...changeset data
   ],
   "error":null,
   "has_error":false
}

List Alert Tags

Returns available alerts tags.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: List Alert Tags Data

{
   "reserved_tags":[
      {
         "name":"test",
         "description":"test desc"
      }
   ],
   "tags":[
      {
         "name":"AC"
      },
      {
         "name":"Location"
      },
      {
         "name":"Connection Error"
      }
   ],
   "error":null,
   "has_error":false
}

Update the Case Notes

Update the case notes.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
  "data": {
    "msg": "Updated"
  },
  "error": null,
  "has_error": false
}

Release Notes

• v2.0.8 - Jinja bug fix for Get Alerts
• v2.0.0 - Updated architecture to support IO via filesystem
• v1.2.2 - Added 1 new action: Update the Case Notes and added 2 optional field in Get Alerts action named Last Modified Min Date and Last Modified Max Date.