Cofense Triage
Last updated
What this adapter fetches
This adapter ingests Cofense Triage Reporters — employees of your organization who report suspicious emails via the Cofense Reporter button. Reporter records include email, last reported date, reputation score, VIP flag, and total report count. Phishing reports, threat indicators, and IOC data are out of scope.
Cofense Triage instance hostname (e.g., triage.your-company.com). Enter without the https:// prefix.
The OAuth2 Client ID generated for an API user in your Cofense Triage instance. Created in the Cofense Triage UI under the API Keys section by an administrator.
The OAuth2 Client Secret paired with the Client ID. Capture this value at creation time — it is typically shown only once.
Optional proxy server in host:port format used to reach the Cofense Triage instance.
The amount of time (in seconds) to wait for Cofense Triage API responses (default: 60).
Permissions Required
The API user must have read access to the Reporters endpoint (/api/public/v2/reporters) in Cofense Triage. Without that role, requests return HTTP 403.
Attention
Please perform a connection test to ensure there is a valid connection to your Cofense Triage instance. When the discovery operation is finalized you will be able to see the details on the Assets page.
Last updated