ZeroFox provides cloud-based software as a service for organizations to detect risks found on social media and digital channels, such as phishing, malware, scams, impersonator accounts, piracy, counterfeit and more.

Connect ZeroFox with LogicHub

1. Navigate to Automations > Integrations.

2. Search for ZeroFox.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the LogicHub Remote Agent.

8. API Token: API Token for accessing Zerofox servers.

9. After you've entered all the details, click Connect.

Actions for ZeroFox

Get Alerts

Returns alerts matching given/default filters and parameters. By default, no filters are applied and results are sorted by timestamp.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Get Alerts Data

``` {json}{ "alert_type":"search query", "asset":{ "entity_group":{ "id":4660, "name":"Default" }, "id":9284920, "image":"", "labels":[

}, "asset_term":{ "deleted":false, "id":326992, "name":"TestData" }, "assignee":"", "business_network":null, "content_created_at":"2018-01-01T00:00:00+00:00", "darkweb_term":null, "entity":{ "entity_group":{ "id":4660, "name":"Default" }, "id":578470, "image":"", "labels":[

}, "entity_account":null, "entity_email_receiver_id":null, "entity_term":{ "deleted":false, "id":326992, "name":"TestData" }, "error":null, "escalated":false, "has_error":false, "id":154182828, "last_modified":"2021-10-04T03:37:28Z", "logs":[ { "action":"invalidate", "actor":"Platform Specialist", "id":345634, "subject":"", "timestamp":"2021-10-04T03:37:28+00:00" }, { "action":"open", "actor":"", "id":76542, "subject":"", "timestamp":"2021-09-26T08:27:32+00:00" } ], "metadata":"", "network":"test", "notes":"", "offending_content_url":"https://test.com", "perpetrator":{ "content":"", "display_name":"4r25a", "id":245625444, "name":"f2345", "network":"test", "timestamp":"2018-01-01T00:00:00+00:00", "type":"page", "url":"https://test.com" }, "protected_locations":null, "protected_social_object":"testData", "reviewed":true, "reviews":[

], "rule_group_id":1460, "rule_id":37572, "rule_name":"credentials test", "severity":4, "status":"Closed", "tags":[

], "timestamp":"2021-09-26T08:27:32+00:00" }

Get Alerts By Timerange

Retrieves metrics on an Enterprise's alerts, grouped by timerange.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Get Alerts By Timerange Data

``` {json}{ "begin":"2021-09-26T07:58:30.996000+02:00", "count":1, "has_error":false, "error":null, "end":"2021-09-26T09:58:30.996000+02:00" }

Get Alert Types

List all possible alert types

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of results:

• has_error: True/False

• error: message/null

• result: Get Alert Types Data

``` {json}{ "count":15, "previous":null, "has_error":false, "results":[ { "id":1, "name":"location" }, { "id":5, "name":"query" }, { "id":6, "name":"test data" } ], "error":null, "next":null }

Get Alert By ID

Fetches an alert by ID

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Get Alert By ID Data

``` {json}{ "alert":{ "alert_type":"test search query", "logs":[ { "id":238611, "timestamp":"2021-09-01T02:35:01+00:00", "actor":"Sample Platform Specialist", "subject":"", "action":"modify tags" }, { "id":4518610, "timestamp":"2021-09-01T02:35:00+00:00", "actor":"", "subject":"", "action":"open" } ], "offending_content_url":"https://testurl.com", "asset_term":null, "assignee":"", "entity":{ "id":2345, "name":"Web Domains Test", "image":"", "labels":[

}, "error":null, "has_error":false }

Create Alert Review

Creates a custom, user-defined alert review on the company of the authorized user.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Create Alert Review Data

``` {json}{ "result":[ ....review data ], "error":null, "has_error":false }

Get Subscriptions

List of subscriptions associated with an Alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Get Subscriptions Data

``` {json}{ "error":null, "has_error":false }

Create Alert Tag Changeset

Create an Alert Tag Changeset to bulk modify Alert Tags for a set of Alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Create Alert Tag Changeset Data

``` {json}{ "result":[ ...changeset data ], "error":null, "has_error":false }

Update the Case Notes

Update the case notes.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{json}{ "data": { "msg": "Updated" }, "error": null, "has_error": false }

Release Notes

• v2.0.8 - Jinja bug fix for Get Alerts

• v2.0.0 - Updated architecture to support IO via filesystem

• v1.2.2 - Added 1 new action: Update the Case Notes and added 2 optional field in Get Alerts action named Last Modified Min Date and Last Modified Max Date.