Skip to main content

Anomali ThreatStream v3

This Integration is part of the Anomali ThreatStream Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Use Anomali ThreatStream to query and submit threats.

Some changes have been made that might affect your existing content. If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Anomali ThreatStream v3 on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Anomali ThreatStream v3.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    Server URL (e.g., https://www.test.com)True
    UsernameTrue
    API KeyTrue
    URL thresholdFalse
    IP thresholdFalse
    Domain thresholdFalse
    File thresholdFalse
    Email thresholdFalse
    Include inactive resultsWhether to include inactive indicators in reputation commands.False
    Source ReliabilityReliability of the source providing the intelligence data.True
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
    Create relationshipsCreate relationships between indicators as part of enrichment.False
  4. Click Test to validate the URLs, token, and connection.

Configure Indicator Threshold Parameters#

Each indicator has a threshold parameter and an integer confidence value that impacts the indicator's DBotScore calculation.
The indicator DBotScore is calculated as follows:

  • If you do not specify the threshold parameter value in your instance configuration (recommended):
    If the indicator confidence > 65, the DBotScore value is set to 3 (Malicious).
    If the indicator confidence is between 25 and 65, the DBotScore value is set to 2 (Suspicious).
    If the indicator confidence < 25, the DBotScore value is set to 1 (Good).
    For example, If the IP threshold value is not specified during configuration and the IP indicator confidence value is 45, the DBotScore value is set to 2 (Suspicious).
  • If you configure the threshold parameter value:
    If the indicator confidence value is above the threshold parameter value, the DBotScore is set to 3 (Malicious). Otherwise the DBotScore is set to 1 (Good).
    Note: You cannot define a threshold that sets the DBotScore to 2 (Suspicious).
    For example, if in the instance configuration you set File threshold to 10 and the confidence value is 15, the DBotScore is set to 3 (Malicious).

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip#


Checks the reputation of the given IP address.

Base Command#

ip

Input#

Argument NameDescriptionRequired
ipThe IP to check.Required
thresholdIf confidence is greater than the threshold the IP address is considered malicious, otherwise it is considered good. This argument overrides the default IP threshold defined as a parameter.Optional
include_inactiveWhether to include results with an inactive status. Possible values are: True, False.Optional
threat_model_associationEnhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.Optional

Context Output#

PathTypeDescription
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
IP.ASNStringThe Autonomous System (AS) number associated with the indicator.
IP.AddressStringThe IP address of the indicator.
IP.Geo.CountryStringThe country associated with the indicator.
IP.Geo.LocationStringThe longitude and latitude of the IP address.
ThreatStream.IP.ASNStringThe Autonomous System (AS) number associated with the indicator.
ThreatStream.IP.AddressStringThe IP address of the indicator.
ThreatStream.IP.CountryStringThe country associated with the indicator.
ThreatStream.IP.TypeStringThe indicator type.
ThreatStream.IP.ModifiedStringThe time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time in UTC time.
ThreatStream.IP.SeverityStringThe indicator severity ("very-high", "high", "medium", or "low").
ThreatStream.IP.ConfidenceStringThe observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.IP.StatusStringThe status assigned to the indicator.
ThreatStream.IP.OrganizationStringThe name of the business that owns the IP address associated with the indicator.
ThreatStream.IP.SourceStringThe indicator source.
IP.Malicious.VendorStringThe vendor that reported the indicator as malicious.
ThreatStream.IP.TagsUnknownTags assigned to the IP.
ThreatStream.IP.ITypeStringThe itype of the indicator associated with the specified model.
IP.TagsUnknownList of IP tags.
IP.ThreatTypesUnknownThreat types associated with the IP.
ThreatStream.IP.Actor.assignee_userUnknownThe assignee user of the threat actor.
ThreatStream.IP.Actor.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.IP.Actor.association_info.createdDateThe date the association info was created.
ThreatStream.IP.Actor.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.IP.Actor.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.IP.Actor.created_tsDateThe date the threat actor was created.
ThreatStream.IP.Actor.feed_idNumberThe feed ID of the threat actor.
ThreatStream.IP.Actor.idNumberThe ID of the threat actor.
ThreatStream.IP.Actor.is_anonymousBooleanWhether the threat actor is anonymous.
ThreatStream.IP.Actor.is_cloneableStringWhether the threat actor is cloneable.
ThreatStream.IP.Actor.is_publicBooleanWhether the threat actor is public.
ThreatStream.IP.Actor.is_teamBooleanWhether the threat actor is a team.
ThreatStream.IP.Actor.modified_tsDateThe date the threat actor was modified.
ThreatStream.IP.Actor.nameStringThe name of the threat actor.
ThreatStream.IP.Actor.organization_idNumberThe organization ID of the threat actor.
ThreatStream.IP.Actor.owner_user_idNumberThe owner user ID of the threat actor.
ThreatStream.IP.Actor.primary_motivationUnknownThe primary motivation of the threat actor.
ThreatStream.IP.Actor.publication_statusStringThe publication status of the threat actor.
ThreatStream.IP.Actor.published_tsDateThe date the threat actor was published.
ThreatStream.IP.Actor.resource_levelUnknownThe resource level of the threat actor.
ThreatStream.IP.Actor.resource_uriStringThe resource URI of the threat actor.
ThreatStream.IP.Actor.source_createdUnknownThe date the source was created.
ThreatStream.IP.Actor.source_modifiedUnknownThe date the source was modified.
ThreatStream.IP.Actor.start_dateUnknownThe start date.
ThreatStream.IP.Actor.tagsStringThe tags of the threat indicator.
ThreatStream.IP.Actor.tags_v2.idStringThe ID of the tag.
ThreatStream.IP.Actor.tags_v2.nameStringThe name of the tag.
ThreatStream.IP.Actor.tlpStringThe TLP of the threat actor.
ThreatStream.IP.Actor.uuidStringThe UUID of the threat actor.
ThreatStream.IP.Signature.assignee_userUnknownThe assignee user of the signature.
ThreatStream.IP.Signature.association_info.commentUnknownThe comment in the association info of the signature.
ThreatStream.IP.Signature.association_info.createdDateThe date the association info was created.
ThreatStream.IP.Signature.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.IP.Signature.can_add_public_tagsBooleanWhether you can add public tags to the signature.
ThreatStream.IP.Signature.created_tsDateThe date the signature was created.
ThreatStream.IP.Signature.feed_idNumberThe feed ID of the signature.
ThreatStream.IP.Signature.idNumberThe ID of the signature.
ThreatStream.IP.Signature.is_anonymousBooleanWhether the signature was anonymous.
ThreatStream.IP.Signature.is_cloneableStringWhether the signature is cloneable.
ThreatStream.IP.Signature.is_publicBooleanWhether the signature is public.
ThreatStream.IP.Signature.is_teamBooleanWhether the signature is a team signature.
ThreatStream.IP.Signature.modified_tsDateThe date the signature was modified.
ThreatStream.IP.Signature.nameStringThe name of the signature.
ThreatStream.IP.Signature.organization_idNumberThe organization ID of the signature.
ThreatStream.IP.Signature.owner_user_idNumberThe owner user ID of the signature.
ThreatStream.IP.Signature.primary_motivationUnknownThe primary motivation of the signature.
ThreatStream.IP.Signature.publication_statusStringThe publication status of the signature.
ThreatStream.IP.Signature.published_tsDateThe date the signature was published.
ThreatStream.IP.Signature.resource_levelUnknownThe resource level of the signature.
ThreatStream.IP.Signature.resource_uriStringThe resource URI of the signature.
ThreatStream.IP.Signature.source_createdUnknownThe date the source was created.
ThreatStream.IP.Signature.source_modifiedUnknownThe date the source was modified.
ThreatStream.IP.Signature.start_dateUnknownThe start date.
ThreatStream.IP.Signature.tagsStringThe tags of the threat indicator.
ThreatStream.IP.Signature.tags_v2.idStringThe ID of the tag.
ThreatStream.IP.Signature.tags_v2.nameStringThe name of the tag.
ThreatStream.IP.Signature.tlpStringThe TLP of the signature.
ThreatStream.IP.Signature.uuidStringThe UUID of the signature.
ThreatStream.IP.ThreatBulletin.all_circles_visibleBooleanWhether all of the circles are visible.
ThreatStream.IP.ThreatBulletin.assignee_orgStringThe assignee organization.
ThreatStream.IP.ThreatBulletin.assignee_org_idStringThe assignee organization ID.
ThreatStream.IP.ThreatBulletin.assignee_org_nameStringThe assignee organization name.
ThreatStream.IP.ThreatBulletin.assignee_userStringThe assignee user.
ThreatStream.IP.ThreatBulletin.assignee_user_idStringThe assignee user ID.
ThreatStream.IP.ThreatBulletin.assignee_user_nameUnknownThe assignee user name.
ThreatStream.IP.ThreatBulletin.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.IP.ThreatBulletin.association_info.createdDateThe date the association info was created.
ThreatStream.IP.ThreatBulletin.association_info.from_idStringThe ID from which the association info is related.
ThreatStream.IP.ThreatBulletin.body_content_typeStringThe body content type.
ThreatStream.IP.ThreatBulletin.campaignUnknownThe campaign of the threat bulletin.
ThreatStream.IP.ThreatBulletin.can_add_public_tagsBooleanWhether you can add public tags.
ThreatStream.IP.ThreatBulletin.created_tsDateThe date the threat bulletin was created.
ThreatStream.IP.ThreatBulletin.feed_idNumberThe feed ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.idStringThe ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.is_anonymousBooleanWhether the threat bulletin is anonymous.
ThreatStream.IP.ThreatBulletin.is_cloneableStringWhether the threat bulletin is cloneable.
ThreatStream.IP.ThreatBulletin.is_editableBooleanWhether the threat bulletin is editable.
ThreatStream.IP.ThreatBulletin.is_emailBooleanWhether the threat bulletin is an email.
ThreatStream.IP.ThreatBulletin.is_publicBooleanWhether the threat bulletin is public.
ThreatStream.IP.ThreatBulletin.modified_tsDateThe date the threat bulletin was modified.
ThreatStream.IP.ThreatBulletin.nameStringThe name of the threat bulletin.
ThreatStream.IP.ThreatBulletin.original_sourceStringThe original source of the threat bulletin.
ThreatStream.IP.ThreatBulletin.original_source_idUnknownThe original source ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.owner_org.idStringThe owner organization ID.
ThreatStream.IP.ThreatBulletin.owner_org.nameStringThe owner organization name.
ThreatStream.IP.ThreatBulletin.owner_org.resource_uriStringThe owner organization URI.
ThreatStream.IP.ThreatBulletin.owner_org_idNumberThe ID of the owner user.
ThreatStream.IP.ThreatBulletin.owner_org_nameStringThe name of the owner organization.
ThreatStream.IP.ThreatBulletin.owner_user.avatar_s3_urlUnknownThe URL of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.can_share_intelligenceBooleanWhether you can share intelligence.
ThreatStream.IP.ThreatBulletin.owner_user.emailStringThe email of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.idStringThe ID of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.is_activeBooleanWhether the owner user is active.
ThreatStream.IP.ThreatBulletin.owner_user.is_readonlyBooleanWhether the owner user has read-only permission.
ThreatStream.IP.ThreatBulletin.owner_user.must_change_passwordBooleanWhether the owner user must change the password.
ThreatStream.IP.ThreatBulletin.owner_user.nameStringThe owner user name.
ThreatStream.IP.ThreatBulletin.owner_user.nicknameStringThe owner user nickname.
ThreatStream.IP.ThreatBulletin.owner_user.organization.idStringThe ID of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.organization.nameStringThe name of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.organization.resource_uriStringThe resource URI of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.resource_uriStringThe resource URI of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user_idNumberThe owner user ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.owner_user_nameStringThe owner user name of the threat bulletin.
ThreatStream.IP.ThreatBulletin.parentUnknownThe parent of the threat bulletin.
ThreatStream.IP.ThreatBulletin.published_tsUnknownThe date the threat bulletin was published.
ThreatStream.IP.ThreatBulletin.resource_uriStringThe resource URI of the threat bulletin.
ThreatStream.IP.ThreatBulletin.sourceUnknownThe source of the threat bulletin.
ThreatStream.IP.ThreatBulletin.source_createdUnknownThe date the source was created.
ThreatStream.IP.ThreatBulletin.source_modifiedUnknownThe date the source was modified.
ThreatStream.IP.ThreatBulletin.starred_by_meBooleanWhether the threat bulletin was started by me.
ThreatStream.IP.ThreatBulletin.starred_total_countNumberThe total number of times the threat bulletin was starred.
ThreatStream.IP.ThreatBulletin.statusStringThe status of the threat bulletin.
ThreatStream.IP.ThreatBulletin.threat_actorUnknownThe threat actor of the threat bulletin.
ThreatStream.IP.ThreatBulletin.tlpUnknownThe TLP of the threat bulletin.
ThreatStream.IP.ThreatBulletin.ttpUnknownThe TTP of the threat bulletin.
ThreatStream.IP.ThreatBulletin.uuidStringThe UUID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.votes.meUnknownThe number of votes by me.
ThreatStream.IP.ThreatBulletin.votes.totalNumberThe number of total votes.
ThreatStream.IP.ThreatBulletin.watched_by_meBooleanWhether the threat bulletin was watched by me.
ThreatStream.IP.ThreatBulletin.watched_total_countNumberThe total number of watchers.
ThreatStream.IP.TTP.assignee_userUnknownThe assignee user of the TTP.
ThreatStream.IP.TTP.association_info.commentUnknownThe comment in the association info of the TTP.
ThreatStream.IP.TTP.association_info.createdDateThe date the association info was created.
ThreatStream.IP.TTP.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.IP.TTP.can_add_public_tagsBooleanWhether you can add public tags to the TTP.
ThreatStream.IP.TTP.created_tsDateThe date the TTP was created.
ThreatStream.IP.TTP.feed_idNumberThe feed ID of the TTP.
ThreatStream.IP.TTP.idNumberThe ID of the TTP.
ThreatStream.IP.TTP.is_anonymousBooleanWhether the TTP was anonymous.
ThreatStream.IP.TTP.is_cloneableStringWhether the TTP was cloneable.
ThreatStream.IP.TTP.is_publicBooleanWhether the TTP is public.
ThreatStream.IP.TTP.is_teamBooleanWhether the TTP is a team.
ThreatStream.IP.TTP.modified_tsDateThe date the TTP was modified.
ThreatStream.IP.TTP.nameStringThe name of the TTP.
ThreatStream.IP.TTP.organization_idNumberThe organization ID of the TTP.
ThreatStream.IP.TTP.owner_user_idNumberThe owner user ID of the TTP.
ThreatStream.IP.TTP.primary_motivationUnknownThe primary motivation of the TTP.
ThreatStream.IP.TTP.publication_statusStringThe publication status of the TTP.
ThreatStream.IP.TTP.published_tsDateThe date the TTP was published.
ThreatStream.IP.TTP.resource_levelUnknownThe resource level of the TTP.
ThreatStream.IP.TTP.resource_uriStringThe resource URI of the TTP.
ThreatStream.IP.TTP.source_createdUnknownThe date the source was created.
ThreatStream.IP.TTP.source_modifiedUnknownThe date the source was modified.
ThreatStream.IP.TTP.start_dateUnknownThe start date.
ThreatStream.IP.TTP.tagsStringThe tags of the threat indicator.
ThreatStream.IP.TTP.tags_v2.idStringThe ID of the tag.
ThreatStream.IP.TTP.tags_v2.nameStringThe name of the tag.
ThreatStream.IP.TTP.tlpStringThe TLP of the TTP.
ThreatStream.IP.TTP.uuidStringThe UUID of the TTP.
ThreatStream.IP.Vulnerability.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.IP.Vulnerability.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.IP.Vulnerability.association_info.createdDateThe date the association info was created.
ThreatStream.IP.Vulnerability.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.IP.Vulnerability.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.IP.Vulnerability.circles.idStringThe ID of the circle.
ThreatStream.IP.Vulnerability.circles.nameStringThe name of the circle.
ThreatStream.IP.Vulnerability.circles.resource_uriStringThe resource URI of the circle.
ThreatStream.IP.Vulnerability.created_tsDateThe date the vulnerability was created.
ThreatStream.IP.Vulnerability.feed_idNumberThe feed ID of the vulnerability.
ThreatStream.IP.Vulnerability.idNumberThe ID of the vulnerability.
ThreatStream.IP.Vulnerability.is_anonymousBooleanWhether the vulnerability is anonymous.
ThreatStream.IP.Vulnerability.is_cloneableStringWhether the vulnerability is cloneable.
ThreatStream.IP.Vulnerability.is_publicBooleanWhether the vulnerability is public.
ThreatStream.IP.Vulnerability.is_systemBooleanWhether the vulnerability is in the system.
ThreatStream.IP.Vulnerability.modified_tsDateThe date the vulnerability was modified.
ThreatStream.IP.Vulnerability.nameStringThe name of the vulnerability.
ThreatStream.IP.Vulnerability.organization_idNumberThe organization ID of the vulnerability.
ThreatStream.IP.Vulnerability.owner_user_idUnknownThe owner user ID of the vulnerability.
ThreatStream.IP.Vulnerability.publication_statusStringThe publication status of the vulnerability.
ThreatStream.IP.Vulnerability.published_tsDateThe date the vulnerability was published.
ThreatStream.IP.Vulnerability.resource_uriStringThe resource URI of the vulnerability.
ThreatStream.IP.Vulnerability.sourceStringThe source of the vulnerability.
ThreatStream.IP.Vulnerability.source_createdUnknownThe feed ID of the vulnerability.
ThreatStream.IP.Vulnerability.source_modifiedUnknownWhether the source was modified.
ThreatStream.IP.Vulnerability.tagsStringThe tags of the vulnerability.
ThreatStream.IP.Vulnerability.tags_v2.idStringThe ID of the tag.
ThreatStream.IP.Vulnerability.tags_v2.nameStringThe name of the tag.
ThreatStream.IP.Vulnerability.tlpStringThe TLP of the vulnerability.
ThreatStream.IP.Vulnerability.update_idNumberThe update ID of the vulnerability.
ThreatStream.IP.Vulnerability.uuidStringThe UUID of the vulnerability.
ThreatStream.IP.Campaign.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.IP.Campaign.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.IP.Campaign.association_info.createdDateThe date the association info was created.
ThreatStream.IP.Campaign.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.IP.Campaign.can_add_public_tagsBooleanWhether you can add public tags to the campaign.
ThreatStream.IP.Campaign.created_tsDateThe date the campaign was created.
ThreatStream.IP.Campaign.end_dateUnknownThe end date of the campaign.
ThreatStream.IP.Campaign.feed_idNumberThe feed ID of the campaign.
ThreatStream.IP.Campaign.idNumberThe ID of the campaign.
ThreatStream.IP.Campaign.is_anonymousBooleanWhether the campaign is anonymous.
ThreatStream.IP.Campaign.is_cloneableStringWhether the campaign is cloneable.
ThreatStream.IP.Campaign.is_publicBooleanWhether the campaign is public.
ThreatStream.IP.Campaign.modified_tsDateThe date the campaign was modified.
ThreatStream.IP.Campaign.nameStringThe name of the campaign.
ThreatStream.IP.Campaign.objectiveUnknownThe objective of the campaign.
ThreatStream.IP.Campaign.organization_idNumberThe organization ID of the campaign.
ThreatStream.IP.Campaign.owner_user_idNumberThe owner user ID of the campaign.
ThreatStream.IP.Campaign.publication_statusStringThe publication status of the campaign.
ThreatStream.IP.Campaign.published_tsUnknownThe date the campaign was published.
ThreatStream.IP.Campaign.resource_uriStringThe resource URI of the campaign.
ThreatStream.IP.Campaign.source_createdDateThe date the campaign was created.
ThreatStream.IP.Campaign.source_modifiedDateWhether the source was modified.
ThreatStream.IP.Campaign.start_dateUnknownThe start date of the campaign.
ThreatStream.IP.Campaign.status.display_nameStringThe display name of the status.
ThreatStream.IP.Campaign.status.idNumberThe ID of the status of the campaign.
ThreatStream.IP.Campaign.status.resource_uriStringThe resource URI of the status of the campaign.
ThreatStream.IP.Campaign.tlpStringThe TLP of the campaign.
ThreatStream.IP.Campaign.uuidStringThe UUID of the campaign.

Command example#

!ip ip=23.98.23.98 threat_model_association=True

Context Example#

{
"DBotScore": {
"Indicator": "23.98.23.98",
"Reliability": "B - Usually reliable",
"Score": 3,
"Type": "ip",
"Vendor": "Anomali ThreatStream v3 May"
},
"IP": {
"Address": "23.98.23.98",
"Malicious": {
"Description": null,
"Vendor": "Anomali ThreatStream v3 May"
},
"Relationships": [
{
"EntityA": "23.98.23.98",
"EntityAType": "IP",
"EntityB": "Test Investigation",
"EntityBType": "Campaign",
"Relationship": "related-to"
}
],
"Tags": [
"apt",
"PANW_Test"
],
"ThreatTypes": [
{
"threatcategory": "apt",
"threatcategoryconfidence": null
}
]
},
"ThreatStream": {
"IP": {
"ASN": "",
"Actor": [],
"Address": "23.98.23.98",
"Campaign": [
{
"assignee_user": {
"email": "darbel@paloaltonetworks.com",
"id": "202",
"name": "",
"resource_uri": "/api/v1/user/202/"
},
"association_info": [
{
"comment": null,
"created": "2022-08-01T09:52:10.246877",
"from_id": 239450621,
"sro": {}
}
],
"can_add_public_tags": true,
"circles": [],
"created_ts": "2022-08-01T09:52:10.252091",
"end_date": null,
"feed_id": 0,
"id": 372437,
"intelligence_initiatives": [],
"is_anonymous": false,
"is_cloneable": "yes",
"is_public": false,
"modified_ts": "2022-08-01T09:52:10.246877",
"name": "Test Investigation",
"objective": null,
"organization_id": 88,
"owner_user_id": 202,
"publication_status": "new",
"published_ts": null,
"resource_uri": "/api/v1/campaign/372437/",
"source_created": null,
"source_modified": null,
"start_date": null,
"status": {
"display_name": "Ongoing",
"id": 1,
"resource_uri": "/api/v1/campaignstatus/1/"
},
"tags": [],
"tags_v2": [],
"tlp": "white",
"uuid": "9b7872f1-beb7-42d7-a500-d37df74af644",
"workgroups": []
}
],
"Confidence": 100,
"Country": null,
"IType": "apt_ip",
"Modified": "2022-08-01T09:46:41.715Z",
"Organization": "",
"Severity": "very-high",
"Signature": [],
"Source": "Analyst",
"Status": "active",
"TTP": [],
"Tags": [
"apt",
"PANW_Test"
],
"ThreatBulletin": [],
"Type": "ip",
"Vulnerability": []
}
}
}

Human Readable Output#

IP reputation for: 23.98.23.98#

ASNAddressConfidenceCountryITypeModifiedOrganizationSeveritySourceStatusTagsType
23.98.23.98100apt_ip2022-08-01T09:46:41.715Zvery-highAnalystactiveapt, PANW_Testip

Actor details:#

No entries.

Signature details:#

No entries.

ThreatBulletin details:#

No entries.

TTP details:#

No entries.

Vulnerability details:#

No entries.

Campaign details:#

nameid
Test Investigation372437

domain#


Checks the reputation of the given domain name.

Base Command#

domain

Input#

Argument NameDescriptionRequired
domainThe domain name to check.Required
thresholdIf confidence is greater than the threshold the domain is considered malicious, otherwise it is considered good. This argument overrides the default domain threshold defined as a parameter.Optional
include_inactiveWhether to include results with an inactive status. Possible values are: True, False.Optional
threat_model_associationEnhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.Optional

Context Output#

PathTypeDescription
Domain.NameStringThe domain name.
Domain.DNSStringThe IP addresses resolved by the DNS.
Domain.WHOIS.CreationDateDateThe date the domain was created. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
Domain.WHOIS.UpdatedDateDateThe date the domain was last updated. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
Domain.WHOIS.Registrant.NameStringThe registrant name.
Domain.WHOIS.Registrant.EmailStringThe registrant email address.
Domain.WHOIS.Registrant.PhoneStringThe registrant phone number.
ThreatStream.Domain.ASNStringThe Autonomous System (AS) number associated with the indicator.
ThreatStream.Domain.AddressStringThe indicator domain name.
ThreatStream.Domain.CountryStringThe country associated with the indicator.
ThreatStream.Domain.TypeStringThe indicator type.
ThreatStream.Domain.ModifiedStringThe date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.Domain.SeverityStringThe indicator severity ("very-high", "high", "medium", "low").
ThreatStream.Domain.ConfidenceStringThe observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.Domain.StatusStringThe status assigned to the indicator.
ThreatStream.Domain.OrganizationStringThe name of the business that owns the IP address associated with the indicator.
ThreatStream.Domain.SourceStringThe indicator source.
Domain.Malicious.VendorStringThe vendor that reported the indicator as malicious.
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
ThreatStream.Domain.TagsUnknownTags assigned to the domain.
ThreatStream.Domain.ITypeStringThe itype of the indicator associated with the specified model.
Domain.TagsUnknownList of domain tags.
Domain.ThreatTypesUnknownThreat types associated with the domain.
ThreatStream.Domain.Actor.assignee_userUnknownThe assignee user of the threat actor.
ThreatStream.Domain.Actor.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.Domain.Actor.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.Actor.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.Domain.Actor.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.Domain.Actor.created_tsDateThe date the threat actor was created.
ThreatStream.Domain.Actor.feed_idNumberThe feed ID of the threat actor.
ThreatStream.Domain.Actor.idNumberThe ID of the threat actor.
ThreatStream.Domain.Actor.is_anonymousBooleanWhether the threat actor is anonymous.
ThreatStream.Domain.Actor.is_cloneableStringWhether the threat actor is cloneable.
ThreatStream.Domain.Actor.is_publicBooleanWhether the threat actor is public.
ThreatStream.Domain.Actor.is_teamBooleanWhether the threat actor is a team.
ThreatStream.Domain.Actor.modified_tsDateThe date the threat actor was modified.
ThreatStream.Domain.Actor.nameStringThe name of the threat actor.
ThreatStream.Domain.Actor.organization_idNumberThe organization ID of the threat actor.
ThreatStream.Domain.Actor.owner_user_idNumberThe owner user ID of the threat actor.
ThreatStream.Domain.Actor.primary_motivationUnknownThe primary motivation of the threat actor.
ThreatStream.Domain.Actor.publication_statusStringThe publication status of the threat actor.
ThreatStream.Domain.Actor.published_tsDateThe date the threat actor was published.
ThreatStream.Domain.Actor.resource_levelUnknownThe resource level of the threat actor.
ThreatStream.Domain.Actor.resource_uriStringThe resource URI of the threat actor.
ThreatStream.Domain.Actor.source_createdUnknownThe date the source was created.
ThreatStream.Domain.Actor.source_modifiedUnknownThe date the source was modified.
ThreatStream.Domain.Actor.start_dateUnknownThe start date.
ThreatStream.Domain.Actor.tagsStringThe tags of the threat indicator.
ThreatStream.Domain.Actor.tags_v2.idStringThe ID of the tag.
ThreatStream.Domain.Actor.tags_v2.nameStringThe name of the tag.
ThreatStream.Domain.Actor.tlpStringThe TLP of the threat actor.
ThreatStream.Domain.Actor.uuidStringThe UUID of the threat actor.
ThreatStream.Domain.Signature.assignee_userUnknownThe assignee user of the signature.
ThreatStream.Domain.Signature.association_info.commentUnknownThe comment in the association info of the signature.
ThreatStream.Domain.Signature.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.Signature.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.Domain.Signature.can_add_public_tagsBooleanWhether you can add public tags to the signature.
ThreatStream.Domain.Signature.created_tsDateThe date the signature was created.
ThreatStream.Domain.Signature.feed_idNumberThe feed ID of the signature.
ThreatStream.Domain.Signature.idNumberThe ID of the signature.
ThreatStream.Domain.Signature.is_anonymousBooleanWhether the signature is anonymous.
ThreatStream.Domain.Signature.is_cloneableStringWhether the signature is cloneable.
ThreatStream.Domain.Signature.is_publicBooleanWhether the signature is public.
ThreatStream.Domain.Signature.is_teamBooleanWhether the signature is a team signature.
ThreatStream.Domain.Signature.modified_tsDateThe date the signature was modified.
ThreatStream.Domain.Signature.nameStringThe name of the signature.
ThreatStream.Domain.Signature.organization_idNumberThe organization ID of the signature.
ThreatStream.Domain.Signature.owner_user_idNumberThe owner user ID of the signature.
ThreatStream.Domain.Signature.primary_motivationUnknownThe primary motivation of the signature.
ThreatStream.Domain.Signature.publication_statusStringThe publication status of the signature.
ThreatStream.Domain.Signature.published_tsDateThe date the signature was published.
ThreatStream.Domain.Signature.resource_levelUnknownThe resource level of the signature.
ThreatStream.Domain.Signature.resource_uriStringThe resource URI of the signature.
ThreatStream.Domain.Signature.source_createdUnknownThe date the source was created.
ThreatStream.Domain.Signature.source_modifiedUnknownThe date the source was modified.
ThreatStream.Domain.Signature.start_dateUnknownThe start date.
ThreatStream.Domain.Signature.tagsStringThe tags of the threat indicator.
ThreatStream.Domain.Signature.tags_v2.idStringThe ID of the tag.
ThreatStream.Domain.Signature.tags_v2.nameStringThe name of the tag.
ThreatStream.Domain.Signature.tlpStringThe TLP of the signature.
ThreatStream.Domain.Signature.uuidStringThe UUID of the signature.
ThreatStream.Domain.ThreatBulletin.all_circles_visibleBooleanWhether all of the circles are visible.
ThreatStream.Domain.ThreatBulletin.assignee_orgStringThe assignee organization.
ThreatStream.Domain.ThreatBulletin.assignee_org_idStringThe assignee organization ID.
ThreatStream.Domain.ThreatBulletin.assignee_org_nameStringThe assignee organization name.
ThreatStream.Domain.ThreatBulletin.assignee_userStringThe assignee user.
ThreatStream.Domain.ThreatBulletin.assignee_user_idStringThe assignee user ID.
ThreatStream.Domain.ThreatBulletin.assignee_user_nameUnknownThe assignee user name.
ThreatStream.Domain.ThreatBulletin.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.Domain.ThreatBulletin.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.ThreatBulletin.association_info.from_idStringThe ID from which the association info is related.
ThreatStream.Domain.ThreatBulletin.body_content_typeStringThe body content type.
ThreatStream.Domain.ThreatBulletin.campaignUnknownThe campaign of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.can_add_public_tagsBooleanWhether you can add public tags.
ThreatStream.Domain.ThreatBulletin.created_tsDateThe date the threat bulletin was created.
ThreatStream.Domain.ThreatBulletin.feed_idNumberThe feed ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.idStringThe ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.is_anonymousBooleanWhether the threat bulletin is anonymous.
ThreatStream.Domain.ThreatBulletin.is_cloneableStringWhether the threat bulletin is cloneable.
ThreatStream.Domain.ThreatBulletin.is_editableBooleanWhether the threat bulletin is editable.
ThreatStream.Domain.ThreatBulletin.is_emailBooleanWhether the threat bulletin is an email.
ThreatStream.Domain.ThreatBulletin.is_publicBooleanWhether the threat bulletin is public.
ThreatStream.Domain.ThreatBulletin.modified_tsDateThe date the threat bulletin was modified.
ThreatStream.Domain.ThreatBulletin.nameStringThe name of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.original_sourceStringThe original source of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.original_source_idUnknownThe original source ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.owner_org.idStringThe owner organization ID.
ThreatStream.Domain.ThreatBulletin.owner_org.nameStringThe owner organization name.
ThreatStream.Domain.ThreatBulletin.owner_org.resource_uriStringThe owner organization URI.
ThreatStream.Domain.ThreatBulletin.owner_org_idNumberThe ID of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_org_nameStringThe name of the owner organization.
ThreatStream.Domain.ThreatBulletin.owner_user.avatar_s3_urlUnknownThe URL of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.can_share_intelligenceBooleanWhether you can share intelligence.
ThreatStream.Domain.ThreatBulletin.owner_user.emailStringThe email of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.idStringThe ID of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.is_activeBooleanWhether the owner user is active.
ThreatStream.Domain.ThreatBulletin.owner_user.is_readonlyBooleanWhether the owner user has read-only permission.
ThreatStream.Domain.ThreatBulletin.owner_user.must_change_passwordBooleanWhether the owner user must change the password.
ThreatStream.Domain.ThreatBulletin.owner_user.nameStringThe owner user name.
ThreatStream.Domain.ThreatBulletin.owner_user.nicknameStringThe owner user nickname.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.idStringThe ID of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.nameStringThe name of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.resource_uriStringThe resource URI of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.resource_uriStringThe resource URI of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user_idNumberThe owner user ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.owner_user_nameStringThe owner user name of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.parentUnknownThe parent of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.published_tsUnknownThe date the threat bulletin was published.
ThreatStream.Domain.ThreatBulletin.resource_uriStringThe resource URI of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.sourceUnknownThe source of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.source_createdUnknownThe date the source was created.
ThreatStream.Domain.ThreatBulletin.source_modifiedUnknownThe date the source was modified.
ThreatStream.Domain.ThreatBulletin.starred_by_meBooleanWhether the threat bulletin was started by me.
ThreatStream.Domain.ThreatBulletin.starred_total_countNumberThe total number of times the threat bulletin was starred.
ThreatStream.Domain.ThreatBulletin.statusStringThe status of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.threat_actorUnknownThe threat actor of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.tlpUnknownThe TLP of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.ttpUnknownThe TTP of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.uuidStringThe UUID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.votes.meUnknownThe number of votes by me.
ThreatStream.Domain.ThreatBulletin.votes.totalNumberThe number of total votes.
ThreatStream.Domain.ThreatBulletin.watched_by_meBooleanWhether the threat bulletin was watched by me.
ThreatStream.Domain.ThreatBulletin.watched_total_countNumberThe total number of watchers.
ThreatStream.Domain.TTP.assignee_userUnknownThe assignee user of the TTP.
ThreatStream.Domain.TTP.association_info.commentUnknownThe comment in the association info of the TTP.
ThreatStream.Domain.TTP.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.TTP.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.Domain.TTP.can_add_public_tagsBooleanWhether you can add public tags to the TTP.
ThreatStream.Domain.TTP.created_tsDateThe date the TTP was created.
ThreatStream.Domain.TTP.feed_idNumberThe feed ID of the TTP.
ThreatStream.Domain.TTP.idNumberThe ID of the TTP.
ThreatStream.Domain.TTP.is_anonymousBooleanWhether the TTP was anonymous.
ThreatStream.Domain.TTP.is_cloneableStringWhether the TTP was cloneable.
ThreatStream.Domain.TTP.is_publicBooleanWhether the TTP is public.
ThreatStream.Domain.TTP.is_teamBooleanWhether the TTP is a team.
ThreatStream.Domain.TTP.modified_tsDateThe date the TTP was modified.
ThreatStream.Domain.TTP.nameStringThe name of the TTP.
ThreatStream.Domain.TTP.organization_idNumberThe organization ID of the TTP.
ThreatStream.Domain.TTP.owner_user_idNumberThe owner user ID of the TTP.
ThreatStream.Domain.TTP.primary_motivationUnknownThe primary motivation of the TTP.
ThreatStream.Domain.TTP.publication_statusStringThe publication status of the TTP.
ThreatStream.Domain.TTP.published_tsDateThe date the TTP was published.
ThreatStream.Domain.TTP.resource_levelUnknownThe resource level of the TTP.
ThreatStream.Domain.TTP.resource_uriStringThe resource URI of the TTP.
ThreatStream.Domain.TTP.source_createdUnknownThe date the source was created.
ThreatStream.Domain.TTP.source_modifiedUnknownThe date the source was modified.
ThreatStream.Domain.TTP.start_dateUnknownThe start date.
ThreatStream.Domain.TTP.tagsStringThe tags of the threat indicator.
ThreatStream.Domain.TTP.tags_v2.idStringThe ID of the tag.
ThreatStream.Domain.TTP.tags_v2.nameStringThe name of the tag.
ThreatStream.Domain.TTP.tlpStringThe TLP of the TTP.
ThreatStream.Domain.TTP.uuidStringThe UUID of the TTP.
ThreatStream.Domain.Vulnerability.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.Domain.Vulnerability.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.Domain.Vulnerability.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.Vulnerability.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.Domain.Vulnerability.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.Domain.Vulnerability.circles.idStringThe ID of the circle.
ThreatStream.Domain.Vulnerability.circles.nameStringThe name of the circle.
ThreatStream.Domain.Vulnerability.circles.resource_uriStringThe resource URI of the circle.
ThreatStream.Domain.Vulnerability.created_tsDateThe date the vulnerability was created.
ThreatStream.Domain.Vulnerability.feed_idNumberThe feed ID of the vulnerability.
ThreatStream.Domain.Vulnerability.idNumberThe ID of the vulnerability.
ThreatStream.Domain.Vulnerability.is_anonymousBooleanWhether the vulnerability is anonymous.
ThreatStream.Domain.Vulnerability.is_cloneableStringWhether the vulnerability is cloneable.
ThreatStream.Domain.Vulnerability.is_publicBooleanWhether the vulnerability is public.
ThreatStream.Domain.Vulnerability.is_systemBooleanWhether the vulnerability is in the system.
ThreatStream.Domain.Vulnerability.modified_tsDateThe date the vulnerability was modified.
ThreatStream.Domain.Vulnerability.nameStringThe name of the vulnerability.
ThreatStream.Domain.Vulnerability.organization_idNumberThe organization ID of the vulnerability.
ThreatStream.Domain.Vulnerability.owner_user_idUnknownThe owner user ID of the vulnerability.
ThreatStream.Domain.Vulnerability.publication_statusStringThe publication status of the vulnerability.
ThreatStream.Domain.Vulnerability.published_tsDateThe date the vulnerability was published.
ThreatStream.Domain.Vulnerability.resource_uriStringThe resource URI of the vulnerability.
ThreatStream.Domain.Vulnerability.sourceStringThe source of the vulnerability.
ThreatStream.Domain.Vulnerability.source_createdUnknownThe feed ID of the vulnerability.
ThreatStream.Domain.Vulnerability.source_modifiedUnknownWhether the source was modified.
ThreatStream.Domain.Vulnerability.tagsStringThe tags of the vulnerability.
ThreatStream.Domain.Vulnerability.tags_v2.idStringThe ID of the tag.
ThreatStream.Domain.Vulnerability.tags_v2.nameStringThe name of the tag.
ThreatStream.Domain.Vulnerability.tlpStringThe TLP of the vulnerability.
ThreatStream.Domain.Vulnerability.update_idNumberThe update ID of the vulnerability.
ThreatStream.Domain.Vulnerability.uuidStringThe UUID of the vulnerability.
ThreatStream.Domain.Campaign.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.Domain.Campaign.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.Domain.Campaign.association_info.createdDateThe date the association info was created.
ThreatStream.Domain.Campaign.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.Domain.Campaign.can_add_public_tagsBooleanWhether you can add public tags to the campaign.
ThreatStream.Domain.Campaign.created_tsDateThe date the campaign was created.
ThreatStream.Domain.Campaign.end_dateUnknownThe end date of the campaign.
ThreatStream.Domain.Campaign.feed_idNumberThe feed ID of the campaign.
ThreatStream.Domain.Campaign.idNumberThe ID of the campaign.
ThreatStream.Domain.Campaign.is_anonymousBooleanWhether the campaign is anonymous.
ThreatStream.Domain.Campaign.is_cloneableStringWhether the campaign is cloneable.
ThreatStream.Domain.Campaign.is_publicBooleanWhether the campaign is public.
ThreatStream.Domain.Campaign.modified_tsDateThe date the campaign was modified.
ThreatStream.Domain.Campaign.nameStringThe name of the campaign.
ThreatStream.Domain.Campaign.objectiveUnknownThe objective of the campaign.
ThreatStream.Domain.Campaign.organization_idNumberThe organization ID of the campaign.
ThreatStream.Domain.Campaign.owner_user_idNumberThe owner user ID of the campaign.
ThreatStream.Domain.Campaign.publication_statusStringThe publication status of the campaign.
ThreatStream.Domain.Campaign.published_tsUnknownThe date the campaign was published.
ThreatStream.Domain.Campaign.resource_uriStringThe resource URI of the campaign.
ThreatStream.Domain.Campaign.source_createdDateThe date the campaign was created.
ThreatStream.Domain.Campaign.source_modifiedDateWhether the source was modified.
ThreatStream.Domain.Campaign.start_dateUnknownThe start date of the campaign.
ThreatStream.Domain.Campaign.status.display_nameStringThe display name of the status.
ThreatStream.Domain.Campaign.status.idNumberThe ID of the status of the campaign.
ThreatStream.Domain.Campaign.status.resource_uriStringThe resource URI of the status of the campaign.
ThreatStream.Domain.Campaign.tlpStringThe TLP of the campaign.
ThreatStream.Domain.Campaign.uuidStringThe UUID of the campaign.

Command example#

!domain domain=y.gp threat_model_association=True

Context Example#

{
"DBotScore": {
"Indicator": "y.gp",
"Reliability": "B - Usually reliable",
"Score": 2,
"Type": "domain",
"Vendor": "Anomali ThreatStream v3 May"
},
"Domain": {
"CreationDate": "2021-03-31T10:17:13.553Z",
"DNS": "1.1.1.1",
"Geo": {
"Country": "DE",
"Location": "51.2993,9.491"
},
"Name": "y.gp",
"Organization": "Hetzner Online GmbH",
"Relationships": [
{
"EntityA": "y.gp",
"EntityAType": "Domain",
"EntityB": "1.1.1.1",
"EntityBType": "IP",
"Relationship": "resolved-from"
}
],
"Tags": [
"malware"
],
"ThreatTypes": [
{
"threatcategory": "malware",
"threatcategoryconfidence": null
}
],
"TrafficLightProtocol": "amber",
"UpdatedDate": "2021-03-31T10:17:56.207Z",
"WHOIS": {
"CreationDate": "2021-03-31T10:17:13.553Z",
"UpdatedDate": "2021-03-31T10:17:56.207Z"
}
},
"ThreatStream": {
"Domain": {
"ASN": "24940",
"Actor": [],
"Address": "y.gp",
"Campaign": [],
"Confidence": 50,
"Country": "DE",
"IType": "mal_domain",
"Modified": "2021-03-31T10:17:56.207Z",
"Organization": "Hetzner Online GmbH",
"Severity": "very-high",
"Signature": [],
"Source": "Analyst",
"Status": "active",
"TTP": [],
"Tags": [
"malware"
],
"ThreatBulletin": [],
"Type": "domain",
"Vulnerability": []
}
}
}

Human Readable Output#

Domain reputation for: y.gp#

ASNAddressConfidenceCountryITypeModifiedOrganizationSeveritySourceStatusTagsType
24940y.gp50DEmal_domain2021-03-31T10:17:56.207ZHetzner Online GmbHvery-highAnalystactivemalwaredomain

Actor details:#

No entries.

Signature details:#

No entries.

ThreatBulletin details:#

No entries.

TTP details:#

No entries.

Vulnerability details:#

No entries.

Campaign details:#

No entries.

file#


Checks the reputation of the given hash of the file.

Base Command#

file

Input#

Argument NameDescriptionRequired
fileThe hash of file to check.Required
thresholdIf the confidence is greater than the threshold the hash of the file is considered malicious, otherwise it is considered good. This argument overrides the default file threshold defined as a parameter.Optional
include_inactiveWhether to include results with an inactive status. Possible values are: True, False.Optional
threat_model_associationEnhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.Optional

Context Output#

PathTypeDescription
File.MD5StringThe MD5 hash of the file.
File.SHA1StringThe SHA1 hash of the file.
File.SHA256StringThe SHA256 hash of the file.
File.SHA512StringThe SHA512 hash of the file.
File.Malicious.VendorStringThe vendor that reported the indicator as malicious.
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
ThreatStream.File.SeverityStringThe indicator severity ("very-high", "high", "medium", "low").
ThreatStream.File.ConfidenceStringThe observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.File.StatusStringThe status assigned to the indicator.
ThreatStream.File.TypeStringThe indicator type.
ThreatStream.File.MD5StringThe MD5 hash of the indicator.
ThreatStream.File.SHA1StringThe SHA1 hash of the indicator.
ThreatStream.File.SHA256StringThe SHA256 hash of the indicator.
ThreatStream.File.SHA512StringThe SHA512 hash of the indicator.
ThreatStream.File.ModifiedStringThe date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.File.SourceStringThe indicator source.
ThreatStream.File.TagsUnknownTags assigned to the file.
ThreatStream.File.ITypeStringThe itype of the indicator associated with the specified model.
File.TagsUnknownList of file tags.
File.ThreatTypesUnknownThreat types associated with the file.
ThreatStream.File.Actor.assignee_userUnknownThe assignee user of the threat actor.
ThreatStream.File.Actor.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.File.Actor.association_info.createdDateThe date the association info was created.
ThreatStream.File.Actor.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.File.Actor.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.File.Actor.created_tsDateThe date the threat actor was created.
ThreatStream.File.Actor.feed_idNumberThe feed ID of the threat actor.
ThreatStream.File.Actor.idNumberThe ID of the threat actor.
ThreatStream.File.Actor.is_anonymousBooleanWhether the threat actor is anonymous.
ThreatStream.File.Actor.is_cloneableStringWhether the threat actor is cloneable.
ThreatStream.File.Actor.is_publicBooleanWhether the threat actor is public.
ThreatStream.File.Actor.is_teamBooleanWhether the threat actor is a team.
ThreatStream.File.Actor.modified_tsDateThe date the threat actor was modified.
ThreatStream.File.Actor.nameStringThe name of the threat actor.
ThreatStream.File.Actor.organization_idNumberThe organization ID of the threat actor.
ThreatStream.File.Actor.owner_user_idNumberThe owner user ID of the threat actor.
ThreatStream.File.Actor.primary_motivationUnknownThe primary motivation of the threat actor.
ThreatStream.File.Actor.publication_statusStringThe publication status of the threat actor.
ThreatStream.File.Actor.published_tsDateThe date the threat actor was published.
ThreatStream.File.Actor.resource_levelUnknownThe resource level of the threat actor.
ThreatStream.File.Actor.resource_uriStringThe resource URI of the threat actor.
ThreatStream.File.Actor.source_createdUnknownThe date the source was created.
ThreatStream.File.Actor.source_modifiedUnknownThe date the source was modified.
ThreatStream.File.Actor.start_dateUnknownThe start date.
ThreatStream.File.Actor.tagsStringThe tags of the threat indicator.
ThreatStream.File.Actor.tags_v2.idStringThe ID of the tag.
ThreatStream.File.Actor.tags_v2.nameStringThe name of the tag.
ThreatStream.File.Actor.tlpStringThe TLP of the threat actor.
ThreatStream.File.Actor.uuidStringThe UUID of the threat actor.
ThreatStream.File.Signature.assignee_userUnknownThe assignee user of the signature.
ThreatStream.File.Signature.association_info.commentUnknownThe comment in the association info of the signature.
ThreatStream.File.Signature.association_info.createdDateThe date the association info was created.
ThreatStream.File.Signature.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.File.Signature.can_add_public_tagsBooleanWhether you can add public tags to the signature.
ThreatStream.File.Signature.created_tsDateThe date the signature was created.
ThreatStream.File.Signature.feed_idNumberThe feed ID of the signature.
ThreatStream.File.Signature.idNumberThe ID of the signature.
ThreatStream.File.Signature.is_anonymousBooleanWhether the signature is anonymous.
ThreatStream.File.Signature.is_cloneableStringWhether the signature is cloneable.
ThreatStream.File.Signature.is_publicBooleanWhether the signature is public.
ThreatStream.File.Signature.is_teamBooleanWhether the signature is a team signature.
ThreatStream.File.Signature.modified_tsDateThe date the signature was modified.
ThreatStream.File.Signature.nameStringThe name of the signature.
ThreatStream.File.Signature.organization_idNumberThe organization ID of the signature.
ThreatStream.File.Signature.owner_user_idNumberThe owner user ID of the signature.
ThreatStream.File.Signature.primary_motivationUnknownThe primary motivation of the signature.
ThreatStream.File.Signature.publication_statusStringThe publication status of the signature.
ThreatStream.File.Signature.published_tsDateThe date the signature was published.
ThreatStream.File.Signature.resource_levelUnknownThe resource level of the signature.
ThreatStream.File.Signature.resource_uriStringThe resource URI of the signature.
ThreatStream.File.Signature.source_createdUnknownThe date the source was created.
ThreatStream.File.Signature.source_modifiedUnknownThe date the source was modified.
ThreatStream.File.Signature.start_dateUnknownThe start date.
ThreatStream.File.Signature.tagsStringThe tags of the threat indicator.
ThreatStream.File.Signature.tags_v2.idStringThe ID of the tag.
ThreatStream.File.Signature.tags_v2.nameStringThe name of the tag.
ThreatStream.File.Signature.tlpStringThe TLP of the signature.
ThreatStream.File.Signature.uuidStringThe UUID of the signature.
ThreatStream.File.ThreatBulletin.all_circles_visibleBooleanWhether all of the circles are visible.
ThreatStream.File.ThreatBulletin.assignee_orgStringThe assignee organization.
ThreatStream.File.ThreatBulletin.assignee_org_idStringThe assignee organization ID.
ThreatStream.File.ThreatBulletin.assignee_org_nameStringThe assignee organization name.
ThreatStream.File.ThreatBulletin.assignee_userStringThe assignee user.
ThreatStream.File.ThreatBulletin.assignee_user_idStringThe assignee user ID.
ThreatStream.File.ThreatBulletin.assignee_user_nameUnknownThe assignee user name.
ThreatStream.File.ThreatBulletin.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.File.ThreatBulletin.association_info.createdDateThe date the association info was created.
ThreatStream.File.ThreatBulletin.association_info.from_idStringThe ID from which the association info is related.
ThreatStream.File.ThreatBulletin.body_content_typeStringThe body content type.
ThreatStream.File.ThreatBulletin.campaignUnknownThe campaign of the threat bulletin.
ThreatStream.File.ThreatBulletin.can_add_public_tagsBooleanWhether you can add public tags.
ThreatStream.File.ThreatBulletin.created_tsDateThe date the threat bulletin was created.
ThreatStream.File.ThreatBulletin.feed_idNumberThe feed ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.idStringThe ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.is_anonymousBooleanWhether the threat bulletin is anonymous.
ThreatStream.File.ThreatBulletin.is_cloneableStringWhether the threat bulletin is cloneable.
ThreatStream.File.ThreatBulletin.is_editableBooleanWhether the threat bulletin is editable.
ThreatStream.File.ThreatBulletin.is_emailBooleanWhether the threat bulletin is an email.
ThreatStream.File.ThreatBulletin.is_publicBooleanWhether the threat bulletin is public.
ThreatStream.File.ThreatBulletin.modified_tsDateThe date the threat bulletin was modified.
ThreatStream.File.ThreatBulletin.nameStringThe name of the threat bulletin.
ThreatStream.File.ThreatBulletin.original_sourceStringThe original source of the threat bulletin.
ThreatStream.File.ThreatBulletin.original_source_idUnknownThe original source ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.owner_org.idStringThe owner organization ID.
ThreatStream.File.ThreatBulletin.owner_org.nameStringThe owner organization name.
ThreatStream.File.ThreatBulletin.owner_org.resource_uriStringThe owner organization URI.
ThreatStream.File.ThreatBulletin.owner_org_idNumberThe ID of the owner user.
ThreatStream.File.ThreatBulletin.owner_org_nameStringThe name of the owner organization.
ThreatStream.File.ThreatBulletin.owner_user.avatar_s3_urlUnknownThe URL of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.can_share_intelligenceBooleanWhether you can share intelligence.
ThreatStream.File.ThreatBulletin.owner_user.emailStringThe email of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.idStringThe ID of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.is_activeBooleanWhether the owner user is active.
ThreatStream.File.ThreatBulletin.owner_user.is_readonlyBooleanWhether the owner user has read-only permission.
ThreatStream.File.ThreatBulletin.owner_user.must_change_passwordBooleanWhether the owner user must change the password.
ThreatStream.File.ThreatBulletin.owner_user.nameStringThe owner user name.
ThreatStream.File.ThreatBulletin.owner_user.nicknameStringThe owner user nickname.
ThreatStream.File.ThreatBulletin.owner_user.organization.idStringThe ID of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.organization.nameStringThe name of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.organization.resource_uriStringThe resource URI of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.resource_uriStringThe resource URI of the owner user.
ThreatStream.File.ThreatBulletin.owner_user_idNumberThe owner user ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.owner_user_nameStringThe owner user name of the threat bulletin.
ThreatStream.File.ThreatBulletin.parentUnknownThe parent of the threat bulletin.
ThreatStream.File.ThreatBulletin.published_tsUnknownThe date the threat bulletin was published.
ThreatStream.File.ThreatBulletin.resource_uriStringThe resource URI of the threat bulletin.
ThreatStream.File.ThreatBulletin.sourceUnknownThe source of the threat bulletin.
ThreatStream.File.ThreatBulletin.source_createdUnknownThe date the source was created.
ThreatStream.File.ThreatBulletin.source_modifiedUnknownThe date the source was modified.
ThreatStream.File.ThreatBulletin.starred_by_meBooleanWhether the threat bulletin was started by me.
ThreatStream.File.ThreatBulletin.starred_total_countNumberThe total number of times the threat bulletin was starred.
ThreatStream.File.ThreatBulletin.statusStringThe status of the threat bulletin.
ThreatStream.File.ThreatBulletin.threat_actorUnknownThe threat actor of the threat bulletin.
ThreatStream.File.ThreatBulletin.tlpUnknownThe TLP of the threat bulletin.
ThreatStream.File.ThreatBulletin.ttpUnknownThe TTP of the threat bulletin.
ThreatStream.File.ThreatBulletin.uuidStringThe UUID of the threat bulletin.
ThreatStream.File.ThreatBulletin.votes.meUnknownThe number of votes by me.
ThreatStream.File.ThreatBulletin.votes.totalNumberThe number of total votes.
ThreatStream.File.ThreatBulletin.watched_by_meBooleanWhether the threat bulletin was watched by me.
ThreatStream.File.ThreatBulletin.watched_total_countNumberThe total number of watchers.
ThreatStream.File.TTP.assignee_userUnknownThe assignee user of the TTP.
ThreatStream.File.TTP.association_info.commentUnknownThe comment in the association info of the TTP.
ThreatStream.File.TTP.association_info.createdDateThe date the association info was created.
ThreatStream.File.TTP.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.File.TTP.can_add_public_tagsBooleanWhether you can add public tags to the TTP.
ThreatStream.File.TTP.created_tsDateThe date the TTP was created.
ThreatStream.File.TTP.feed_idNumberThe feed ID of the TTP.
ThreatStream.File.TTP.idNumberThe ID of the TTP.
ThreatStream.File.TTP.is_anonymousBooleanWhether the TTP was anonymous.
ThreatStream.File.TTP.is_cloneableStringWhether the TTP was cloneable.
ThreatStream.File.TTP.is_publicBooleanWhether the TTP is public.
ThreatStream.File.TTP.is_teamBooleanWhether the TTP is a team.
ThreatStream.File.TTP.modified_tsDateThe date the TTP was modified.
ThreatStream.File.TTP.nameStringThe name of the TTP.
ThreatStream.File.TTP.organization_idNumberThe organization ID of the TTP.
ThreatStream.File.TTP.owner_user_idNumberThe owner user ID of the TTP.
ThreatStream.File.TTP.primary_motivationUnknownThe primary motivation of the TTP.
ThreatStream.File.TTP.publication_statusStringThe publication status of the TTP.
ThreatStream.File.TTP.published_tsDateThe date the TTP was published.
ThreatStream.File.TTP.resource_levelUnknownThe resource level of the TTP.
ThreatStream.File.TTP.resource_uriStringThe resource URI of the TTP.
ThreatStream.File.TTP.source_createdUnknownThe date the source was created.
ThreatStream.File.TTP.source_modifiedUnknownThe date the source was modified.
ThreatStream.File.TTP.start_dateUnknownThe start date.
ThreatStream.File.TTP.tagsStringThe tags of the threat indicator.
ThreatStream.File.TTP.tags_v2.idStringThe ID of the tag.
ThreatStream.File.TTP.tags_v2.nameStringThe name of the tag.
ThreatStream.File.TTP.tlpStringThe TLP of the TTP.
ThreatStream.File.TTP.uuidStringThe UUID of the TTP.
ThreatStream.File.Vulnerability.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.File.Vulnerability.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.File.Vulnerability.association_info.createdDateThe date the association info was created.
ThreatStream.File.Vulnerability.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.File.Vulnerability.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.File.Vulnerability.circles.idStringThe ID of the circle.
ThreatStream.File.Vulnerability.circles.nameStringThe name of the circle.
ThreatStream.File.Vulnerability.circles.resource_uriStringThe resource URI of the circle.
ThreatStream.File.Vulnerability.created_tsDateThe date the vulnerability was created.
ThreatStream.File.Vulnerability.feed_idNumberThe feed ID of the vulnerability.
ThreatStream.File.Vulnerability.idNumberThe ID of the vulnerability.
ThreatStream.File.Vulnerability.is_anonymousBooleanWhether the vulnerability is anonymous.
ThreatStream.File.Vulnerability.is_cloneableStringWhether the vulnerability is cloneable.
ThreatStream.File.Vulnerability.is_publicBooleanWhether the vulnerability is public.
ThreatStream.File.Vulnerability.is_systemBooleanWhether the vulnerability is in the system.
ThreatStream.File.Vulnerability.modified_tsDateThe date the vulnerability was modified.
ThreatStream.File.Vulnerability.nameStringThe name of the vulnerability.
ThreatStream.File.Vulnerability.organization_idNumberThe organization ID of the vulnerability.
ThreatStream.File.Vulnerability.owner_user_idUnknownThe owner user ID of the vulnerability.
ThreatStream.File.Vulnerability.publication_statusStringThe publication status of the vulnerability.
ThreatStream.File.Vulnerability.published_tsDateThe date the vulnerability was published.
ThreatStream.File.Vulnerability.resource_uriStringThe resource URI of the vulnerability.
ThreatStream.File.Vulnerability.sourceStringThe source of the vulnerability.
ThreatStream.File.Vulnerability.source_createdUnknownThe feed ID of the vulnerability.
ThreatStream.File.Vulnerability.source_modifiedUnknownWhether the source was modified.
ThreatStream.File.Vulnerability.tagsStringThe tags of the vulnerability.
ThreatStream.File.Vulnerability.tags_v2.idStringThe ID of the tag.
ThreatStream.File.Vulnerability.tags_v2.nameStringThe name of the tag.
ThreatStream.File.Vulnerability.tlpStringThe TLP of the vulnerability.
ThreatStream.File.Vulnerability.update_idNumberThe update ID of the vulnerability.
ThreatStream.File.Vulnerability.uuidStringThe UUID of the vulnerability.
ThreatStream.File.Campaign.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.File.Campaign.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.File.Campaign.association_info.createdDateThe date the association info was created.
ThreatStream.File.Campaign.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.File.Campaign.can_add_public_tagsBooleanWhether you can add public tags to the campaign.
ThreatStream.File.Campaign.created_tsDateThe date the campaign was created.
ThreatStream.File.Campaign.end_dateUnknownThe end date of the campaign.
ThreatStream.File.Campaign.feed_idNumberThe feed ID of the campaign.
ThreatStream.File.Campaign.idNumberThe ID of the campaign.
ThreatStream.File.Campaign.is_anonymousBooleanWhether the campaign is anonymous.
ThreatStream.File.Campaign.is_cloneableStringWhether the campaign is cloneable.
ThreatStream.File.Campaign.is_publicBooleanWhether the campaign is public.
ThreatStream.File.Campaign.modified_tsDateThe date the campaign was modified.
ThreatStream.File.Campaign.nameStringThe name of the campaign.
ThreatStream.File.Campaign.objectiveUnknownThe objective of the campaign.
ThreatStream.File.Campaign.organization_idNumberThe organization ID of the campaign.
ThreatStream.File.Campaign.owner_user_idNumberThe owner user ID of the campaign.
ThreatStream.File.Campaign.publication_statusStringThe publication status of the campaign.
ThreatStream.File.Campaign.published_tsUnknownThe date the campaign was published.
ThreatStream.File.Campaign.resource_uriStringThe resource URI of the campaign.
ThreatStream.File.Campaign.source_createdDateThe date the campaign was created.
ThreatStream.File.Campaign.source_modifiedDateWhether the source was modified.
ThreatStream.File.Campaign.start_dateUnknownThe start date of the campaign.
ThreatStream.File.Campaign.status.display_nameStringThe display name of the status.
ThreatStream.File.Campaign.status.idNumberThe ID of the status of the campaign.
ThreatStream.File.Campaign.status.resource_uriStringThe resource URI of the status of the campaign.
ThreatStream.File.Campaign.tlpStringThe TLP of the campaign.
ThreatStream.File.Campaign.uuidStringThe UUID of the campaign.

Command example#

!file file=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f threat_model_association=True

Context Example#

{
"DBotScore": {
"Indicator": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
"Reliability": "B - Usually reliable",
"Score": 2,
"Type": "file",
"Vendor": "Anomali ThreatStream v3 May"
},
"File": {
"Hashes": [
{
"type": "SHA256",
"value": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
}
],
"Relationships": [
{
"EntityA": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
"EntityAType": "File",
"EntityB": "Alert report",
"EntityBType": "Threat Actor",
"Relationship": "related-to"
}
],
"SHA256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
"Tags": [
"apt"
],
"ThreatTypes": [
{
"threatcategory": "apt",
"threatcategoryconfidence": null
}
],
"TrafficLightProtocol": "red"
},
"ThreatStream": {
"File": {
"Actor": [
{
"aliases": [],
"assignee_user": null,
"association_info": [
{
"comment": null,
"created": "2022-07-11T16:26:11.530823",
"from_id": 366645476,
"sro": {}
}
],
"can_add_public_tags": true,
"circles": [],
"created_ts": "2022-04-25T03:06:21.595651",
"feed_id": 269,
"id": 47096,
"intelligence_initiatives": [],
"is_anonymous": false,
"is_cloneable": "yes",
"is_public": true,
"is_team": false,
"modified_ts": "2022-07-11T16:30:00.437522",
"name": "Alert report",
"organization_id": 17,
"owner_user_id": 327,
"primary_motivation": null,
"publication_status": "published",
"published_ts": "2022-04-25T03:06:21.481665",
"resource_level": null,
"resource_uri": "/api/v1/actor/47096/",
"source_created": null,
"source_modified": null,
"start_date": null,
"tags": [
"packetstorm",
"microsoft"
],
"tags_v2": [
{
"id": "gvp",
"name": "microsoft"
},
{
"id": "wli",
"name": "packetstorm"
}
],
"tlp": "red",
"uuid": "0db81103-6728-4051-9fe0-4022ae24cc24",
"workgroups": []
}
],
"Campaign": [],
"Confidence": 50,
"IType": "apt_md5",
"Modified": "2022-07-11T16:30:00.359Z",
"SHA256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
"Severity": "very-high",
"Signature": [
{
"assignee_user": null,
"association_info": [
{
"comment": null,
"created": "2022-07-11T16:27:15.271832",
"from_id": 366645476,
"sro": {}
}
],
"can_add_public_tags": true,
"circles": [],
"created_ts": "2020-07-31T20:56:33.459260",
"feed_id": 155,
"id": 631,
"intelligence_initiatives": [],
"is_anonymous": false,
"is_cloneable": "yes",
"is_public": true,
"modified_ts": "2022-08-02T06:20:19.772588",
"name": "Feeds SDK 2.0: Signature Carbon Black Query test 1",
"organization_id": 39,
"owner_user_id": 64,
"publication_status": "published",
"published_ts": "2020-07-31T20:56:33.295192",
"resource_uri": "/api/v1/signature/631/",
"s_type": "Carbon Black Query",
"source_created": null,
"source_modified": null,
"tags": [
"actor_tag1"
],
"tags_v2": [
{
"id": "igh",
"name": "actor_tag1"
}
],
"tlp": "white",
"uuid": "4c0d74d9-6bd5-45c0-a288-5bc1d714eee8",
"workgroups": []
}
],
"Source": "tmalache@paloaltonetworks.com",
"Status": "active",
"TTP": [
{
"assignee_user": null,
"association_info": [
{
"comment": null,
"created": "2022-07-11T16:27:43.327492",
"from_id": 366645476,
"sro": {}
}
],
"can_add_public_tags": true,
"children": [],
"circles": [],
"created_ts": "2019-02-19T20:48:37.938265",
"feed_id": 3,
"id": 1500,
"intelligence_initiatives": [],
"is_anonymous": false,
"is_category": false,
"is_cloneable": "yes",
"is_mitre": false,
"is_public": true,
"modified_ts": "2022-08-02T06:17:07.420212",
"name": "FleaHopper TTP",
"organization_id": 4,
"owner_user_id": 7,
"publication_status": "published",
"published_ts": "2019-02-19T20:48:37.665110",
"resource_uri": "/api/v1/ttp/1500/",
"source_created": null,
"source_modified": null,
"tags": [],
"tags_v2": [],
"tlp": "red",
"uuid": null,
"workgroups": []
}
],
"Tags": [
"apt"
],
"ThreatBulletin": [],
"Type": "SHA256",
"Vulnerability": [
{
"assignee_user": null,
"association_info": [
{
"comment": null,
"created": "2022-07-11T16:16:43.125297",
"from_id": 366645476,
"sro": {}
}
],
"can_add_public_tags": true,
"circles": [
{
"id": "310",
"name": "NVD CVEs",
"resource_uri": "/api/v1/trustedcircle/310/"
}
],
"created_ts": "2022-06-28T00:14:01.266128",
"feed_id": 0,
"id": 177244,
"intelligence_initiatives": [],
"is_anonymous": false,
"is_cloneable": "yes_private_only",
"is_public": false,
"is_system": true,
"modified_ts": "2022-07-11T13:54:00",
"name": "CVE-2022-31098",
"organization_id": 1,
"owner_user_id": null,
"publication_status": "published",
"published_ts": "2022-06-27T22:15:00",
"resource_uri": "/api/v1/vulnerability/177244/",
"source": "mitre",
"source_created": null,
"source_modified": null,
"tags": [
"CWE-532"
],
"tags_v2": [
{
"id": "30h",
"name": "CWE-532"
}
],
"tlp": "white",
"update_id": 8849957,
"uuid": "9f209a42-4cd2-4405-8176-3a925c86ac03",
"workgroups": []
}
]
}
}
}

Human Readable Output#

File reputation for: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f#

ConfidenceITypeModifiedSHA256SeveritySourceStatusTagsType
50apt_md52022-07-11T16:30:00.359Z275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0fvery-hightmalache@paloaltonetworks.comactiveaptSHA256

Actor details:#

nameid
Alert report47096

Signature details:#

nameid
Feeds SDK 2.0: Signature Carbon Black Query test 1631

ThreatBulletin details:#

No entries.

TTP details:#

nameid
FleaHopper TTP1500

Vulnerability details:#

nameid
CVE-2022-31098177244

Campaign details:#

No entries.

threatstream-email-reputation#


Checks the reputation of the given email address.

Base Command#

threatstream-email-reputation

Input#

Argument NameDescriptionRequired
emailThe email address to check.Required
thresholdIf the confidence is greater than the threshold the email address is considered malicious, otherwise it is considered good. This argument overrides the default email threshold defined as a parameter.Optional
include_inactiveWhether to include results with an inactive status. Possible values are: True, False.Optional

Context Output#

PathTypeDescription
DBotScore.IndicatorStringThe tested indicator.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
ThreatStream.EmailReputation.SeverityStringThe indicator severity ("very-high", "high", "medium", "low").
ThreatStream.EmailReputation.ConfidenceStringThe observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.EmailReputation.StatusStringThe status assigned to the indicator.
ThreatStream.EmailReputation.TypeStringThe indicator type.
ThreatStream.EmailReputation.EmailStringThe indicator email address.
ThreatStream.EmailReputation.SourceStringThe indicator source.
ThreatStream.EmailReputation.ModifiedStringThe date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.EmailReputation.TagsUnknownTags assigned to the email.

Command Example#

!threatstream-email-reputation email=egov@ac.in

Context Example#

{
"DBotScore": {
"Indicator": "egov@ac.in",
"Reliability": "B - Usually reliable",
"Score": 3,
"Type": "email",
"Vendor": "Anomali ThreatStream v3"
},
"Email": {
"Address": "egov@ac.in"
},
"ThreatStream": {
"EmailReputation": {
"Confidence": 10000,
"Email": "egov@ac.in",
"Modified": "2021-08-01T10:35:53.484Z",
"Severity": "high",
"Source": "Analyst",
"Status": "active",
"Tags": [
"apt"
],
"Type": "email"
}
}
}

Human Readable Output#

Email reputation for: egov@ac.in#

ConfidenceEmailModifiedSeveritySourceStatusTagsType
10000egov@ac.in2021-08-01T10:35:53.484ZhighAnalystactiveaptemail

threatstream-get-passive-dns#


Returns enrichment data for Domain or IP for available observables.

Base Command#

threatstream-get-passive-dns

Input#

Argument NameDescriptionRequired
typeThe type of passive DNS search ("ip", "domain"). Possible values are: ip, domain. Default is ip.Required
valuePossible values are "IP" or "Domain".Required
limitThe maximum number of results to return. Default is 50.Optional

Context Output#

PathTypeDescription
ThreatStream.PassiveDNS.DomainStringThe domain value.
ThreatStream.PassiveDNS.IpStringThe IP value.
ThreatStream.PassiveDNS.RrtypeStringThe Rrtype value.
ThreatStream.PassiveDNS.SourceStringThe source value.
ThreatStream.PassiveDNS.FirstSeenStringThe first seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time, in UTC time.
ThreatStream.PassiveDNS.LastSeenStringThe last seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.

Command Example#

!threatstream-get-passive-dns type="domain" value="y.gp" limit="1"

Context Example#

{
"ThreatStream": {
"PassiveDNS": [
{
"Domain": "y.gp",
"FirstSeen": "2015-07-20 02:33:47",
"Ip": "78.78.78.67",
"LastSeen": "2015-12-19 06:44:35",
"Rrtype": "A",
"Source": "Anomali Labs"
}
]
}
}

Human Readable Output#

Passive DNS enrichment data for: y.gp#

DomainFirstSeenIpLastSeenRrtypeSource
y.gp2015-07-20 02:33:4778.78.78.672015-12-19 06:44:35AAnomali Labs

threatstream-import-indicator-with-approval#


Imports indicators (observables) into ThreatStream. The imported data must be approved using the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL.

Base Command#

threatstream-import-indicator-with-approval

Input#

Argument NameDescriptionRequired
confidenceThe observable certainty level of a reported indicator type. Default is 50.Optional
classificationWhether the indicator data is public or private to the organization. Possible values are: private, public. Default is private.Optional
threat_typeType of threat associated with the imported observables. Can be "adware", "anomalous", "anonymization", "apt", "bot", "brute", "c2", "compromised", "crypto", "data_leakage", "ddos", "dyn_dns", "exfil", "exploit", "hack_tool", "i2p", "informational", "malware", "p2p", "parked", "phish", "scan", "sinkhole", "spam", "suppress", "suspicious", "tor", or "vps". Possible values are: adware, anomalous, anonymization, apt, bot, brute, c2, compromised, crypto, data_leakage, ddos, dyn_dns, exfil, exploit, hack_tool, i2p, informational, malware, p2p, parked, phish, scan, sinkhole, spam, suppress, suspicious, tor, vps. Default is exploit.Optional
severityThe potential impact of the indicator type with which the observable is believed to be associated. Can be "low", "medium", "high", or "very-high". Possible values are: low, medium, high, very-high. Default is low.Optional
import_typeThe import type of the indicator. Can be "datatext", "file-id", or "url". Possible values are: datatext, file-id, url.Required
import_valueThe source of imported data. Can be one of the following: url, datatext of file-id of uploaded file to the War Room. Supported file types for file-id are: CSV, HTML, IOC, JSON, PDF, TXT.Required
ip_mappingIndicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported IP-type observable when an explicit itype is not specified for it.Optional
domain_mappingIndicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported domain-type observable when an explicit itype is not specified for it.Optional
url_mappingIndicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported URL-type observable when an explicit itype is not specified for it.Optional
email_mappingIndicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported email-type observable when an explicit itype is not specified for it.Optional
md5_mappingIndicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported MD5-type observable when an explicit itype is not specified for it.Optional

Context Output#

There is no context output for this command.

Command Example#

!threatstream-import-indicator-with-approval import_type=datatext import_value=78.78.78.67

Context Example#

{
"ThreatStream": {
"Import": {
"ImportID": "36118"
}
}
}

Human Readable Output#

The data was imported successfully. The ID of imported job is: 36118

threatstream-import-indicator-without-approval#


Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API.

Base Command#

threatstream-import-indicator-without-approval

Input#

Argument NameDescriptionRequired
confidenceThe observable certainty level of a reported indicator type. Default is 50.Optional
source_confidence_weightTo use your specified confidence entirely and not re-assess the value using machine learning algorithms, set sourceconfidence weight to 100.Optional
expiration_tsThe time stamp when intelligence will expire on ThreatStream, in ISO format. For example, 2020-12-24T00:00:00.Optional
severityThe severity to assign to the observable when it is imported. Can be "low", "medium", "high" , or "very-high". Possible values are: low, medium, high, very-high.Optional
tagsA comma-separated list of tags. For example, tag1,tag2.Optional
trustedcirclesA comma-separated list of trusted circle IDs with which threat data should be shared.Optional
classificationDenotes whether the indicator data is public or private to the organization. Possible values are: private, public.Required
allow_unresolvedWhether unresolved domain observables are included in the file will be accepted as valid in ThreatStream and imported. Possible values are: yes, no.Optional
file_idThe entry ID of a file (containing a JSON with an "objects" array and "meta" maps) that is uploaded to the War Room.Required

Context Output#

There is no context output for this command.

Command Example#

!threatstream-import-indicator-without-approval classification=private file_id=2761@3c9bd2a0-9eac-465b-8799-459df4997b2d

Human Readable Output#

The data was imported successfully.

threatstream-get-model-list#


Returns a list of threat models.

Base Command#

threatstream-get-model-list

Input#

Argument NameDescriptionRequired
modelThe threat model of the returned list. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.Required
limitLimits the model size list. Specifying limit=0 returns up to a maximum of 1000 models. For limit=0, the output is not set in the context. Default is 50.Optional

Context Output#

PathTypeDescription
ThreatStream.List.TypeStringThe threat model type.
ThreatStream.List.NameStringThe threat model name.
ThreatStream.List.IDStringThe threat model ID.
ThreatStream.List.CreatedTimeStringThe date and time of threat model creation. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time in UTC time.

Command Example#

!threatstream-get-model-list model=actor limit=10

Context Example#

{
"ThreatStream": {
"List": [
{
"CreatedTime": "2019-02-19T16:42:00.933984",
"ID": 1,
"Name": "Fleahopper Actor",
"Type": "Actor"
},
{
"CreatedTime": "2019-08-24T02:47:29.204380",
"ID": 10158,
"Name": "report actor 1",
"Type": "Actor"
},
{
"CreatedTime": "2019-08-28T16:35:39.316135",
"ID": 10159,
"Name": "report actor 1",
"Type": "Actor"
},
{
"CreatedTime": "2020-10-14T12:28:54.937276",
"ID": 10909,
"Name": "MANDRA",
"Type": "Actor"
},
{
"CreatedTime": "2021-09-14T13:37:02.111599",
"ID": 26769,
"Name": "New_Created_Actor",
"Type": "Actor"
}
]
}
}

Human Readable Output#

List of Actors#

CreatedTimeIDNameType
2019-02-19T16:42:00.9339841Fleahopper ActorActor
2019-08-24T02:47:29.20438010158report actor 1Actor
2019-08-28T16:35:39.31613510159report actor 1Actor
2020-10-14T12:28:54.93727610909MANDRAActor
2021-09-14T13:37:02.11159926769New_Created_ActorActor

threatstream-get-model-description#


Returns an HTML file with a description of the threat model.

Base Command#

threatstream-get-model-description

Input#

Argument NameDescriptionRequired
modelThe threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.Required
idThe threat model ID.Required

Context Output#

PathTypeDescription
File.NameStringThe file name of the model description.
File.EntryIDStringThe entry ID of the model description.

Command Example#

!threatstream-get-model-description model=actor id=1

Context Example#

{
"File": {
"EntryID": "3171@3c9bd2a0-9eac-465b-8799-459df4997b2d",
"Extension": "html",
"Info": "text/html; charset=utf-8",
"MD5": "18d7610f85c1216e78c59cbde5c470d9",
"Name": "actor_1.html",
"SHA1": "c778f72fd7799108db427f632ca6b2bb07c9bde4",
"SHA256": "6d06bdc613490216373e2b189c8d41143974c7a128da26e8fc4ba4f45a7e718b",
"SHA512": "989b0ae32b61b3b5a7ea1c3e629b50f07e7086310f8e4057ec046b368e55fc82cae873bd81eada657d827c96c71253b6ba3688561844ce983cdc5019d9666aa4",
"SSDeep": "48:32u8P32apgpIph9/gldn2++TnlCC4i72gSmB2rXpzNZx:32tuapgpCglM++TCE2gSN/",
"Size": 1868,
"Type": "ASCII text, with very long lines, with no line terminators"
}
}

Human Readable Output#

threatstream-get-indicators-by-model#


Returns a list of indicators associated with the specified model and ID of the model.

Base Command#

threatstream-get-indicators-by-model

Input#

Argument NameDescriptionRequired
modelThe threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.Required
idThe model ID.Required
limitThe maximum number of results to return. Default is 20.Optional

Context Output#

PathTypeDescription
ThreatStream.Model.ModelTypeStringThe threat model type.
ThreatStream.Model.ModelIDStringThe threat model ID.
ThreatStream.Model.Indicators.ValueStringThe value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IDStringThe ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ITypeStringThe iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.SeverityStringThe indicator severity associated with the specified model.
ThreatStream.Model.Indicators.ConfidenceStringThe confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.CountryStringThe country of the indicator associated with the specified model
ThreatStream.Model.Indicators.OrganizationStringThe organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASNStringThe ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.StatusStringThe status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.TagsStringThe tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ModifiedStringThe date and time the indicator was last modified.
ThreatStream.Model.Indicators.SourceStringThe indicator source.
ThreatStream.Model.Indicators.TypeStringThe indicator type.

Command Example#

!threatstream-get-indicators-by-model id=731 model=incident

Context Example#

{
"ThreatStream": {
"Model": {
"Indicators": [
{
"ASN": "",
"Confidence": 50,
"Country": null,
"ID": 181481953,
"IType": "mal_email",
"Modified": "2021-03-25T13:27:58.922Z",
"Organization": "",
"Severity": "low",
"Source": "Analyst",
"Status": "inactive",
"Tags": "tag-approved",
"Type": "email",
"Value": "testemail123@test.com"
}
],
"ModelID": "731",
"ModelType": "Incident"
}
}
}

Human Readable Output#

Indicators list for Threat Model Incident with id 731#

ASNConfidenceCountryIDITypeModifiedOrganizationSeveritySourceStatusTagsTypeValue
50181481953mal_email2021-03-25T13:27:58.922ZlowAnalystinactivetag-approvedemailtestemail123@test.com

threatstream-submit-to-sandbox#


Submits a file or URL to the ThreatStream-hosted sandbox for detonation.

Base Command#

threatstream-submit-to-sandbox

Input#

Argument NameDescriptionRequired
submission_classificationClassification of the Sandbox submission. Can be "private" or "public". Possible values are: private, public. Default is private.Optional
report_platformThe platform on which the submitted URL or file is run. To obtain a list supported platforms run the threatstream-supported-platforms command. Can be "WINDOWS7", or "WINDOWSXP". Possible values are: WINDOWS7, WINDOWSXP. Default is WINDOWS7.Optional
submission_typeThe detonation type. Can be "file" or "url". Possible values are: file, url. Default is file.Required
submission_valueThe submission value. Possible values are a valid URL or a file ID that was uploaded to the War Room to detonate.Required
premium_sandboxWhether the premium sandbox should be used for detonation. Possible values are: false, true. Default is false.Optional
detailA comma-separated list of additional details for the indicator. This information is displayed in the Tag column of the ThreatStream UI.Optional

Context Output#

PathTypeDescription
ThreatStream.Analysis.ReportIDStringThe report ID submitted to the sandbox.
ThreatStream.Analysis.StatusStringThe analysis status.
ThreatStream.Analysis.PlatformStringThe platform of the submission submitted to the sandbox.

Command Example#

!threatstream-submit-to-sandbox submission_classification="private" report_platform="WINDOWS7" submission_type="file" submission_value="1711@3c9bd2a0-9eac-465b-8799-459df4997b2d" premium_sandbox="false"

Context Example#

{
"ThreatStream": {
"Analysis": {
"Platform": "WINDOWS7",
"ReportID": 12418,
"Status": "processing"
}
}
}

Human Readable Output#

The submission info for 1711@3c9bd2a0-9eac-465b-8799-459df4997b2d#

PlatformReportIDStatus
WINDOWS712418processing

threatstream-get-analysis-status#


Returns the current status of the report submitted to the sandbox. The report ID is returned from the threatstream-submit-to-sandbox command.

Base Command#

threatstream-get-analysis-status

Input#

Argument NameDescriptionRequired
report_idThe report ID to check the status.Required

Context Output#

PathTypeDescription
ThreatStream.Analysis.ReportIDStringThe report ID of the file or URL that was detonated in the sandbox.
ThreatStream.Analysis.StatusStringThe report status of the file or URL that was detonated in the sandbox.
ThreatStream.Analysis.PlatformStringThe platform used for detonation.
ThreatStream.Analysis.VerdictStringThe report verdict of the file or URL detonated in the sandbox. The verdict remains "benign" until detonation is complete.

Command Example#

!threatstream-get-analysis-status report_id=12414

Context Example#

{
"ThreatStream": {
"Analysis": {
"Platform": "WINDOWS7",
"ReportID": "12414",
"Status": "errors",
"Verdict": "Benign"
}
}
}

Human Readable Output#

The analysis status for id 12414#

PlatformReportIDStatusVerdict
WINDOWS712414errorsBenign

threatstream-analysis-report#


Returns the report of a file or URL submitted to the sandbox.

Base Command#

threatstream-analysis-report

Input#

Argument NameDescriptionRequired
report_idThe report ID to return.Required

Context Output#

PathTypeDescription
ThreatStream.Analysis.ReportIDStringThe ID of the report submitted to the sandbox.
ThreatStream.Analysis.CategoryStringThe report category.
ThreatStream.Analysis.StartedStringThe detonation start time.
ThreatStream.Analysis.CompletedStringThe detonation completion time.
ThreatStream.Analysis.DurationNumberThe duration of the detonation (in seconds).
ThreatStream.Analysis.VmNameStringThe VM name.
ThreatStream.Analysis.VmIDStringThe VM ID.
ThreatStream.Analysis.Network.UdpSourceStringThe UDP source.
ThreatStream.Analysis.Network.UdpDestinationStringThe UDP destination.
ThreatStream.Analysis.Network.UdpPortStringThe UDP port.
ThreatStream.Analysis.Network.IcmpSourceStringThe ICMP source.
ThreatStream.Analysis.Network.IcmpDestinationStringThe ICMP destination.
ThreatStream.Analysis.Network.IcmpPortStringThe ICMP port.
ThreatStream.Analysis.Network.TcpSourceStringThe TCP source.
ThreatStream.Analysis.Network.TcpDestinationStringThe TCP destination.
ThreatStream.Analysis.Network.TcpPortStringThe TCP port.
ThreatStream.Analysis.Network.HttpSourceStringThe source of the HTTP address.
ThreatStream.Analysis.Network.HttpDestinatonStringThe destination of the HTTP address.
ThreatStream.Analysis.Network.HttpPortStringThe port of the HTTP address.
ThreatStream.Analysis.Network.HttpsSourceStringThe source of the HTTPS address.
ThreatStream.Analysis.Network.HttpsDestinatonStringThe destination of the HTTPS address.
ThreatStream.Analysis.Network.HttpsPortStringThe port of the HTTPS address.
ThreatStream.Analysis.Network.HostsStringThe network analysis hosts.
ThreatStream.Analysis.VerdictStringThe verdict of the sandbox detonation.

Command Example#

!threatstream-analysis-report report_id="12212"

Context Example#

{
"ThreatStream": {
"Analysis": {
"Category": "Url",
"Completed": "2021-08-19 06:51:52",
"Duration": 152,
"Network": [
{
"UdpDestinaton": "8.8.8.8",
"UdpPort": 53,
"UdpSource": "192.168.2.4"
},
{
"Hosts": "78.78.78.67"
}
],
"ReportID": "12212",
"Started": "2021-08-19 06:49:20",
"Verdict": "Benign",
"VmID": "",
"VmName": ""
}
}
}

Human Readable Output#

Report 12212 analysis results#

CategoryCompletedDurationReportIDStartedVerdictVmIDVmName
Url2021-08-19 06:51:52152122122021-08-19 06:49:20Benign

threatstream-get-indicators#


Return filtered indicators from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.

Base Command#

threatstream-get-indicators

Input#

Argument NameDescriptionRequired
queryThe Anomali Observable Search Filter Language query to filter indicator results. If a query is passed as an argument, it overrides all other arguments.Optional
asnThe Autonomous System (AS) number associated with the indicator.Optional
confidenceThe observable certainty level
of a reported indicator type. Confidence scores range from 0-100 in increasing order of confidence, and are assigned by ThreatStream based on several factors.
Optional
countryThe country associated with the indicator.Optional
created_tsWhen the indicator was first seen on
the ThreatStream cloud platform. The date must be specified in this format:
YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.
For example, 2014-10-02T20:44:35.
Optional
idThe unique ID for the indicator.Optional
is_publicWhether the classification of the indicator is public. Default is "false". Possible values are: false, true.Optional
indicator_severityThe severity assigned to the indicator by ThreatStream.Optional
orgThe registered owner (organization) of the IP address associated with the indicator.Optional
statusThe status assigned to the indicator. Can be "active", "inactive", or "falsepos". Possible values are: active, inactive, falsepos.Optional
tags_nameThe tag assigned to the indicator.Optional
typeThe type of indicator. Can be "domain", "email", "ip", "MD5", "string", or "url". Possible values are: domain, email, ip, md5, string, url.Optional
indicator_valueThe value of the indicator. .Optional
limitThe maximum number of results to return from ThreatStream. Default is 20. Default is 20.Optional

Context Output#

PathTypeDescription
ThreatStream.Indicators.ITypeStringThe indicator type.
ThreatStream.Indicators.ModifiedStringThe date and time the indicator was last updated in ThreatStream. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
ThreatStream.Indicators.ConfidenceStringThe observable certainty level of a reported indicator type.
ThreatStream.Indicators.ValueStringThe indicator value.
ThreatStream.Indicators.StatusStringThe indicator status.
ThreatStream.Indicators.OrganizationStringThe registered owner (organization) of the IP address associated with the indicator.
ThreatStream.Indicators.CountryStringThe country associated with the indicator.
ThreatStream.Indicators.TagsStringThe tag assigned to the indicator.
ThreatStream.Indicators.SourceStringThe indicator source.
ThreatStream.Indicators.IDStringThe indicator ID.
ThreatStream.Indicators.ASNStringThe Autonomous System (AS) number associated with the indicator.
ThreatStream.Indicators.SeverityStringThe severity assigned to the indicator.

Command Example#

!threatstream-get-indicators type=ip status=active limit=5

Context Example#

{
"ThreatStream": {
"Indicators": [
{
"ASN": "",
"Confidence": 100,
"Country": null,
"ID": 239450621,
"IType": "apt_ip",
"Modified": "2021-05-24T16:42:09.245Z",
"Organization": "",
"Severity": "very-high",
"Source": "Analyst",
"Status": "active",
"Tags": null,
"Type": "ip",
"Value": "78.78.78.67"
},
{
"ASN": "",
"Confidence": -1,
"Country": null,
"ID": 235549247,
"IType": "apt_ip",
"Modified": "2021-04-29T16:02:17.558Z",
"Organization": "",
"Severity": "very-high",
"Source": "Analyst",
"Status": "active",
"Tags": null,
"Type": "ip",
"Value": "78.78.78.67"
}
]
}
}

Human Readable Output#

The indicators results#

ASNConfidenceCountryIDITypeModifiedOrganizationSeveritySourceStatusTagsTypeValue
100239450621apt_ip2021-05-24T16:42:09.245Zvery-highAnalystactiveip78.78.78.67
-1235549247apt_ip2021-04-29T16:02:17.558Zvery-highAnalystactiveip78.78.78.67

threatstream-add-tag-to-model#


Adds tags to intelligence to filter for related entities.

Base Command#

threatstream-add-tag-to-model

Input#

Argument NameDescriptionRequired
modelThe type of threat model entity to which to add the tag. Can be "actor", "campaign", "incident", "intelligence", "signature", "tipreport", "ttp", or "vulnerability". Possible values are: actor, campaign, incident, intelligence, signature, tipreport, ttp, vulnerability. Default is intelligence.Optional
tagsA comma separated list of tags applied to the specified threat model entities or observable. .Required
model_idThe ID of the model to which to add the tag.Required

Context Output#

There is no context output for this command.

Command Example#

!threatstream-add-tag-to-model model=incident model_id=130 tags="suspicious,not valid"

Human Readable Output#

Added successfully tags: ['suspicious', 'not valid'] to incident with 130

threatstream-create-model#


Creates a threat model with the specified parameters.

Base Command#

threatstream-create-model

Input#

Argument NameDescriptionRequired
modelThe type of threat model to create. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, ttp, vulnerability, tipreport.Required
nameThe name of the threat model to create.Required
is_publicWhether the scope of threat model is visible. Possible values are: true, false. Default is false.Optional
tlpThe Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". Possible values are: red, amber, green, white. Default is red.Optional
tagsA comma separated list of tags.Optional
intelligenceA comma separated list of indicators IDs associated with the threat model on the ThreatStream platform.Optional
descriptionThe description of the threat model.Optional

Context Output#

PathTypeDescription
ThreatStream.Model.ModelTypeStringThe threat model type.
ThreatStream.Model.ModelIDStringThe threat model ID.
ThreatStream.Model.Indicators.ValueStringThe value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IDStringThe ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ITypeStringThe iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.SeverityStringThe severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ConfidenceStringThe confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.CountryStringThe country of the indicator associated with the specified model
ThreatStream.Model.Indicators.OrganizationStringThe organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASNStringThe ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.StatusStringThe status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.TagsStringThe tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ModifiedStringThe date and time the indicator was last modified.
ThreatStream.Model.Indicators.SourceStringThe indicator source.
ThreatStream.Model.Indicators.TypeStringThe indicator type.

Command Example#

!threatstream-create-model model=actor name="New_Created_Actor_1" description="Description of the actor threat model" intelligence=191431508 tags="new actor,test" tlp=red

Context Example#

{
"ThreatStream": {
"Model": {
"Indicators": [
{
"ASN": "",
"Confidence": 50,
"Country": null,
"ID": 191431508,
"IType": "apt_md5",
"Modified": "2021-09-13T12:40:42.596Z",
"Organization": "",
"Severity": "medium",
"Source": "TestSource",
"Status": "active",
"Tags": null,
"Type": "SHA256",
"Value": "178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1"
}
],
"ModelID": 26770,
"ModelType": "Actor"
}
}
}

Human Readable Output#

Indicators list for Threat Model Actor with id 26770#

ASNConfidenceCountryIDITypeModifiedOrganizationSeveritySourceStatusTagsTypeValue
50191431508apt_md52021-09-13T12:40:42.596ZmediumTestSourceactiveSHA256178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1

threatstream-update-model#


Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overrides previous data stored in ThreatStream.

Base Command#

threatstream-update-model

Input#

Argument NameDescriptionRequired
modelThe type of threat model to update. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, ttp, vulnerability, tipreport.Required
model_idThe ID of the threat model to update.Required
nameThe name of the threat model to update.Optional
is_publicWhether the scope of threat model is visible. Possible values are: true, false. Default is false.Optional
tlpThe Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". Possible values are: red, amber, green, white. Default is red.Optional
tagsA comma separated list of tags.Optional
intelligenceA comma separated list of indicator IDs associated with the threat model on the ThreatStream platform.Optional
descriptionThe description of the threat model.Optional

Context Output#

PathTypeDescription
ThreatStream.Model.ModelTypeStringThe threat model type.
ThreatStream.Model.ModelIDStringThe threat model ID.
ThreatStream.Model.Indicators.ValueStringThe value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IDStringThe ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ITypeStringThe iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.SeverityStringThe severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ConfidenceStringThe confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.CountryStringThe country of the indicator associated with the specified model.
ThreatStream.Model.Indicators.OrganizationStringThe organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASNStringThe ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.StatusStringThe status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.TagsStringThe tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ModifiedStringThe date and time the indicator was last modified.
ThreatStream.Model.Indicators.SourceStringThe indicator source.
ThreatStream.Model.Indicators.TypeStringThe indicator type.

Command Example#

!threatstream-update-model model=actor model_id=26769 intelligence=191431508 tags="updated tag,gone"

Context Example#

{
"ThreatStream": {
"Model": {
"Indicators": [
{
"ASN": "",
"Confidence": 50,
"Country": null,
"ID": 191431508,
"IType": "apt_md5",
"Modified": "2021-09-13T12:40:42.596Z",
"Organization": "",
"Severity": "medium",
"Source": "TestSource",
"Status": "active",
"Tags": null,
"Type": "SHA256",
"Value": "178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1"
}
],
"ModelID": "26769",
"ModelType": "Actor"
}
}
}

Human Readable Output#

Indicators list for Threat Model Actor with id 26769#

ASNConfidenceCountryIDITypeModifiedOrganizationSeveritySourceStatusTagsTypeValue
50191431508apt_md52021-09-13T12:40:42.596ZmediumTestSourceactiveSHA256178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1

threatstream-supported-platforms#


Returns a list of supported platforms for default or premium sandbox.

Base Command#

threatstream-supported-platforms

Input#

Argument NameDescriptionRequired
sandbox_typeThe type of sandbox ("default" or "premium"). Possible values are: default, premium. Default is default.Optional

Context Output#

PathTypeDescription
ThreatStream.PremiumPlatforms.NameStringThe name of the supported platform for premium sandbox.
ThreatStream.PremiumPlatforms.TypesStringThe type of supported submissions for premium sandbox.
ThreatStream.PremiumPlatforms.LabelStringThe display name of the supported platform of premium sandbox.
ThreatStream.DefaultPlatforms.NameStringThe name of the supported platform for standard sandbox.
ThreatStream.DefaultPlatforms.TypesStringThe type of the supported submissions for standard sandbox.
ThreatStream.DefaultPlatforms.LabelStringThe display name of the supported platform of standard sandbox.

Command Example#

!threatstream-supported-platforms sandbox_type=default

Context Example#

{
"ThreatStream": {
"DefaultPlatforms": [
{
"Label": "Windows 7",
"Name": "WINDOWS7",
"Platform": "windows",
"Types": [
"file",
"url"
]
}
]
}
}

Human Readable Output#

Supported platforms for default sandbox#

LabelNamePlatformTypes
Windows 7WINDOWS7windowsfile,
url

url#


Checks the reputation of the given URL.

Base Command#

url

Input#

Argument NameDescriptionRequired
urlThe URL to check.Required
thresholdIf confidence is greater than the threshold the URL is considered malicious, otherwise it is considered good. This argument overrides the default URL threshold defined as a parameter.Optional
include_inactiveWhether to include results with an inactive status. Possible values are: True, False.Optional
threat_model_associationEnhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.Optional

Context Output#

PathTypeDescription
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
URL.DataStringThe URL of the indicator.
URL.Malicious.VendorStringThe vendor that reported the indicator as malicious.
ThreatStream.URL.ModifiedStringThe date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.URL.ConfidenceStringThe observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.URL.StatusStringThe indicator status.
ThreatStream.URL.OrganizationStringThe name of the business that owns the IP address associated with the indicator.
ThreatStream.URL.AddressStringThe indicator URL.
ThreatStream.URL.CountryStringThe country associated with the indicator.
ThreatStream.URL.TypeStringThe indicator type.
ThreatStream.URL.SourceStringThe indicator source.
ThreatStream.URL.SeverityStringThe indicator severity ("very-high", "high", "medium", or "low").
ThreatStream.URL.TagsUnknownTags assigned to the URL.
ThreatStream.URL.ITypeStringThe itype of the indicator associated with the specified model.
URL.TagsUnknownList of URL tags.
URL.ThreatTypesUnknownThreat types associated with the url.
ThreatStream.URL.Actor.assignee_userUnknownThe assignee user of the threat actor.
ThreatStream.URL.Actor.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.URL.Actor.association_info.createdDateThe date the association info was created.
ThreatStream.URL.Actor.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.URL.Actor.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.URL.Actor.created_tsDateThe date the threat actor was created.
ThreatStream.URL.Actor.feed_idNumberThe feed ID of the threat actor.
ThreatStream.URL.Actor.idNumberThe ID of the threat actor.
ThreatStream.URL.Actor.is_anonymousBooleanWhether the threat actor is anonymous.
ThreatStream.URL.Actor.is_cloneableStringWhether the threat actor is cloneable.
ThreatStream.URL.Actor.is_publicBooleanWhether the threat actor is public.
ThreatStream.URL.Actor.is_teamBooleanWhether the threat actor is a team.
ThreatStream.URL.Actor.modified_tsDateThe date the threat actor was modified.
ThreatStream.URL.Actor.nameStringThe name of the threat actor.
ThreatStream.URL.Actor.organization_idNumberThe organization ID of the threat actor.
ThreatStream.URL.Actor.owner_user_idNumberThe owner user ID of the threat actor.
ThreatStream.URL.Actor.primary_motivationUnknownThe primary motivation of the threat actor.
ThreatStream.URL.Actor.publication_statusStringThe publication status of the threat actor.
ThreatStream.URL.Actor.published_tsDateThe date the threat actor was published.
ThreatStream.URL.Actor.resource_levelUnknownThe resource level of the threat actor.
ThreatStream.URL.Actor.resource_uriStringThe resource URI of the threat actor.
ThreatStream.URL.Actor.source_createdUnknownThe date the source was created.
ThreatStream.URL.Actor.source_modifiedUnknownThe date the source was modified.
ThreatStream.URL.Actor.start_dateUnknownThe start date.
ThreatStream.URL.Actor.tagsStringThe tags of the threat indicator.
ThreatStream.URL.Actor.tags_v2.idStringThe ID of the tag.
ThreatStream.URL.Actor.tags_v2.nameStringThe name of the tag.
ThreatStream.URL.Actor.tlpStringThe TLP of the threat actor.
ThreatStream.URL.Actor.uuidStringThe UUID of the threat actor.
ThreatStream.URL.Signature.assignee_userUnknownThe assignee user of the signature.
ThreatStream.URL.Signature.association_info.commentUnknownThe comment in the association info of the signature.
ThreatStream.URL.Signature.association_info.createdDateThe date the association info was created.
ThreatStream.URL.Signature.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.URL.Signature.can_add_public_tagsBooleanWhether you can add public tags to the signature.
ThreatStream.URL.Signature.created_tsDateThe date the signature was created.
ThreatStream.URL.Signature.feed_idNumberThe feed ID of the signature.
ThreatStream.URL.Signature.idNumberThe ID of the signature.
ThreatStream.URL.Signature.is_anonymousBooleanWhether the signature is anonymous.
ThreatStream.URL.Signature.is_cloneableStringWhether the signature is cloneable.
ThreatStream.URL.Signature.is_publicBooleanWhether the signature is public.
ThreatStream.URL.Signature.is_teamBooleanWhether the signature is a team signature.
ThreatStream.URL.Signature.modified_tsDateThe date the signature was modified.
ThreatStream.URL.Signature.nameStringThe name of the signature.
ThreatStream.URL.Signature.organization_idNumberThe organization ID of the signature.
ThreatStream.URL.Signature.owner_user_idNumberThe owner user ID of the signature.
ThreatStream.URL.Signature.primary_motivationUnknownThe primary motivation of the signature.
ThreatStream.URL.Signature.publication_statusStringThe publication status of the signature.
ThreatStream.URL.Signature.published_tsDateThe date the signature was published.
ThreatStream.URL.Signature.resource_levelUnknownThe resource level of the signature.
ThreatStream.URL.Signature.resource_uriStringThe resource URI of the signature.
ThreatStream.URL.Signature.source_createdUnknownThe date the source was created.
ThreatStream.URL.Signature.source_modifiedUnknownThe date the source was modified.
ThreatStream.URL.Signature.start_dateUnknownThe start date.
ThreatStream.URL.Signature.tagsStringThe tags of the threat indicator.
ThreatStream.URL.Signature.tags_v2.idStringThe ID of the tag.
ThreatStream.URL.Signature.tags_v2.nameStringThe name of the tag.
ThreatStream.URL.Signature.tlpStringThe TLP of the signature.
ThreatStream.URL.Signature.uuidStringThe UUID of the signature.
ThreatStream.URL.ThreatBulletin.all_circles_visibleBooleanWhether all of the circles are visible.
ThreatStream.URL.ThreatBulletin.assignee_orgStringThe assignee organization.
ThreatStream.URL.ThreatBulletin.assignee_org_idStringThe assignee organization ID.
ThreatStream.URL.ThreatBulletin.assignee_org_nameStringThe assignee organization name.
ThreatStream.URL.ThreatBulletin.assignee_userStringThe assignee user.
ThreatStream.URL.ThreatBulletin.assignee_user_idStringThe assignee user ID.
ThreatStream.URL.ThreatBulletin.assignee_user_nameUnknownThe assignee user name.
ThreatStream.URL.ThreatBulletin.association_info.commentUnknownThe comment in the association info of the threat actor.
ThreatStream.URL.ThreatBulletin.association_info.createdDateThe date the association info was created.
ThreatStream.URL.ThreatBulletin.association_info.from_idStringThe ID from which the association info is related.
ThreatStream.URL.ThreatBulletin.body_content_typeStringThe body content type.
ThreatStream.URL.ThreatBulletin.campaignUnknownThe campaign of the threat bulletin.
ThreatStream.URL.ThreatBulletin.can_add_public_tagsBooleanWhether you can add public tags.
ThreatStream.URL.ThreatBulletin.created_tsDateThe date the threat bulletin was created.
ThreatStream.URL.ThreatBulletin.feed_idNumberThe feed ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.idStringThe ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.is_anonymousBooleanWhether the threat bulletin is anonymous.
ThreatStream.URL.ThreatBulletin.is_cloneableStringWhether the threat bulletin is cloneable.
ThreatStream.URL.ThreatBulletin.is_editableBooleanWhether the threat bulletin is editable.
ThreatStream.URL.ThreatBulletin.is_emailBooleanWhether the threat bulletin is an email.
ThreatStream.URL.ThreatBulletin.is_publicBooleanWhether the threat bulletin is public.
ThreatStream.URL.ThreatBulletin.modified_tsDateThe date the threat bulletin was modified.
ThreatStream.URL.ThreatBulletin.nameStringThe name of the threat bulletin.
ThreatStream.URL.ThreatBulletin.original_sourceStringThe original source of the threat bulletin.
ThreatStream.URL.ThreatBulletin.original_source_idUnknownThe original source ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.owner_org.idStringThe owner organization ID.
ThreatStream.URL.ThreatBulletin.owner_org.nameStringThe owner organization name.
ThreatStream.URL.ThreatBulletin.owner_org.resource_uriStringThe owner organization URI.
ThreatStream.URL.ThreatBulletin.owner_org_idNumberThe ID of the owner user.
ThreatStream.URL.ThreatBulletin.owner_org_nameStringThe name of the owner organization.
ThreatStream.URL.ThreatBulletin.owner_user.avatar_s3_urlUnknownThe URL of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.can_share_intelligenceBooleanWhether you can share intelligence.
ThreatStream.URL.ThreatBulletin.owner_user.emailStringThe email of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.idStringThe ID of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.is_activeBooleanWhether the owner user is active.
ThreatStream.URL.ThreatBulletin.owner_user.is_readonlyBooleanWhether the owner user has read-only permission.
ThreatStream.URL.ThreatBulletin.owner_user.must_change_passwordBooleanWhether the owner user must change the password.
ThreatStream.URL.ThreatBulletin.owner_user.nameStringThe owner user name.
ThreatStream.URL.ThreatBulletin.owner_user.nicknameStringThe owner user nickname.
ThreatStream.URL.ThreatBulletin.owner_user.organization.idStringThe ID of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.organization.nameStringThe name of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.organization.resource_uriStringThe resource URI of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.resource_uriStringThe resource URI of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user_idNumberThe owner user ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.owner_user_nameStringThe owner user name of the threat bulletin.
ThreatStream.URL.ThreatBulletin.parentUnknownThe parent of the threat bulletin.
ThreatStream.URL.ThreatBulletin.published_tsUnknownThe date the threat bulletin was published.
ThreatStream.URL.ThreatBulletin.resource_uriStringThe resource URI of the threat bulletin.
ThreatStream.URL.ThreatBulletin.sourceUnknownThe source of the threat bulletin.
ThreatStream.URL.ThreatBulletin.source_createdUnknownThe date the source was created.
ThreatStream.URL.ThreatBulletin.source_modifiedUnknownThe date the source was modified.
ThreatStream.URL.ThreatBulletin.starred_by_meBooleanWhether the threat bulletin was started by me.
ThreatStream.URL.ThreatBulletin.starred_total_countNumberThe total number of times the threat bulletin was starred.
ThreatStream.URL.ThreatBulletin.statusStringThe status of the threat bulletin.
ThreatStream.URL.ThreatBulletin.threat_actorUnknownThe threat actor of the threat bulletin.
ThreatStream.URL.ThreatBulletin.tlpUnknownThe TLP of the threat bulletin.
ThreatStream.URL.ThreatBulletin.ttpUnknownThe TTP of the threat bulletin.
ThreatStream.URL.ThreatBulletin.uuidStringThe UUID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.votes.meUnknownThe number of votes by me.
ThreatStream.URL.ThreatBulletin.votes.totalNumberThe number of total votes.
ThreatStream.URL.ThreatBulletin.watched_by_meBooleanWhether the threat bulletin was watched by me.
ThreatStream.URL.ThreatBulletin.watched_total_countNumberThe total number of watchers.
ThreatStream.URL.TTP.assignee_userUnknownThe assignee user of the TTP.
ThreatStream.URL.TTP.association_info.commentUnknownThe comment in the association info of the TTP.
ThreatStream.URL.TTP.association_info.createdDateThe date the association info was created.
ThreatStream.URL.TTP.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.URL.TTP.can_add_public_tagsBooleanWhether you can add public tags to the TTP.
ThreatStream.URL.TTP.created_tsDateThe date the TTP was created.
ThreatStream.URL.TTP.feed_idNumberThe feed ID of the TTP.
ThreatStream.URL.TTP.idNumberThe ID of the TTP.
ThreatStream.URL.TTP.is_anonymousBooleanWhether the TTP was anonymous.
ThreatStream.URL.TTP.is_cloneableStringWhether the TTP was cloneable.
ThreatStream.URL.TTP.is_publicBooleanWhether the TTP is public.
ThreatStream.URL.TTP.is_teamBooleanWhether the TTP is a team.
ThreatStream.URL.TTP.modified_tsDateThe date the TTP was modified.
ThreatStream.URL.TTP.nameStringThe name of the TTP.
ThreatStream.URL.TTP.organization_idNumberThe organization ID of the TTP.
ThreatStream.URL.TTP.owner_user_idNumberThe owner user ID of the TTP.
ThreatStream.URL.TTP.primary_motivationUnknownThe primary motivation of the TTP.
ThreatStream.URL.TTP.publication_statusStringThe publication status of the TTP.
ThreatStream.URL.TTP.published_tsDateThe date the TTP was published.
ThreatStream.URL.TTP.resource_levelUnknownThe resource level of the TTP.
ThreatStream.URL.TTP.resource_uriStringThe resource URI of the TTP.
ThreatStream.URL.TTP.source_createdUnknownThe date the source was created.
ThreatStream.URL.TTP.source_modifiedUnknownThe date the source was modified.
ThreatStream.URL.TTP.start_dateUnknownThe start date.
ThreatStream.URL.TTP.tagsStringThe tags of the threat indicator.
ThreatStream.URL.TTP.tags_v2.idStringThe ID of the tag.
ThreatStream.URL.TTP.tags_v2.nameStringThe name of the tag.
ThreatStream.URL.TTP.tlpStringThe TLP of the TTP.
ThreatStream.URL.TTP.uuidStringThe UUID of the TTP.
ThreatStream.URL.Vulnerability.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.URL.Vulnerability.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.URL.Vulnerability.association_info.createdDateThe date the association info was created.
ThreatStream.URL.Vulnerability.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.URL.Vulnerability.can_add_public_tagsBooleanWhether you can add public tags to the threat actor.
ThreatStream.URL.Vulnerability.circles.idStringThe ID of the circle.
ThreatStream.URL.Vulnerability.circles.nameStringThe name of the circle.
ThreatStream.URL.Vulnerability.circles.resource_uriStringThe resource URI of the circle.
ThreatStream.URL.Vulnerability.created_tsDateThe date the vulnerability was created.
ThreatStream.URL.Vulnerability.feed_idNumberThe feed ID of the vulnerability.
ThreatStream.URL.Vulnerability.idNumberThe ID of the vulnerability.
ThreatStream.URL.Vulnerability.is_anonymousBooleanWhether the vulnerability is anonymous.
ThreatStream.URL.Vulnerability.is_cloneableStringWhether the vulnerability is cloneable.
ThreatStream.URL.Vulnerability.is_publicBooleanWhether the vulnerability is public.
ThreatStream.URL.Vulnerability.is_systemBooleanWhether the vulnerability is in the system.
ThreatStream.URL.Vulnerability.modified_tsDateThe date the vulnerability was modified.
ThreatStream.URL.Vulnerability.nameStringThe name of the vulnerability.
ThreatStream.URL.Vulnerability.organization_idNumberThe organization ID of the vulnerability.
ThreatStream.URL.Vulnerability.owner_user_idUnknownThe owner user ID of the vulnerability.
ThreatStream.URL.Vulnerability.publication_statusStringThe publication status of the vulnerability.
ThreatStream.URL.Vulnerability.published_tsDateThe date the vulnerability was published.
ThreatStream.URL.Vulnerability.resource_uriStringThe resource URI of the vulnerability.
ThreatStream.URL.Vulnerability.sourceStringThe source of the vulnerability.
ThreatStream.URL.Vulnerability.source_createdUnknownThe feed ID of the vulnerability.
ThreatStream.URL.Vulnerability.source_modifiedUnknownWhether the source was modified.
ThreatStream.URL.Vulnerability.tagsStringThe tags of the vulnerability.
ThreatStream.URL.Vulnerability.tags_v2.idStringThe ID of the tag.
ThreatStream.URL.Vulnerability.tags_v2.nameStringThe name of the tag.
ThreatStream.URL.Vulnerability.tlpStringThe TLP of the vulnerability.
ThreatStream.URL.Vulnerability.update_idNumberThe update ID of the vulnerability.
ThreatStream.URL.Vulnerability.uuidStringThe UUID of the vulnerability.
ThreatStream.URL.Campaign.assignee_userUnknownThe assignee user of the vulnerability.
ThreatStream.URL.Campaign.association_info.commentUnknownThe comment in the association info of the vulnerability.
ThreatStream.URL.Campaign.association_info.createdDateThe date the association info was created.
ThreatStream.URL.Campaign.association_info.from_idNumberThe ID from which the association info is related.
ThreatStream.URL.Campaign.can_add_public_tagsBooleanWhether you can add public tags to the campaign.
ThreatStream.URL.Campaign.created_tsDateThe date the campaign was created.
ThreatStream.URL.Campaign.end_dateUnknownThe end date of the campaign.
ThreatStream.URL.Campaign.feed_idNumberThe feed ID of the campaign.
ThreatStream.URL.Campaign.idNumberThe ID of the campaign.
ThreatStream.URL.Campaign.is_anonymousBooleanWhether the campaign is anonymous.
ThreatStream.URL.Campaign.is_cloneableStringWhether the campaign is cloneable.
ThreatStream.URL.Campaign.is_publicBooleanWhether the campaign is public.
ThreatStream.URL.Campaign.modified_tsDateThe date the campaign was modified.
ThreatStream.URL.Campaign.nameStringThe name of the campaign.
ThreatStream.URL.Campaign.objectiveUnknownThe objective of the campaign.
ThreatStream.URL.Campaign.organization_idNumberThe organization ID of the campaign.
ThreatStream.URL.Campaign.owner_user_idNumberThe owner user ID of the campaign.
ThreatStream.URL.Campaign.publication_statusStringThe publication status of the campaign.
ThreatStream.URL.Campaign.published_tsUnknownThe date the campaign was published.
ThreatStream.URL.Campaign.resource_uriStringThe resource URI of the campaign.
ThreatStream.URL.Campaign.source_createdDateThe date the campaign was created.
ThreatStream.URL.Campaign.source_modifiedDateWhether the source was modified.
ThreatStream.URL.Campaign.start_dateUnknownThe start date of the campaign.
ThreatStream.URL.Campaign.status.display_nameStringThe display name of the status.
ThreatStream.URL.Campaign.status.idNumberThe ID of the status of the campaign.
ThreatStream.URL.Campaign.status.resource_uriStringThe resource URI of the status of the campaign.
ThreatStream.URL.Campaign.tlpStringThe TLP of the campaign.
ThreatStream.URL.Campaign.uuidStringThe UUID of the campaign.

Command example#

!url url=http://www.ujhy1.com/ threat_model_association=True

Context Example#

{
"DBotScore": {
"Indicator": "http://www.ujhy1.com/",
"Message": "No results found.",
"Reliability": "B - Usually reliable",
"Score": 0,
"Type": "url",
"Vendor": "Anomali ThreatStream v3 May"
},
"URL": {
"Data": "http://www.ujhy1.com/"
}
}

Human Readable Output#

Anomali ThreatStream v3 May:#

URLResult
http://www.ujhy1.com/Not found

Additional Considerations for this version#

  • Remove the default_threshold integration parameter.
  • Add integration parameter for global threshold in ip, domain, file, url, and threatstream-email-reputation commands.
  • Add Include inactive results checkbox in integration settings for the ability to get inactive results.

threatstream-search-intelligence#


Returns filtered intelligence from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.

Base Command#

threatstream-search-intelligence

Input#

Argument NameDescriptionRequired
valueThe value of an intelligence.Optional
uuidThe UUID of an intelligence. When several UUIDs stated, an β€œOR” operator is used.Optional
typeThe type of an intelligence. Possible values are: domain, email, ip, md5, string, url.Optional
itypeThe itType of an intelligence. (e.g., apt_ip, apt_email).Optional
statusThe status of an intelligence. Possible values are: active, inactive, falsepos.Optional
tagsThe tags of an intelligence. Comma-separated list. When several tags are stated, an β€œOR” operator is used.Optional
asnThe ASN of an intelligence.Optional
confidenceThe confidence of an intelligence. Input will be operator then value, i.e., β€œgt 65” or β€œlt 85”. If only a value is stated, then it must match exactly.Optional
threat_typeThe threat type of an intelligence.Optional
is_publicWhether the intelligence is public.Optional
queryQuery that overrides all other arguments. The filter operators used for the filter language query are the symbolic form (=, <, >, and so on) and not the descriptive form (exact, lt, gt, and so on). E.g., (confidence>=90+AND+(itype="apt_ip"+OR+itype="bot_ip"+OR+itype="c2_ip")).Optional
update_id_gtAn incrementing numeric identifier associated with each update to intelligence on ThreatStream. If specified, then it is recommended to use order_by=update_id.Optional
order_byHow to order the results.Optional
limitThe maximum number of results to return from ThreatStream. The maximum number of returned results is 1000. For more results, use the page and page_size arguments. Default is 50.Optional
pagePage number to get result from. Needs to be used with page_size argument.Optional
page_sizeThe page size of the returned results. Needs to be used with the page argument.Optional

Context Output#

PathTypeDescription
ThreatStream.Intelligence.source_createdStringThe source from which the intelligence was created.
ThreatStream.Intelligence.statusStringThe status of the intelligence.
ThreatStream.Intelligence.itypeStringThe itype of the intelligence.
ThreatStream.Intelligence.expiration_tsDateThe expiration timestamp of the intelligence.
ThreatStream.Intelligence.ipStringThe IP address of the intelligence.
ThreatStream.Intelligence.is_editableBooleanWhether the intelligence is editable.
ThreatStream.Intelligence.feed_idStringThe feed ID of the intelligence.
ThreatStream.Intelligence.update_idStringThe update ID of the intelligence.
ThreatStream.Intelligence.valueStringThe value of the intelligence.
ThreatStream.Intelligence.is_publicBooleanWhether the intelligence is public.
ThreatStream.Intelligence.threattypeStringThe threat type of the intelligence.
ThreatStream.Intelligence.workgroupsStringThe work groups of the intelligence.
ThreatStream.Intelligence.confidenceStringThe confidence of the intelligence.
ThreatStream.Intelligence.uuidStringThe UUID of the intelligence.
ThreatStream.Intelligence.retina_confidenceStringThe retina confidence of the intelligence.
ThreatStream.Intelligence.trusted_circle_idsStringThe trusted circleIDs of the intelligence.
ThreatStream.Intelligence.idStringThe ID of the intelligence.
ThreatStream.Intelligence.sourceStringThe source of the iIntelligence.
ThreatStream.Intelligence.owner_organization_idStringThe owner organization ID of the intelligence.
ThreatStream.Intelligence.import_session_idStringThe import session ID of the intelligence.
ThreatStream.Intelligence.source_modifiedBooleanWhether the the source was modified.
ThreatStream.Intelligence.typeStringThe type of the intelligence.
ThreatStream.Intelligence.descriptionStringThe description of the intelligence.
ThreatStream.Intelligence.tagsStringThe tags of the intelligence.
ThreatStream.Intelligence.threatscoreStringThe threat score of the intelligence.
ThreatStream.Intelligence.latitudeStringThe latitude of the intelligence.
ThreatStream.Intelligence.longitudeStringThe longitude of the intelligence.
ThreatStream.Intelligence.modified_tsDateThe date the intelligence was modified.
ThreatStream.Intelligence.orgStringThe organization of the intelligence.
ThreatStream.Intelligence.asnNumberThe ASN of the intelligence.
ThreatStream.Intelligence.created_tsDateThe date the intelligence was created.
ThreatStream.Intelligence.tlpStringThe TLP of the intelligence.
ThreatStream.Intelligence.is_anonymousBooleanWhether the intelligence is anonymous.
ThreatStream.Intelligence.countryStringThe country of the intelligence.
ThreatStream.Intelligence.source_reported_confidenceStringThe confidence of the reported source.
ThreatStream.Intelligence.subtypeStringThe subtype of the intelligence.
ThreatStream.Intelligence.resource_uriStringThe resource URI of the intelligence
ThreatStream.Intelligence.severityStringThe severity of the intelligence.

Command example#

!threatstream-search-intelligence limit=1 status=inactive value=1.2.4.5

Context Example#

{
"ThreatStream": {
"Intelligence": [
{
"asn": "",
"can_add_public_tags": true,
"confidence": 100,
"country": null,
"created_ts": "2022-04-21T14:27:51.242Z",
"description": null,
"expiration_ts": "2022-07-20T14:27:51.041Z",
"feed_id": 0,
"id": 355250247,
"import_session_id": null,
"ip": "1.2.4.5",
"is_anonymous": false,
"is_editable": false,
"is_public": true,
"itype": "c2_ip",
"latitude": null,
"longitude": null,
"meta": {
"detail2": "bifocals_deactivated_on_2022-07-20_14:30:00.151050",
"severity": "medium"
},
"modified_ts": "2022-07-20T14:30:02.307Z",
"org": "",
"owner_organization_id": 67,
"rdns": null,
"resource_uri": "/api/v2/intelligence/355250247/",
"retina_confidence": -1,
"sort": [
1658327402307,
"355250247"
],
"source": "Analyst",
"source_created": null,
"source_modified": null,
"source_reported_confidence": 100,
"status": "inactive",
"subtype": null,
"tags": [
{
"id": "4w0",
"name": "abc"
},
{
"id": "o8x",
"name": "feb3fbcf-d18c-4a1a-89af-fbe054e16f6c"
},
{
"id": "vuj",
"name": "Playboook_source_without_approval_on_cloud"
}
],
"threat_type": "c2",
"threatscore": 70,
"tlp": null,
"trusted_circle_ids": null,
"type": "ip",
"update_id": 940700580,
"uuid": "3e141a49-6fc9-4567-8efb-919565a39752",
"value": "1.2.4.5",
"workgroups": []
}
]
}
}

Human Readable Output#

The intelligence results#

Can Add Public TagsConfidenceCreated TsExpiration TsFeed IdIdIpIs AnonymousIs EditableIs PublicItypeMetaModified TsOwner Organization IdResource UriRetina ConfidenceSortSourceSource Reported ConfidenceStatusTagsThreat TypeThreatscoreTypeUpdate IdUuidValue
true1002022-04-21T14:27:51.242Z2022-07-20T14:27:51.041Z03552502471.2.4.5falsefalsetruec2_ipdetail2: bifocals_deactivated_on_2022-07-20_14:30:00.151050
severity: medium
2022-07-20T14:30:02.307Z67/api/v2/intelligence/355250247/-11658327402307,
355250247
Analyst100inactive{'id': '4w0', 'name': 'abc'},
{'id': 'o8x', 'name': 'feb3fbcf-d18c-4a1a-89af-fbe054e16f6c'},
{'id': 'vuj', 'name': 'Playboook_source_without_approval_on_cloud'}
c270ip9407005803e141a49-6fc9-4567-8efb-919565a397521.2.4.5