Anomali ThreatStream v3

This Integration is part of the Anomali ThreatStream Pack.

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Use Anomali ThreatStream to query and submit threats.

Some changes have been made that might affect your existing content. If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Anomali ThreatStream v3 on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.

2. Search for Anomali ThreatStream v3.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Server URL (e.g., https://www.test.com)		True
   Username		True
   API Key		True
   URL threshold		False
   IP threshold		False
   Domain threshold		False
   File threshold		False
   Email threshold		False
   Include inactive results	Whether to include inactive indicators in reputation commands.	False
   Source Reliability	Reliability of the source providing the intelligence data.	True
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Create relationships	Create relationships between indicators as part of enrichment.	False

4. Click Test to validate the URLs, token, and connection.

Configure Indicator Threshold Parameters

Each indicator has a threshold parameter and an integer confidence value that impacts the indicator's DBotScore calculation.
The indicator DBotScore is calculated as follows:

• If you do not specify the threshold parameter value in your instance configuration (recommended):
  If the indicator confidence > 65, the DBotScore value is set to 3 (Malicious).
  If the indicator confidence is between 25 and 65, the DBotScore value is set to 2 (Suspicious).
  If the indicator confidence < 25, the DBotScore value is set to 1 (Good).
  For example, If the IP threshold value is not specified during configuration and the IP indicator confidence value is 45, the DBotScore value is set to 2 (Suspicious).
• If you configure the threshold parameter value:
  If the indicator confidence value is above the threshold parameter value, the DBotScore is set to 3 (Malicious). Otherwise the DBotScore is set to 1 (Good).
  Note: You cannot define a threshold that sets the DBotScore to 2 (Suspicious).
  For example, if in the instance configuration you set File threshold to 10 and the confidence value is 15, the DBotScore is set to 3 (Malicious).

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

---

Checks the reputation of the given IP address.

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP to check.	Required
threshold	If confidence is greater than the threshold the IP address is considered malicious, otherwise it is considered good. This argument overrides the default IP threshold defined as a parameter.	Optional
include_inactive	Whether to include results with an inactive status. Possible values are: True, False.	Optional
threat_model_association	Enhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.	Optional

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
IP.ASN	String	The Autonomous System (AS) number associated with the indicator.
IP.Address	String	The IP address of the indicator.
IP.Geo.Country	String	The country associated with the indicator.
IP.Geo.Location	String	The longitude and latitude of the IP address.
ThreatStream.IP.ASN	String	The Autonomous System (AS) number associated with the indicator.
ThreatStream.IP.Address	String	The IP address of the indicator.
ThreatStream.IP.Country	String	The country associated with the indicator.
ThreatStream.IP.Type	String	The indicator type.
ThreatStream.IP.Modified	String	The time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time in UTC time.
ThreatStream.IP.Severity	String	The indicator severity ("very-high", "high", "medium", or "low").
ThreatStream.IP.Confidence	String	The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.IP.Status	String	The status assigned to the indicator.
ThreatStream.IP.Organization	String	The name of the business that owns the IP address associated with the indicator.
ThreatStream.IP.Source	String	The indicator source.
IP.Malicious.Vendor	String	The vendor that reported the indicator as malicious.
ThreatStream.IP.Tags	Unknown	Tags assigned to the IP.
ThreatStream.IP.IType	String	The itype of the indicator associated with the specified model.
IP.Tags	Unknown	List of IP tags.
IP.ThreatTypes	Unknown	Threat types associated with the IP.
ThreatStream.IP.Actor.assignee_user	Unknown	The assignee user of the threat actor.
ThreatStream.IP.Actor.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.IP.Actor.association_info.created	Date	The date the association info was created.
ThreatStream.IP.Actor.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.IP.Actor.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.IP.Actor.created_ts	Date	The date the threat actor was created.
ThreatStream.IP.Actor.feed_id	Number	The feed ID of the threat actor.
ThreatStream.IP.Actor.id	Number	The ID of the threat actor.
ThreatStream.IP.Actor.is_anonymous	Boolean	Whether the threat actor is anonymous.
ThreatStream.IP.Actor.is_cloneable	String	Whether the threat actor is cloneable.
ThreatStream.IP.Actor.is_public	Boolean	Whether the threat actor is public.
ThreatStream.IP.Actor.is_team	Boolean	Whether the threat actor is a team.
ThreatStream.IP.Actor.modified_ts	Date	The date the threat actor was modified.
ThreatStream.IP.Actor.name	String	The name of the threat actor.
ThreatStream.IP.Actor.organization_id	Number	The organization ID of the threat actor.
ThreatStream.IP.Actor.owner_user_id	Number	The owner user ID of the threat actor.
ThreatStream.IP.Actor.primary_motivation	Unknown	The primary motivation of the threat actor.
ThreatStream.IP.Actor.publication_status	String	The publication status of the threat actor.
ThreatStream.IP.Actor.published_ts	Date	The date the threat actor was published.
ThreatStream.IP.Actor.resource_level	Unknown	The resource level of the threat actor.
ThreatStream.IP.Actor.resource_uri	String	The resource URI of the threat actor.
ThreatStream.IP.Actor.source_created	Unknown	The date the source was created.
ThreatStream.IP.Actor.source_modified	Unknown	The date the source was modified.
ThreatStream.IP.Actor.start_date	Unknown	The start date.
ThreatStream.IP.Actor.tags	String	The tags of the threat indicator.
ThreatStream.IP.Actor.tags_v2.id	String	The ID of the tag.
ThreatStream.IP.Actor.tags_v2.name	String	The name of the tag.
ThreatStream.IP.Actor.tlp	String	The TLP of the threat actor.
ThreatStream.IP.Actor.uuid	String	The UUID of the threat actor.
ThreatStream.IP.Signature.assignee_user	Unknown	The assignee user of the signature.
ThreatStream.IP.Signature.association_info.comment	Unknown	The comment in the association info of the signature.
ThreatStream.IP.Signature.association_info.created	Date	The date the association info was created.
ThreatStream.IP.Signature.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.IP.Signature.can_add_public_tags	Boolean	Whether you can add public tags to the signature.
ThreatStream.IP.Signature.created_ts	Date	The date the signature was created.
ThreatStream.IP.Signature.feed_id	Number	The feed ID of the signature.
ThreatStream.IP.Signature.id	Number	The ID of the signature.
ThreatStream.IP.Signature.is_anonymous	Boolean	Whether the signature was anonymous.
ThreatStream.IP.Signature.is_cloneable	String	Whether the signature is cloneable.
ThreatStream.IP.Signature.is_public	Boolean	Whether the signature is public.
ThreatStream.IP.Signature.is_team	Boolean	Whether the signature is a team signature.
ThreatStream.IP.Signature.modified_ts	Date	The date the signature was modified.
ThreatStream.IP.Signature.name	String	The name of the signature.
ThreatStream.IP.Signature.organization_id	Number	The organization ID of the signature.
ThreatStream.IP.Signature.owner_user_id	Number	The owner user ID of the signature.
ThreatStream.IP.Signature.primary_motivation	Unknown	The primary motivation of the signature.
ThreatStream.IP.Signature.publication_status	String	The publication status of the signature.
ThreatStream.IP.Signature.published_ts	Date	The date the signature was published.
ThreatStream.IP.Signature.resource_level	Unknown	The resource level of the signature.
ThreatStream.IP.Signature.resource_uri	String	The resource URI of the signature.
ThreatStream.IP.Signature.source_created	Unknown	The date the source was created.
ThreatStream.IP.Signature.source_modified	Unknown	The date the source was modified.
ThreatStream.IP.Signature.start_date	Unknown	The start date.
ThreatStream.IP.Signature.tags	String	The tags of the threat indicator.
ThreatStream.IP.Signature.tags_v2.id	String	The ID of the tag.
ThreatStream.IP.Signature.tags_v2.name	String	The name of the tag.
ThreatStream.IP.Signature.tlp	String	The TLP of the signature.
ThreatStream.IP.Signature.uuid	String	The UUID of the signature.
ThreatStream.IP.ThreatBulletin.all_circles_visible	Boolean	Whether all of the circles are visible.
ThreatStream.IP.ThreatBulletin.assignee_org	String	The assignee organization.
ThreatStream.IP.ThreatBulletin.assignee_org_id	String	The assignee organization ID.
ThreatStream.IP.ThreatBulletin.assignee_org_name	String	The assignee organization name.
ThreatStream.IP.ThreatBulletin.assignee_user	String	The assignee user.
ThreatStream.IP.ThreatBulletin.assignee_user_id	String	The assignee user ID.
ThreatStream.IP.ThreatBulletin.assignee_user_name	Unknown	The assignee user name.
ThreatStream.IP.ThreatBulletin.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.IP.ThreatBulletin.association_info.created	Date	The date the association info was created.
ThreatStream.IP.ThreatBulletin.association_info.from_id	String	The ID from which the association info is related.
ThreatStream.IP.ThreatBulletin.body_content_type	String	The body content type.
ThreatStream.IP.ThreatBulletin.campaign	Unknown	The campaign of the threat bulletin.
ThreatStream.IP.ThreatBulletin.can_add_public_tags	Boolean	Whether you can add public tags.
ThreatStream.IP.ThreatBulletin.created_ts	Date	The date the threat bulletin was created.
ThreatStream.IP.ThreatBulletin.feed_id	Number	The feed ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.id	String	The ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.is_anonymous	Boolean	Whether the threat bulletin is anonymous.
ThreatStream.IP.ThreatBulletin.is_cloneable	String	Whether the threat bulletin is cloneable.
ThreatStream.IP.ThreatBulletin.is_editable	Boolean	Whether the threat bulletin is editable.
ThreatStream.IP.ThreatBulletin.is_email	Boolean	Whether the threat bulletin is an email.
ThreatStream.IP.ThreatBulletin.is_public	Boolean	Whether the threat bulletin is public.
ThreatStream.IP.ThreatBulletin.modified_ts	Date	The date the threat bulletin was modified.
ThreatStream.IP.ThreatBulletin.name	String	The name of the threat bulletin.
ThreatStream.IP.ThreatBulletin.original_source	String	The original source of the threat bulletin.
ThreatStream.IP.ThreatBulletin.original_source_id	Unknown	The original source ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.owner_org.id	String	The owner organization ID.
ThreatStream.IP.ThreatBulletin.owner_org.name	String	The owner organization name.
ThreatStream.IP.ThreatBulletin.owner_org.resource_uri	String	The owner organization URI.
ThreatStream.IP.ThreatBulletin.owner_org_id	Number	The ID of the owner user.
ThreatStream.IP.ThreatBulletin.owner_org_name	String	The name of the owner organization.
ThreatStream.IP.ThreatBulletin.owner_user.avatar_s3_url	Unknown	The URL of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.can_share_intelligence	Boolean	Whether you can share intelligence.
ThreatStream.IP.ThreatBulletin.owner_user.email	String	The email of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.id	String	The ID of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user.is_active	Boolean	Whether the owner user is active.
ThreatStream.IP.ThreatBulletin.owner_user.is_readonly	Boolean	Whether the owner user has read-only permission.
ThreatStream.IP.ThreatBulletin.owner_user.must_change_password	Boolean	Whether the owner user must change the password.
ThreatStream.IP.ThreatBulletin.owner_user.name	String	The owner user name.
ThreatStream.IP.ThreatBulletin.owner_user.nickname	String	The owner user nickname.
ThreatStream.IP.ThreatBulletin.owner_user.organization.id	String	The ID of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.organization.name	String	The name of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.organization.resource_uri	String	The resource URI of the owner user organization.
ThreatStream.IP.ThreatBulletin.owner_user.resource_uri	String	The resource URI of the owner user.
ThreatStream.IP.ThreatBulletin.owner_user_id	Number	The owner user ID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.owner_user_name	String	The owner user name of the threat bulletin.
ThreatStream.IP.ThreatBulletin.parent	Unknown	The parent of the threat bulletin.
ThreatStream.IP.ThreatBulletin.published_ts	Unknown	The date the threat bulletin was published.
ThreatStream.IP.ThreatBulletin.resource_uri	String	The resource URI of the threat bulletin.
ThreatStream.IP.ThreatBulletin.source	Unknown	The source of the threat bulletin.
ThreatStream.IP.ThreatBulletin.source_created	Unknown	The date the source was created.
ThreatStream.IP.ThreatBulletin.source_modified	Unknown	The date the source was modified.
ThreatStream.IP.ThreatBulletin.starred_by_me	Boolean	Whether the threat bulletin was started by me.
ThreatStream.IP.ThreatBulletin.starred_total_count	Number	The total number of times the threat bulletin was starred.
ThreatStream.IP.ThreatBulletin.status	String	The status of the threat bulletin.
ThreatStream.IP.ThreatBulletin.threat_actor	Unknown	The threat actor of the threat bulletin.
ThreatStream.IP.ThreatBulletin.tlp	Unknown	The TLP of the threat bulletin.
ThreatStream.IP.ThreatBulletin.ttp	Unknown	The TTP of the threat bulletin.
ThreatStream.IP.ThreatBulletin.uuid	String	The UUID of the threat bulletin.
ThreatStream.IP.ThreatBulletin.votes.me	Unknown	The number of votes by me.
ThreatStream.IP.ThreatBulletin.votes.total	Number	The number of total votes.
ThreatStream.IP.ThreatBulletin.watched_by_me	Boolean	Whether the threat bulletin was watched by me.
ThreatStream.IP.ThreatBulletin.watched_total_count	Number	The total number of watchers.
ThreatStream.IP.TTP.assignee_user	Unknown	The assignee user of the TTP.
ThreatStream.IP.TTP.association_info.comment	Unknown	The comment in the association info of the TTP.
ThreatStream.IP.TTP.association_info.created	Date	The date the association info was created.
ThreatStream.IP.TTP.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.IP.TTP.can_add_public_tags	Boolean	Whether you can add public tags to the TTP.
ThreatStream.IP.TTP.created_ts	Date	The date the TTP was created.
ThreatStream.IP.TTP.feed_id	Number	The feed ID of the TTP.
ThreatStream.IP.TTP.id	Number	The ID of the TTP.
ThreatStream.IP.TTP.is_anonymous	Boolean	Whether the TTP was anonymous.
ThreatStream.IP.TTP.is_cloneable	String	Whether the TTP was cloneable.
ThreatStream.IP.TTP.is_public	Boolean	Whether the TTP is public.
ThreatStream.IP.TTP.is_team	Boolean	Whether the TTP is a team.
ThreatStream.IP.TTP.modified_ts	Date	The date the TTP was modified.
ThreatStream.IP.TTP.name	String	The name of the TTP.
ThreatStream.IP.TTP.organization_id	Number	The organization ID of the TTP.
ThreatStream.IP.TTP.owner_user_id	Number	The owner user ID of the TTP.
ThreatStream.IP.TTP.primary_motivation	Unknown	The primary motivation of the TTP.
ThreatStream.IP.TTP.publication_status	String	The publication status of the TTP.
ThreatStream.IP.TTP.published_ts	Date	The date the TTP was published.
ThreatStream.IP.TTP.resource_level	Unknown	The resource level of the TTP.
ThreatStream.IP.TTP.resource_uri	String	The resource URI of the TTP.
ThreatStream.IP.TTP.source_created	Unknown	The date the source was created.
ThreatStream.IP.TTP.source_modified	Unknown	The date the source was modified.
ThreatStream.IP.TTP.start_date	Unknown	The start date.
ThreatStream.IP.TTP.tags	String	The tags of the threat indicator.
ThreatStream.IP.TTP.tags_v2.id	String	The ID of the tag.
ThreatStream.IP.TTP.tags_v2.name	String	The name of the tag.
ThreatStream.IP.TTP.tlp	String	The TLP of the TTP.
ThreatStream.IP.TTP.uuid	String	The UUID of the TTP.
ThreatStream.IP.Vulnerability.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.IP.Vulnerability.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.IP.Vulnerability.association_info.created	Date	The date the association info was created.
ThreatStream.IP.Vulnerability.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.IP.Vulnerability.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.IP.Vulnerability.circles.id	String	The ID of the circle.
ThreatStream.IP.Vulnerability.circles.name	String	The name of the circle.
ThreatStream.IP.Vulnerability.circles.resource_uri	String	The resource URI of the circle.
ThreatStream.IP.Vulnerability.created_ts	Date	The date the vulnerability was created.
ThreatStream.IP.Vulnerability.feed_id	Number	The feed ID of the vulnerability.
ThreatStream.IP.Vulnerability.id	Number	The ID of the vulnerability.
ThreatStream.IP.Vulnerability.is_anonymous	Boolean	Whether the vulnerability is anonymous.
ThreatStream.IP.Vulnerability.is_cloneable	String	Whether the vulnerability is cloneable.
ThreatStream.IP.Vulnerability.is_public	Boolean	Whether the vulnerability is public.
ThreatStream.IP.Vulnerability.is_system	Boolean	Whether the vulnerability is in the system.
ThreatStream.IP.Vulnerability.modified_ts	Date	The date the vulnerability was modified.
ThreatStream.IP.Vulnerability.name	String	The name of the vulnerability.
ThreatStream.IP.Vulnerability.organization_id	Number	The organization ID of the vulnerability.
ThreatStream.IP.Vulnerability.owner_user_id	Unknown	The owner user ID of the vulnerability.
ThreatStream.IP.Vulnerability.publication_status	String	The publication status of the vulnerability.
ThreatStream.IP.Vulnerability.published_ts	Date	The date the vulnerability was published.
ThreatStream.IP.Vulnerability.resource_uri	String	The resource URI of the vulnerability.
ThreatStream.IP.Vulnerability.source	String	The source of the vulnerability.
ThreatStream.IP.Vulnerability.source_created	Unknown	The feed ID of the vulnerability.
ThreatStream.IP.Vulnerability.source_modified	Unknown	Whether the source was modified.
ThreatStream.IP.Vulnerability.tags	String	The tags of the vulnerability.
ThreatStream.IP.Vulnerability.tags_v2.id	String	The ID of the tag.
ThreatStream.IP.Vulnerability.tags_v2.name	String	The name of the tag.
ThreatStream.IP.Vulnerability.tlp	String	The TLP of the vulnerability.
ThreatStream.IP.Vulnerability.update_id	Number	The update ID of the vulnerability.
ThreatStream.IP.Vulnerability.uuid	String	The UUID of the vulnerability.
ThreatStream.IP.Campaign.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.IP.Campaign.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.IP.Campaign.association_info.created	Date	The date the association info was created.
ThreatStream.IP.Campaign.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.IP.Campaign.can_add_public_tags	Boolean	Whether you can add public tags to the campaign.
ThreatStream.IP.Campaign.created_ts	Date	The date the campaign was created.
ThreatStream.IP.Campaign.end_date	Unknown	The end date of the campaign.
ThreatStream.IP.Campaign.feed_id	Number	The feed ID of the campaign.
ThreatStream.IP.Campaign.id	Number	The ID of the campaign.
ThreatStream.IP.Campaign.is_anonymous	Boolean	Whether the campaign is anonymous.
ThreatStream.IP.Campaign.is_cloneable	String	Whether the campaign is cloneable.
ThreatStream.IP.Campaign.is_public	Boolean	Whether the campaign is public.
ThreatStream.IP.Campaign.modified_ts	Date	The date the campaign was modified.
ThreatStream.IP.Campaign.name	String	The name of the campaign.
ThreatStream.IP.Campaign.objective	Unknown	The objective of the campaign.
ThreatStream.IP.Campaign.organization_id	Number	The organization ID of the campaign.
ThreatStream.IP.Campaign.owner_user_id	Number	The owner user ID of the campaign.
ThreatStream.IP.Campaign.publication_status	String	The publication status of the campaign.
ThreatStream.IP.Campaign.published_ts	Unknown	The date the campaign was published.
ThreatStream.IP.Campaign.resource_uri	String	The resource URI of the campaign.
ThreatStream.IP.Campaign.source_created	Date	The date the campaign was created.
ThreatStream.IP.Campaign.source_modified	Date	Whether the source was modified.
ThreatStream.IP.Campaign.start_date	Unknown	The start date of the campaign.
ThreatStream.IP.Campaign.status.display_name	String	The display name of the status.
ThreatStream.IP.Campaign.status.id	Number	The ID of the status of the campaign.
ThreatStream.IP.Campaign.status.resource_uri	String	The resource URI of the status of the campaign.
ThreatStream.IP.Campaign.tlp	String	The TLP of the campaign.
ThreatStream.IP.Campaign.uuid	String	The UUID of the campaign.

Command example

!ip ip=23.98.23.98 threat_model_association=True

Context Example

{

"DBotScore": {

"Indicator": "23.98.23.98",

"Reliability": "B - Usually reliable",

"Score": 3,

"Type": "ip",

"Vendor": "Anomali ThreatStream v3 May"

},

"IP": {

"Address": "23.98.23.98",

"Malicious": {

"Description": null,

"Vendor": "Anomali ThreatStream v3 May"

},

"Relationships": [

{

"EntityA": "23.98.23.98",

"EntityAType": "IP",

"EntityB": "Test Investigation",

"EntityBType": "Campaign",

"Relationship": "related-to"

}

],

"Tags": [

"apt",

"PANW_Test"

],

"ThreatTypes": [

{

"threatcategory": "apt",

"threatcategoryconfidence": null

}

]

},

"ThreatStream": {

"IP": {

"ASN": "",

"Actor": [],

"Address": "23.98.23.98",

"Campaign": [

{

"assignee_user": {

"email": "darbel@paloaltonetworks.com",

"id": "202",

"name": "",

"resource_uri": "/api/v1/user/202/"

},

"association_info": [

{

"comment": null,

"created": "2022-08-01T09:52:10.246877",

"from_id": 239450621,

"sro": {}

}

],

"can_add_public_tags": true,

"circles": [],

"created_ts": "2022-08-01T09:52:10.252091",

"end_date": null,

"feed_id": 0,

"id": 372437,

"intelligence_initiatives": [],

"is_anonymous": false,

"is_cloneable": "yes",

"is_public": false,

"modified_ts": "2022-08-01T09:52:10.246877",

"name": "Test Investigation",

"objective": null,

"organization_id": 88,

"owner_user_id": 202,

"publication_status": "new",

"published_ts": null,

"resource_uri": "/api/v1/campaign/372437/",

"source_created": null,

"source_modified": null,

"start_date": null,

"status": {

"display_name": "Ongoing",

"id": 1,

"resource_uri": "/api/v1/campaignstatus/1/"

},

"tags": [],

"tags_v2": [],

"tlp": "white",

"uuid": "9b7872f1-beb7-42d7-a500-d37df74af644",

"workgroups": []

}

],

"Confidence": 100,

"Country": null,

"IType": "apt_ip",

"Modified": "2022-08-01T09:46:41.715Z",

"Organization": "",

"Severity": "very-high",

"Signature": [],

"Source": "Analyst",

"Status": "active",

"TTP": [],

"Tags": [

"apt",

"PANW_Test"

],

"ThreatBulletin": [],

"Type": "ip",

"Vulnerability": []

}

}

}

Human Readable Output

IP reputation for: 23.98.23.98

ASN	Address	Confidence	Country	IType	Modified	Organization	Severity	Source	Status	Tags	Type
	23.98.23.98	100		apt_ip	2022-08-01T09:46:41.715Z		very-high	Analyst	active	apt, PANW_Test	ip

Actor details:

No entries.

Signature details:

No entries.

ThreatBulletin details:

No entries.

TTP details:

No entries.

Vulnerability details:

No entries.

Campaign details:

name	id
Test Investigation	372437

domain

---

Checks the reputation of the given domain name.

Base Command

domain

Input

Argument Name	Description	Required
domain	The domain name to check.	Required
threshold	If confidence is greater than the threshold the domain is considered malicious, otherwise it is considered good. This argument overrides the default domain threshold defined as a parameter.	Optional
include_inactive	Whether to include results with an inactive status. Possible values are: True, False.	Optional
threat_model_association	Enhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.	Optional

Context Output

Path	Type	Description
Domain.Name	String	The domain name.
Domain.DNS	String	The IP addresses resolved by the DNS.
Domain.WHOIS.CreationDate	Date	The date the domain was created. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
Domain.WHOIS.UpdatedDate	Date	The date the domain was last updated. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
Domain.WHOIS.Registrant.Name	String	The registrant name.
Domain.WHOIS.Registrant.Email	String	The registrant email address.
Domain.WHOIS.Registrant.Phone	String	The registrant phone number.
ThreatStream.Domain.ASN	String	The Autonomous System (AS) number associated with the indicator.
ThreatStream.Domain.Address	String	The indicator domain name.
ThreatStream.Domain.Country	String	The country associated with the indicator.
ThreatStream.Domain.Type	String	The indicator type.
ThreatStream.Domain.Modified	String	The date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.Domain.Severity	String	The indicator severity ("very-high", "high", "medium", "low").
ThreatStream.Domain.Confidence	String	The observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.Domain.Status	String	The status assigned to the indicator.
ThreatStream.Domain.Organization	String	The name of the business that owns the IP address associated with the indicator.
ThreatStream.Domain.Source	String	The indicator source.
Domain.Malicious.Vendor	String	The vendor that reported the indicator as malicious.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
ThreatStream.Domain.Tags	Unknown	Tags assigned to the domain.
ThreatStream.Domain.IType	String	The itype of the indicator associated with the specified model.
Domain.Tags	Unknown	List of domain tags.
Domain.ThreatTypes	Unknown	Threat types associated with the domain.
ThreatStream.Domain.Actor.assignee_user	Unknown	The assignee user of the threat actor.
ThreatStream.Domain.Actor.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.Domain.Actor.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.Actor.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.Domain.Actor.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.Domain.Actor.created_ts	Date	The date the threat actor was created.
ThreatStream.Domain.Actor.feed_id	Number	The feed ID of the threat actor.
ThreatStream.Domain.Actor.id	Number	The ID of the threat actor.
ThreatStream.Domain.Actor.is_anonymous	Boolean	Whether the threat actor is anonymous.
ThreatStream.Domain.Actor.is_cloneable	String	Whether the threat actor is cloneable.
ThreatStream.Domain.Actor.is_public	Boolean	Whether the threat actor is public.
ThreatStream.Domain.Actor.is_team	Boolean	Whether the threat actor is a team.
ThreatStream.Domain.Actor.modified_ts	Date	The date the threat actor was modified.
ThreatStream.Domain.Actor.name	String	The name of the threat actor.
ThreatStream.Domain.Actor.organization_id	Number	The organization ID of the threat actor.
ThreatStream.Domain.Actor.owner_user_id	Number	The owner user ID of the threat actor.
ThreatStream.Domain.Actor.primary_motivation	Unknown	The primary motivation of the threat actor.
ThreatStream.Domain.Actor.publication_status	String	The publication status of the threat actor.
ThreatStream.Domain.Actor.published_ts	Date	The date the threat actor was published.
ThreatStream.Domain.Actor.resource_level	Unknown	The resource level of the threat actor.
ThreatStream.Domain.Actor.resource_uri	String	The resource URI of the threat actor.
ThreatStream.Domain.Actor.source_created	Unknown	The date the source was created.
ThreatStream.Domain.Actor.source_modified	Unknown	The date the source was modified.
ThreatStream.Domain.Actor.start_date	Unknown	The start date.
ThreatStream.Domain.Actor.tags	String	The tags of the threat indicator.
ThreatStream.Domain.Actor.tags_v2.id	String	The ID of the tag.
ThreatStream.Domain.Actor.tags_v2.name	String	The name of the tag.
ThreatStream.Domain.Actor.tlp	String	The TLP of the threat actor.
ThreatStream.Domain.Actor.uuid	String	The UUID of the threat actor.
ThreatStream.Domain.Signature.assignee_user	Unknown	The assignee user of the signature.
ThreatStream.Domain.Signature.association_info.comment	Unknown	The comment in the association info of the signature.
ThreatStream.Domain.Signature.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.Signature.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.Domain.Signature.can_add_public_tags	Boolean	Whether you can add public tags to the signature.
ThreatStream.Domain.Signature.created_ts	Date	The date the signature was created.
ThreatStream.Domain.Signature.feed_id	Number	The feed ID of the signature.
ThreatStream.Domain.Signature.id	Number	The ID of the signature.
ThreatStream.Domain.Signature.is_anonymous	Boolean	Whether the signature is anonymous.
ThreatStream.Domain.Signature.is_cloneable	String	Whether the signature is cloneable.
ThreatStream.Domain.Signature.is_public	Boolean	Whether the signature is public.
ThreatStream.Domain.Signature.is_team	Boolean	Whether the signature is a team signature.
ThreatStream.Domain.Signature.modified_ts	Date	The date the signature was modified.
ThreatStream.Domain.Signature.name	String	The name of the signature.
ThreatStream.Domain.Signature.organization_id	Number	The organization ID of the signature.
ThreatStream.Domain.Signature.owner_user_id	Number	The owner user ID of the signature.
ThreatStream.Domain.Signature.primary_motivation	Unknown	The primary motivation of the signature.
ThreatStream.Domain.Signature.publication_status	String	The publication status of the signature.
ThreatStream.Domain.Signature.published_ts	Date	The date the signature was published.
ThreatStream.Domain.Signature.resource_level	Unknown	The resource level of the signature.
ThreatStream.Domain.Signature.resource_uri	String	The resource URI of the signature.
ThreatStream.Domain.Signature.source_created	Unknown	The date the source was created.
ThreatStream.Domain.Signature.source_modified	Unknown	The date the source was modified.
ThreatStream.Domain.Signature.start_date	Unknown	The start date.
ThreatStream.Domain.Signature.tags	String	The tags of the threat indicator.
ThreatStream.Domain.Signature.tags_v2.id	String	The ID of the tag.
ThreatStream.Domain.Signature.tags_v2.name	String	The name of the tag.
ThreatStream.Domain.Signature.tlp	String	The TLP of the signature.
ThreatStream.Domain.Signature.uuid	String	The UUID of the signature.
ThreatStream.Domain.ThreatBulletin.all_circles_visible	Boolean	Whether all of the circles are visible.
ThreatStream.Domain.ThreatBulletin.assignee_org	String	The assignee organization.
ThreatStream.Domain.ThreatBulletin.assignee_org_id	String	The assignee organization ID.
ThreatStream.Domain.ThreatBulletin.assignee_org_name	String	The assignee organization name.
ThreatStream.Domain.ThreatBulletin.assignee_user	String	The assignee user.
ThreatStream.Domain.ThreatBulletin.assignee_user_id	String	The assignee user ID.
ThreatStream.Domain.ThreatBulletin.assignee_user_name	Unknown	The assignee user name.
ThreatStream.Domain.ThreatBulletin.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.Domain.ThreatBulletin.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.ThreatBulletin.association_info.from_id	String	The ID from which the association info is related.
ThreatStream.Domain.ThreatBulletin.body_content_type	String	The body content type.
ThreatStream.Domain.ThreatBulletin.campaign	Unknown	The campaign of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.can_add_public_tags	Boolean	Whether you can add public tags.
ThreatStream.Domain.ThreatBulletin.created_ts	Date	The date the threat bulletin was created.
ThreatStream.Domain.ThreatBulletin.feed_id	Number	The feed ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.id	String	The ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.is_anonymous	Boolean	Whether the threat bulletin is anonymous.
ThreatStream.Domain.ThreatBulletin.is_cloneable	String	Whether the threat bulletin is cloneable.
ThreatStream.Domain.ThreatBulletin.is_editable	Boolean	Whether the threat bulletin is editable.
ThreatStream.Domain.ThreatBulletin.is_email	Boolean	Whether the threat bulletin is an email.
ThreatStream.Domain.ThreatBulletin.is_public	Boolean	Whether the threat bulletin is public.
ThreatStream.Domain.ThreatBulletin.modified_ts	Date	The date the threat bulletin was modified.
ThreatStream.Domain.ThreatBulletin.name	String	The name of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.original_source	String	The original source of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.original_source_id	Unknown	The original source ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.owner_org.id	String	The owner organization ID.
ThreatStream.Domain.ThreatBulletin.owner_org.name	String	The owner organization name.
ThreatStream.Domain.ThreatBulletin.owner_org.resource_uri	String	The owner organization URI.
ThreatStream.Domain.ThreatBulletin.owner_org_id	Number	The ID of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_org_name	String	The name of the owner organization.
ThreatStream.Domain.ThreatBulletin.owner_user.avatar_s3_url	Unknown	The URL of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.can_share_intelligence	Boolean	Whether you can share intelligence.
ThreatStream.Domain.ThreatBulletin.owner_user.email	String	The email of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.id	String	The ID of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user.is_active	Boolean	Whether the owner user is active.
ThreatStream.Domain.ThreatBulletin.owner_user.is_readonly	Boolean	Whether the owner user has read-only permission.
ThreatStream.Domain.ThreatBulletin.owner_user.must_change_password	Boolean	Whether the owner user must change the password.
ThreatStream.Domain.ThreatBulletin.owner_user.name	String	The owner user name.
ThreatStream.Domain.ThreatBulletin.owner_user.nickname	String	The owner user nickname.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.id	String	The ID of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.name	String	The name of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.organization.resource_uri	String	The resource URI of the owner user organization.
ThreatStream.Domain.ThreatBulletin.owner_user.resource_uri	String	The resource URI of the owner user.
ThreatStream.Domain.ThreatBulletin.owner_user_id	Number	The owner user ID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.owner_user_name	String	The owner user name of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.parent	Unknown	The parent of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.published_ts	Unknown	The date the threat bulletin was published.
ThreatStream.Domain.ThreatBulletin.resource_uri	String	The resource URI of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.source	Unknown	The source of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.source_created	Unknown	The date the source was created.
ThreatStream.Domain.ThreatBulletin.source_modified	Unknown	The date the source was modified.
ThreatStream.Domain.ThreatBulletin.starred_by_me	Boolean	Whether the threat bulletin was started by me.
ThreatStream.Domain.ThreatBulletin.starred_total_count	Number	The total number of times the threat bulletin was starred.
ThreatStream.Domain.ThreatBulletin.status	String	The status of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.threat_actor	Unknown	The threat actor of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.tlp	Unknown	The TLP of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.ttp	Unknown	The TTP of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.uuid	String	The UUID of the threat bulletin.
ThreatStream.Domain.ThreatBulletin.votes.me	Unknown	The number of votes by me.
ThreatStream.Domain.ThreatBulletin.votes.total	Number	The number of total votes.
ThreatStream.Domain.ThreatBulletin.watched_by_me	Boolean	Whether the threat bulletin was watched by me.
ThreatStream.Domain.ThreatBulletin.watched_total_count	Number	The total number of watchers.
ThreatStream.Domain.TTP.assignee_user	Unknown	The assignee user of the TTP.
ThreatStream.Domain.TTP.association_info.comment	Unknown	The comment in the association info of the TTP.
ThreatStream.Domain.TTP.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.TTP.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.Domain.TTP.can_add_public_tags	Boolean	Whether you can add public tags to the TTP.
ThreatStream.Domain.TTP.created_ts	Date	The date the TTP was created.
ThreatStream.Domain.TTP.feed_id	Number	The feed ID of the TTP.
ThreatStream.Domain.TTP.id	Number	The ID of the TTP.
ThreatStream.Domain.TTP.is_anonymous	Boolean	Whether the TTP was anonymous.
ThreatStream.Domain.TTP.is_cloneable	String	Whether the TTP was cloneable.
ThreatStream.Domain.TTP.is_public	Boolean	Whether the TTP is public.
ThreatStream.Domain.TTP.is_team	Boolean	Whether the TTP is a team.
ThreatStream.Domain.TTP.modified_ts	Date	The date the TTP was modified.
ThreatStream.Domain.TTP.name	String	The name of the TTP.
ThreatStream.Domain.TTP.organization_id	Number	The organization ID of the TTP.
ThreatStream.Domain.TTP.owner_user_id	Number	The owner user ID of the TTP.
ThreatStream.Domain.TTP.primary_motivation	Unknown	The primary motivation of the TTP.
ThreatStream.Domain.TTP.publication_status	String	The publication status of the TTP.
ThreatStream.Domain.TTP.published_ts	Date	The date the TTP was published.
ThreatStream.Domain.TTP.resource_level	Unknown	The resource level of the TTP.
ThreatStream.Domain.TTP.resource_uri	String	The resource URI of the TTP.
ThreatStream.Domain.TTP.source_created	Unknown	The date the source was created.
ThreatStream.Domain.TTP.source_modified	Unknown	The date the source was modified.
ThreatStream.Domain.TTP.start_date	Unknown	The start date.
ThreatStream.Domain.TTP.tags	String	The tags of the threat indicator.
ThreatStream.Domain.TTP.tags_v2.id	String	The ID of the tag.
ThreatStream.Domain.TTP.tags_v2.name	String	The name of the tag.
ThreatStream.Domain.TTP.tlp	String	The TLP of the TTP.
ThreatStream.Domain.TTP.uuid	String	The UUID of the TTP.
ThreatStream.Domain.Vulnerability.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.Domain.Vulnerability.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.Domain.Vulnerability.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.Vulnerability.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.Domain.Vulnerability.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.Domain.Vulnerability.circles.id	String	The ID of the circle.
ThreatStream.Domain.Vulnerability.circles.name	String	The name of the circle.
ThreatStream.Domain.Vulnerability.circles.resource_uri	String	The resource URI of the circle.
ThreatStream.Domain.Vulnerability.created_ts	Date	The date the vulnerability was created.
ThreatStream.Domain.Vulnerability.feed_id	Number	The feed ID of the vulnerability.
ThreatStream.Domain.Vulnerability.id	Number	The ID of the vulnerability.
ThreatStream.Domain.Vulnerability.is_anonymous	Boolean	Whether the vulnerability is anonymous.
ThreatStream.Domain.Vulnerability.is_cloneable	String	Whether the vulnerability is cloneable.
ThreatStream.Domain.Vulnerability.is_public	Boolean	Whether the vulnerability is public.
ThreatStream.Domain.Vulnerability.is_system	Boolean	Whether the vulnerability is in the system.
ThreatStream.Domain.Vulnerability.modified_ts	Date	The date the vulnerability was modified.
ThreatStream.Domain.Vulnerability.name	String	The name of the vulnerability.
ThreatStream.Domain.Vulnerability.organization_id	Number	The organization ID of the vulnerability.
ThreatStream.Domain.Vulnerability.owner_user_id	Unknown	The owner user ID of the vulnerability.
ThreatStream.Domain.Vulnerability.publication_status	String	The publication status of the vulnerability.
ThreatStream.Domain.Vulnerability.published_ts	Date	The date the vulnerability was published.
ThreatStream.Domain.Vulnerability.resource_uri	String	The resource URI of the vulnerability.
ThreatStream.Domain.Vulnerability.source	String	The source of the vulnerability.
ThreatStream.Domain.Vulnerability.source_created	Unknown	The feed ID of the vulnerability.
ThreatStream.Domain.Vulnerability.source_modified	Unknown	Whether the source was modified.
ThreatStream.Domain.Vulnerability.tags	String	The tags of the vulnerability.
ThreatStream.Domain.Vulnerability.tags_v2.id	String	The ID of the tag.
ThreatStream.Domain.Vulnerability.tags_v2.name	String	The name of the tag.
ThreatStream.Domain.Vulnerability.tlp	String	The TLP of the vulnerability.
ThreatStream.Domain.Vulnerability.update_id	Number	The update ID of the vulnerability.
ThreatStream.Domain.Vulnerability.uuid	String	The UUID of the vulnerability.
ThreatStream.Domain.Campaign.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.Domain.Campaign.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.Domain.Campaign.association_info.created	Date	The date the association info was created.
ThreatStream.Domain.Campaign.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.Domain.Campaign.can_add_public_tags	Boolean	Whether you can add public tags to the campaign.
ThreatStream.Domain.Campaign.created_ts	Date	The date the campaign was created.
ThreatStream.Domain.Campaign.end_date	Unknown	The end date of the campaign.
ThreatStream.Domain.Campaign.feed_id	Number	The feed ID of the campaign.
ThreatStream.Domain.Campaign.id	Number	The ID of the campaign.
ThreatStream.Domain.Campaign.is_anonymous	Boolean	Whether the campaign is anonymous.
ThreatStream.Domain.Campaign.is_cloneable	String	Whether the campaign is cloneable.
ThreatStream.Domain.Campaign.is_public	Boolean	Whether the campaign is public.
ThreatStream.Domain.Campaign.modified_ts	Date	The date the campaign was modified.
ThreatStream.Domain.Campaign.name	String	The name of the campaign.
ThreatStream.Domain.Campaign.objective	Unknown	The objective of the campaign.
ThreatStream.Domain.Campaign.organization_id	Number	The organization ID of the campaign.
ThreatStream.Domain.Campaign.owner_user_id	Number	The owner user ID of the campaign.
ThreatStream.Domain.Campaign.publication_status	String	The publication status of the campaign.
ThreatStream.Domain.Campaign.published_ts	Unknown	The date the campaign was published.
ThreatStream.Domain.Campaign.resource_uri	String	The resource URI of the campaign.
ThreatStream.Domain.Campaign.source_created	Date	The date the campaign was created.
ThreatStream.Domain.Campaign.source_modified	Date	Whether the source was modified.
ThreatStream.Domain.Campaign.start_date	Unknown	The start date of the campaign.
ThreatStream.Domain.Campaign.status.display_name	String	The display name of the status.
ThreatStream.Domain.Campaign.status.id	Number	The ID of the status of the campaign.
ThreatStream.Domain.Campaign.status.resource_uri	String	The resource URI of the status of the campaign.
ThreatStream.Domain.Campaign.tlp	String	The TLP of the campaign.
ThreatStream.Domain.Campaign.uuid	String	The UUID of the campaign.

Command example

!domain domain=y.gp threat_model_association=True

Context Example

{

"DBotScore": {

"Indicator": "y.gp",

"Reliability": "B - Usually reliable",

"Score": 2,

"Type": "domain",

"Vendor": "Anomali ThreatStream v3 May"

},

"Domain": {

"CreationDate": "2021-03-31T10:17:13.553Z",

"DNS": "1.1.1.1",

"Geo": {

"Country": "DE",

"Location": "51.2993,9.491"

},

"Name": "y.gp",

"Organization": "Hetzner Online GmbH",

"Relationships": [

{

"EntityA": "y.gp",

"EntityAType": "Domain",

"EntityB": "1.1.1.1",

"EntityBType": "IP",

"Relationship": "resolved-from"

}

],

"Tags": [

"malware"

],

"ThreatTypes": [

{

"threatcategory": "malware",

"threatcategoryconfidence": null

}

],

"TrafficLightProtocol": "amber",

"UpdatedDate": "2021-03-31T10:17:56.207Z",

"WHOIS": {

"CreationDate": "2021-03-31T10:17:13.553Z",

"UpdatedDate": "2021-03-31T10:17:56.207Z"

}

},

"ThreatStream": {

"Domain": {

"ASN": "24940",

"Actor": [],

"Address": "y.gp",

"Campaign": [],

"Confidence": 50,

"Country": "DE",

"IType": "mal_domain",

"Modified": "2021-03-31T10:17:56.207Z",

"Organization": "Hetzner Online GmbH",

"Severity": "very-high",

"Signature": [],

"Source": "Analyst",

"Status": "active",

"TTP": [],

"Tags": [

"malware"

],

"ThreatBulletin": [],

"Type": "domain",

"Vulnerability": []

}

}

}

Human Readable Output

Domain reputation for: y.gp

ASN	Address	Confidence	Country	IType	Modified	Organization	Severity	Source	Status	Tags	Type
24940	y.gp	50	DE	mal_domain	2021-03-31T10:17:56.207Z	Hetzner Online GmbH	very-high	Analyst	active	malware	domain

Actor details:

No entries.

Signature details:

No entries.

ThreatBulletin details:

No entries.

TTP details:

No entries.

Vulnerability details:

No entries.

Campaign details:

No entries.

file

---

Checks the reputation of the given hash of the file.

Base Command

file

Input

Argument Name	Description	Required
file	The hash of file to check.	Required
threshold	If the confidence is greater than the threshold the hash of the file is considered malicious, otherwise it is considered good. This argument overrides the default file threshold defined as a parameter.	Optional
include_inactive	Whether to include results with an inactive status. Possible values are: True, False.	Optional
threat_model_association	Enhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.	Optional

Context Output

Path	Type	Description
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Malicious.Vendor	String	The vendor that reported the indicator as malicious.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
ThreatStream.File.Severity	String	The indicator severity ("very-high", "high", "medium", "low").
ThreatStream.File.Confidence	String	The observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.File.Status	String	The status assigned to the indicator.
ThreatStream.File.Type	String	The indicator type.
ThreatStream.File.MD5	String	The MD5 hash of the indicator.
ThreatStream.File.SHA1	String	The SHA1 hash of the indicator.
ThreatStream.File.SHA256	String	The SHA256 hash of the indicator.
ThreatStream.File.SHA512	String	The SHA512 hash of the indicator.
ThreatStream.File.Modified	String	The date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.File.Source	String	The indicator source.
ThreatStream.File.Tags	Unknown	Tags assigned to the file.
ThreatStream.File.IType	String	The itype of the indicator associated with the specified model.
File.Tags	Unknown	List of file tags.
File.ThreatTypes	Unknown	Threat types associated with the file.
ThreatStream.File.Actor.assignee_user	Unknown	The assignee user of the threat actor.
ThreatStream.File.Actor.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.File.Actor.association_info.created	Date	The date the association info was created.
ThreatStream.File.Actor.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.File.Actor.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.File.Actor.created_ts	Date	The date the threat actor was created.
ThreatStream.File.Actor.feed_id	Number	The feed ID of the threat actor.
ThreatStream.File.Actor.id	Number	The ID of the threat actor.
ThreatStream.File.Actor.is_anonymous	Boolean	Whether the threat actor is anonymous.
ThreatStream.File.Actor.is_cloneable	String	Whether the threat actor is cloneable.
ThreatStream.File.Actor.is_public	Boolean	Whether the threat actor is public.
ThreatStream.File.Actor.is_team	Boolean	Whether the threat actor is a team.
ThreatStream.File.Actor.modified_ts	Date	The date the threat actor was modified.
ThreatStream.File.Actor.name	String	The name of the threat actor.
ThreatStream.File.Actor.organization_id	Number	The organization ID of the threat actor.
ThreatStream.File.Actor.owner_user_id	Number	The owner user ID of the threat actor.
ThreatStream.File.Actor.primary_motivation	Unknown	The primary motivation of the threat actor.
ThreatStream.File.Actor.publication_status	String	The publication status of the threat actor.
ThreatStream.File.Actor.published_ts	Date	The date the threat actor was published.
ThreatStream.File.Actor.resource_level	Unknown	The resource level of the threat actor.
ThreatStream.File.Actor.resource_uri	String	The resource URI of the threat actor.
ThreatStream.File.Actor.source_created	Unknown	The date the source was created.
ThreatStream.File.Actor.source_modified	Unknown	The date the source was modified.
ThreatStream.File.Actor.start_date	Unknown	The start date.
ThreatStream.File.Actor.tags	String	The tags of the threat indicator.
ThreatStream.File.Actor.tags_v2.id	String	The ID of the tag.
ThreatStream.File.Actor.tags_v2.name	String	The name of the tag.
ThreatStream.File.Actor.tlp	String	The TLP of the threat actor.
ThreatStream.File.Actor.uuid	String	The UUID of the threat actor.
ThreatStream.File.Signature.assignee_user	Unknown	The assignee user of the signature.
ThreatStream.File.Signature.association_info.comment	Unknown	The comment in the association info of the signature.
ThreatStream.File.Signature.association_info.created	Date	The date the association info was created.
ThreatStream.File.Signature.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.File.Signature.can_add_public_tags	Boolean	Whether you can add public tags to the signature.
ThreatStream.File.Signature.created_ts	Date	The date the signature was created.
ThreatStream.File.Signature.feed_id	Number	The feed ID of the signature.
ThreatStream.File.Signature.id	Number	The ID of the signature.
ThreatStream.File.Signature.is_anonymous	Boolean	Whether the signature is anonymous.
ThreatStream.File.Signature.is_cloneable	String	Whether the signature is cloneable.
ThreatStream.File.Signature.is_public	Boolean	Whether the signature is public.
ThreatStream.File.Signature.is_team	Boolean	Whether the signature is a team signature.
ThreatStream.File.Signature.modified_ts	Date	The date the signature was modified.
ThreatStream.File.Signature.name	String	The name of the signature.
ThreatStream.File.Signature.organization_id	Number	The organization ID of the signature.
ThreatStream.File.Signature.owner_user_id	Number	The owner user ID of the signature.
ThreatStream.File.Signature.primary_motivation	Unknown	The primary motivation of the signature.
ThreatStream.File.Signature.publication_status	String	The publication status of the signature.
ThreatStream.File.Signature.published_ts	Date	The date the signature was published.
ThreatStream.File.Signature.resource_level	Unknown	The resource level of the signature.
ThreatStream.File.Signature.resource_uri	String	The resource URI of the signature.
ThreatStream.File.Signature.source_created	Unknown	The date the source was created.
ThreatStream.File.Signature.source_modified	Unknown	The date the source was modified.
ThreatStream.File.Signature.start_date	Unknown	The start date.
ThreatStream.File.Signature.tags	String	The tags of the threat indicator.
ThreatStream.File.Signature.tags_v2.id	String	The ID of the tag.
ThreatStream.File.Signature.tags_v2.name	String	The name of the tag.
ThreatStream.File.Signature.tlp	String	The TLP of the signature.
ThreatStream.File.Signature.uuid	String	The UUID of the signature.
ThreatStream.File.ThreatBulletin.all_circles_visible	Boolean	Whether all of the circles are visible.
ThreatStream.File.ThreatBulletin.assignee_org	String	The assignee organization.
ThreatStream.File.ThreatBulletin.assignee_org_id	String	The assignee organization ID.
ThreatStream.File.ThreatBulletin.assignee_org_name	String	The assignee organization name.
ThreatStream.File.ThreatBulletin.assignee_user	String	The assignee user.
ThreatStream.File.ThreatBulletin.assignee_user_id	String	The assignee user ID.
ThreatStream.File.ThreatBulletin.assignee_user_name	Unknown	The assignee user name.
ThreatStream.File.ThreatBulletin.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.File.ThreatBulletin.association_info.created	Date	The date the association info was created.
ThreatStream.File.ThreatBulletin.association_info.from_id	String	The ID from which the association info is related.
ThreatStream.File.ThreatBulletin.body_content_type	String	The body content type.
ThreatStream.File.ThreatBulletin.campaign	Unknown	The campaign of the threat bulletin.
ThreatStream.File.ThreatBulletin.can_add_public_tags	Boolean	Whether you can add public tags.
ThreatStream.File.ThreatBulletin.created_ts	Date	The date the threat bulletin was created.
ThreatStream.File.ThreatBulletin.feed_id	Number	The feed ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.id	String	The ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.is_anonymous	Boolean	Whether the threat bulletin is anonymous.
ThreatStream.File.ThreatBulletin.is_cloneable	String	Whether the threat bulletin is cloneable.
ThreatStream.File.ThreatBulletin.is_editable	Boolean	Whether the threat bulletin is editable.
ThreatStream.File.ThreatBulletin.is_email	Boolean	Whether the threat bulletin is an email.
ThreatStream.File.ThreatBulletin.is_public	Boolean	Whether the threat bulletin is public.
ThreatStream.File.ThreatBulletin.modified_ts	Date	The date the threat bulletin was modified.
ThreatStream.File.ThreatBulletin.name	String	The name of the threat bulletin.
ThreatStream.File.ThreatBulletin.original_source	String	The original source of the threat bulletin.
ThreatStream.File.ThreatBulletin.original_source_id	Unknown	The original source ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.owner_org.id	String	The owner organization ID.
ThreatStream.File.ThreatBulletin.owner_org.name	String	The owner organization name.
ThreatStream.File.ThreatBulletin.owner_org.resource_uri	String	The owner organization URI.
ThreatStream.File.ThreatBulletin.owner_org_id	Number	The ID of the owner user.
ThreatStream.File.ThreatBulletin.owner_org_name	String	The name of the owner organization.
ThreatStream.File.ThreatBulletin.owner_user.avatar_s3_url	Unknown	The URL of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.can_share_intelligence	Boolean	Whether you can share intelligence.
ThreatStream.File.ThreatBulletin.owner_user.email	String	The email of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.id	String	The ID of the owner user.
ThreatStream.File.ThreatBulletin.owner_user.is_active	Boolean	Whether the owner user is active.
ThreatStream.File.ThreatBulletin.owner_user.is_readonly	Boolean	Whether the owner user has read-only permission.
ThreatStream.File.ThreatBulletin.owner_user.must_change_password	Boolean	Whether the owner user must change the password.
ThreatStream.File.ThreatBulletin.owner_user.name	String	The owner user name.
ThreatStream.File.ThreatBulletin.owner_user.nickname	String	The owner user nickname.
ThreatStream.File.ThreatBulletin.owner_user.organization.id	String	The ID of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.organization.name	String	The name of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.organization.resource_uri	String	The resource URI of the owner user organization.
ThreatStream.File.ThreatBulletin.owner_user.resource_uri	String	The resource URI of the owner user.
ThreatStream.File.ThreatBulletin.owner_user_id	Number	The owner user ID of the threat bulletin.
ThreatStream.File.ThreatBulletin.owner_user_name	String	The owner user name of the threat bulletin.
ThreatStream.File.ThreatBulletin.parent	Unknown	The parent of the threat bulletin.
ThreatStream.File.ThreatBulletin.published_ts	Unknown	The date the threat bulletin was published.
ThreatStream.File.ThreatBulletin.resource_uri	String	The resource URI of the threat bulletin.
ThreatStream.File.ThreatBulletin.source	Unknown	The source of the threat bulletin.
ThreatStream.File.ThreatBulletin.source_created	Unknown	The date the source was created.
ThreatStream.File.ThreatBulletin.source_modified	Unknown	The date the source was modified.
ThreatStream.File.ThreatBulletin.starred_by_me	Boolean	Whether the threat bulletin was started by me.
ThreatStream.File.ThreatBulletin.starred_total_count	Number	The total number of times the threat bulletin was starred.
ThreatStream.File.ThreatBulletin.status	String	The status of the threat bulletin.
ThreatStream.File.ThreatBulletin.threat_actor	Unknown	The threat actor of the threat bulletin.
ThreatStream.File.ThreatBulletin.tlp	Unknown	The TLP of the threat bulletin.
ThreatStream.File.ThreatBulletin.ttp	Unknown	The TTP of the threat bulletin.
ThreatStream.File.ThreatBulletin.uuid	String	The UUID of the threat bulletin.
ThreatStream.File.ThreatBulletin.votes.me	Unknown	The number of votes by me.
ThreatStream.File.ThreatBulletin.votes.total	Number	The number of total votes.
ThreatStream.File.ThreatBulletin.watched_by_me	Boolean	Whether the threat bulletin was watched by me.
ThreatStream.File.ThreatBulletin.watched_total_count	Number	The total number of watchers.
ThreatStream.File.TTP.assignee_user	Unknown	The assignee user of the TTP.
ThreatStream.File.TTP.association_info.comment	Unknown	The comment in the association info of the TTP.
ThreatStream.File.TTP.association_info.created	Date	The date the association info was created.
ThreatStream.File.TTP.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.File.TTP.can_add_public_tags	Boolean	Whether you can add public tags to the TTP.
ThreatStream.File.TTP.created_ts	Date	The date the TTP was created.
ThreatStream.File.TTP.feed_id	Number	The feed ID of the TTP.
ThreatStream.File.TTP.id	Number	The ID of the TTP.
ThreatStream.File.TTP.is_anonymous	Boolean	Whether the TTP was anonymous.
ThreatStream.File.TTP.is_cloneable	String	Whether the TTP was cloneable.
ThreatStream.File.TTP.is_public	Boolean	Whether the TTP is public.
ThreatStream.File.TTP.is_team	Boolean	Whether the TTP is a team.
ThreatStream.File.TTP.modified_ts	Date	The date the TTP was modified.
ThreatStream.File.TTP.name	String	The name of the TTP.
ThreatStream.File.TTP.organization_id	Number	The organization ID of the TTP.
ThreatStream.File.TTP.owner_user_id	Number	The owner user ID of the TTP.
ThreatStream.File.TTP.primary_motivation	Unknown	The primary motivation of the TTP.
ThreatStream.File.TTP.publication_status	String	The publication status of the TTP.
ThreatStream.File.TTP.published_ts	Date	The date the TTP was published.
ThreatStream.File.TTP.resource_level	Unknown	The resource level of the TTP.
ThreatStream.File.TTP.resource_uri	String	The resource URI of the TTP.
ThreatStream.File.TTP.source_created	Unknown	The date the source was created.
ThreatStream.File.TTP.source_modified	Unknown	The date the source was modified.
ThreatStream.File.TTP.start_date	Unknown	The start date.
ThreatStream.File.TTP.tags	String	The tags of the threat indicator.
ThreatStream.File.TTP.tags_v2.id	String	The ID of the tag.
ThreatStream.File.TTP.tags_v2.name	String	The name of the tag.
ThreatStream.File.TTP.tlp	String	The TLP of the TTP.
ThreatStream.File.TTP.uuid	String	The UUID of the TTP.
ThreatStream.File.Vulnerability.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.File.Vulnerability.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.File.Vulnerability.association_info.created	Date	The date the association info was created.
ThreatStream.File.Vulnerability.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.File.Vulnerability.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.File.Vulnerability.circles.id	String	The ID of the circle.
ThreatStream.File.Vulnerability.circles.name	String	The name of the circle.
ThreatStream.File.Vulnerability.circles.resource_uri	String	The resource URI of the circle.
ThreatStream.File.Vulnerability.created_ts	Date	The date the vulnerability was created.
ThreatStream.File.Vulnerability.feed_id	Number	The feed ID of the vulnerability.
ThreatStream.File.Vulnerability.id	Number	The ID of the vulnerability.
ThreatStream.File.Vulnerability.is_anonymous	Boolean	Whether the vulnerability is anonymous.
ThreatStream.File.Vulnerability.is_cloneable	String	Whether the vulnerability is cloneable.
ThreatStream.File.Vulnerability.is_public	Boolean	Whether the vulnerability is public.
ThreatStream.File.Vulnerability.is_system	Boolean	Whether the vulnerability is in the system.
ThreatStream.File.Vulnerability.modified_ts	Date	The date the vulnerability was modified.
ThreatStream.File.Vulnerability.name	String	The name of the vulnerability.
ThreatStream.File.Vulnerability.organization_id	Number	The organization ID of the vulnerability.
ThreatStream.File.Vulnerability.owner_user_id	Unknown	The owner user ID of the vulnerability.
ThreatStream.File.Vulnerability.publication_status	String	The publication status of the vulnerability.
ThreatStream.File.Vulnerability.published_ts	Date	The date the vulnerability was published.
ThreatStream.File.Vulnerability.resource_uri	String	The resource URI of the vulnerability.
ThreatStream.File.Vulnerability.source	String	The source of the vulnerability.
ThreatStream.File.Vulnerability.source_created	Unknown	The feed ID of the vulnerability.
ThreatStream.File.Vulnerability.source_modified	Unknown	Whether the source was modified.
ThreatStream.File.Vulnerability.tags	String	The tags of the vulnerability.
ThreatStream.File.Vulnerability.tags_v2.id	String	The ID of the tag.
ThreatStream.File.Vulnerability.tags_v2.name	String	The name of the tag.
ThreatStream.File.Vulnerability.tlp	String	The TLP of the vulnerability.
ThreatStream.File.Vulnerability.update_id	Number	The update ID of the vulnerability.
ThreatStream.File.Vulnerability.uuid	String	The UUID of the vulnerability.
ThreatStream.File.Campaign.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.File.Campaign.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.File.Campaign.association_info.created	Date	The date the association info was created.
ThreatStream.File.Campaign.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.File.Campaign.can_add_public_tags	Boolean	Whether you can add public tags to the campaign.
ThreatStream.File.Campaign.created_ts	Date	The date the campaign was created.
ThreatStream.File.Campaign.end_date	Unknown	The end date of the campaign.
ThreatStream.File.Campaign.feed_id	Number	The feed ID of the campaign.
ThreatStream.File.Campaign.id	Number	The ID of the campaign.
ThreatStream.File.Campaign.is_anonymous	Boolean	Whether the campaign is anonymous.
ThreatStream.File.Campaign.is_cloneable	String	Whether the campaign is cloneable.
ThreatStream.File.Campaign.is_public	Boolean	Whether the campaign is public.
ThreatStream.File.Campaign.modified_ts	Date	The date the campaign was modified.
ThreatStream.File.Campaign.name	String	The name of the campaign.
ThreatStream.File.Campaign.objective	Unknown	The objective of the campaign.
ThreatStream.File.Campaign.organization_id	Number	The organization ID of the campaign.
ThreatStream.File.Campaign.owner_user_id	Number	The owner user ID of the campaign.
ThreatStream.File.Campaign.publication_status	String	The publication status of the campaign.
ThreatStream.File.Campaign.published_ts	Unknown	The date the campaign was published.
ThreatStream.File.Campaign.resource_uri	String	The resource URI of the campaign.
ThreatStream.File.Campaign.source_created	Date	The date the campaign was created.
ThreatStream.File.Campaign.source_modified	Date	Whether the source was modified.
ThreatStream.File.Campaign.start_date	Unknown	The start date of the campaign.
ThreatStream.File.Campaign.status.display_name	String	The display name of the status.
ThreatStream.File.Campaign.status.id	Number	The ID of the status of the campaign.
ThreatStream.File.Campaign.status.resource_uri	String	The resource URI of the status of the campaign.
ThreatStream.File.Campaign.tlp	String	The TLP of the campaign.
ThreatStream.File.Campaign.uuid	String	The UUID of the campaign.

Command example

!file file=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f threat_model_association=True

Context Example

{

"DBotScore": {

"Indicator": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",

"Reliability": "B - Usually reliable",

"Score": 2,

"Type": "file",

"Vendor": "Anomali ThreatStream v3 May"

},

"File": {

"Hashes": [

{

"type": "SHA256",

"value": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"

}

],

"Relationships": [

{

"EntityA": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",

"EntityAType": "File",

"EntityB": "Alert report",

"EntityBType": "Threat Actor",

"Relationship": "related-to"

}

],

"SHA256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",

"Tags": [

"apt"

],

"ThreatTypes": [

{

"threatcategory": "apt",

"threatcategoryconfidence": null

}

],

"TrafficLightProtocol": "red"

},

"ThreatStream": {

"File": {

"Actor": [

{

"aliases": [],

"assignee_user": null,

"association_info": [

{

"comment": null,

"created": "2022-07-11T16:26:11.530823",

"from_id": 366645476,

"sro": {}

}

],

"can_add_public_tags": true,

"circles": [],

"created_ts": "2022-04-25T03:06:21.595651",

"feed_id": 269,

"id": 47096,

"intelligence_initiatives": [],

"is_anonymous": false,

"is_cloneable": "yes",

"is_public": true,

"is_team": false,

"modified_ts": "2022-07-11T16:30:00.437522",

"name": "Alert report",

"organization_id": 17,

"owner_user_id": 327,

"primary_motivation": null,

"publication_status": "published",

"published_ts": "2022-04-25T03:06:21.481665",

"resource_level": null,

"resource_uri": "/api/v1/actor/47096/",

"source_created": null,

"source_modified": null,

"start_date": null,

"tags": [

"packetstorm",

"microsoft"

],

"tags_v2": [

{

"id": "gvp",

"name": "microsoft"

},

{

"id": "wli",

"name": "packetstorm"

}

],

"tlp": "red",

"uuid": "0db81103-6728-4051-9fe0-4022ae24cc24",

"workgroups": []

}

],

"Campaign": [],

"Confidence": 50,

"IType": "apt_md5",

"Modified": "2022-07-11T16:30:00.359Z",

"SHA256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",

"Severity": "very-high",

"Signature": [

{

"assignee_user": null,

"association_info": [

{

"comment": null,

"created": "2022-07-11T16:27:15.271832",

"from_id": 366645476,

"sro": {}

}

],

"can_add_public_tags": true,

"circles": [],

"created_ts": "2020-07-31T20:56:33.459260",

"feed_id": 155,

"id": 631,

"intelligence_initiatives": [],

"is_anonymous": false,

"is_cloneable": "yes",

"is_public": true,

"modified_ts": "2022-08-02T06:20:19.772588",

"name": "Feeds SDK 2.0: Signature Carbon Black Query test 1",

"organization_id": 39,

"owner_user_id": 64,

"publication_status": "published",

"published_ts": "2020-07-31T20:56:33.295192",

"resource_uri": "/api/v1/signature/631/",

"s_type": "Carbon Black Query",

"source_created": null,

"source_modified": null,

"tags": [

"actor_tag1"

],

"tags_v2": [

{

"id": "igh",

"name": "actor_tag1"

}

],

"tlp": "white",

"uuid": "4c0d74d9-6bd5-45c0-a288-5bc1d714eee8",

"workgroups": []

}

],

"Source": "tmalache@paloaltonetworks.com",

"Status": "active",

"TTP": [

{

"assignee_user": null,

"association_info": [

{

"comment": null,

"created": "2022-07-11T16:27:43.327492",

"from_id": 366645476,

"sro": {}

}

],

"can_add_public_tags": true,

"children": [],

"circles": [],

"created_ts": "2019-02-19T20:48:37.938265",

"feed_id": 3,

"id": 1500,

"intelligence_initiatives": [],

"is_anonymous": false,

"is_category": false,

"is_cloneable": "yes",

"is_mitre": false,

"is_public": true,

"modified_ts": "2022-08-02T06:17:07.420212",

"name": "FleaHopper TTP",

"organization_id": 4,

"owner_user_id": 7,

"publication_status": "published",

"published_ts": "2019-02-19T20:48:37.665110",

"resource_uri": "/api/v1/ttp/1500/",

"source_created": null,

"source_modified": null,

"tags": [],

"tags_v2": [],

"tlp": "red",

"uuid": null,

"workgroups": []

}

],

"Tags": [

"apt"

],

"ThreatBulletin": [],

"Type": "SHA256",

"Vulnerability": [

{

"assignee_user": null,

"association_info": [

{

"comment": null,

"created": "2022-07-11T16:16:43.125297",

"from_id": 366645476,

"sro": {}

}

],

"can_add_public_tags": true,

"circles": [

{

"id": "310",

"name": "NVD CVEs",

"resource_uri": "/api/v1/trustedcircle/310/"

}

],

"created_ts": "2022-06-28T00:14:01.266128",

"feed_id": 0,

"id": 177244,

"intelligence_initiatives": [],

"is_anonymous": false,

"is_cloneable": "yes_private_only",

"is_public": false,

"is_system": true,

"modified_ts": "2022-07-11T13:54:00",

"name": "CVE-2022-31098",

"organization_id": 1,

"owner_user_id": null,

"publication_status": "published",

"published_ts": "2022-06-27T22:15:00",

"resource_uri": "/api/v1/vulnerability/177244/",

"source": "mitre",

"source_created": null,

"source_modified": null,

"tags": [

"CWE-532"

],

"tags_v2": [

{

"id": "30h",

"name": "CWE-532"

}

],

"tlp": "white",

"update_id": 8849957,

"uuid": "9f209a42-4cd2-4405-8176-3a925c86ac03",

"workgroups": []

}

]

}

}

}

Human Readable Output

File reputation for: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

Confidence	IType	Modified	SHA256	Severity	Source	Status	Tags	Type
50	apt_md5	2022-07-11T16:30:00.359Z	275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f	very-high	tmalache@paloaltonetworks.com	active	apt	SHA256

Actor details:

name	id
Alert report	47096

Signature details:

name	id
Feeds SDK 2.0: Signature Carbon Black Query test 1	631

ThreatBulletin details:

No entries.

TTP details:

name	id
FleaHopper TTP	1500

Vulnerability details:

name	id
CVE-2022-31098	177244

Campaign details:

No entries.

threatstream-email-reputation

---

Checks the reputation of the given email address.

Base Command

threatstream-email-reputation

Input

Argument Name	Description	Required
email	The email address to check.	Required
threshold	If the confidence is greater than the threshold the email address is considered malicious, otherwise it is considered good. This argument overrides the default email threshold defined as a parameter.	Optional
include_inactive	Whether to include results with an inactive status. Possible values are: True, False.	Optional

Context Output

Path	Type	Description
DBotScore.Indicator	String	The tested indicator.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
ThreatStream.EmailReputation.Severity	String	The indicator severity ("very-high", "high", "medium", "low").
ThreatStream.EmailReputation.Confidence	String	The observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.EmailReputation.Status	String	The status assigned to the indicator.
ThreatStream.EmailReputation.Type	String	The indicator type.
ThreatStream.EmailReputation.Email	String	The indicator email address.
ThreatStream.EmailReputation.Source	String	The indicator source.
ThreatStream.EmailReputation.Modified	String	The date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.EmailReputation.Tags	Unknown	Tags assigned to the email.

Command Example

!threatstream-email-reputation email=egov@ac.in

Context Example

{

"DBotScore": {

"Indicator": "egov@ac.in",

"Reliability": "B - Usually reliable",

"Score": 3,

"Type": "email",

"Vendor": "Anomali ThreatStream v3"

},

"Email": {

"Address": "egov@ac.in"

},

"ThreatStream": {

"EmailReputation": {

"Confidence": 10000,

"Email": "egov@ac.in",

"Modified": "2021-08-01T10:35:53.484Z",

"Severity": "high",

"Source": "Analyst",

"Status": "active",

"Tags": [

"apt"

],

"Type": "email"

}

}

}

Human Readable Output

Email reputation for: egov@ac.in

Confidence	Email	Modified	Severity	Source	Status	Tags	Type
10000	egov@ac.in	2021-08-01T10:35:53.484Z	high	Analyst	active	apt	email

threatstream-get-passive-dns

---

Returns enrichment data for Domain or IP for available observables.

Base Command

threatstream-get-passive-dns

Input

Argument Name	Description	Required
type	The type of passive DNS search ("ip", "domain"). Possible values are: ip, domain. Default is ip.	Required
value	Possible values are "IP" or "Domain".	Required
limit	The maximum number of results to return. Default is 50.	Optional

Context Output

Path	Type	Description
ThreatStream.PassiveDNS.Domain	String	The domain value.
ThreatStream.PassiveDNS.Ip	String	The IP value.
ThreatStream.PassiveDNS.Rrtype	String	The Rrtype value.
ThreatStream.PassiveDNS.Source	String	The source value.
ThreatStream.PassiveDNS.FirstSeen	String	The first seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time, in UTC time.
ThreatStream.PassiveDNS.LastSeen	String	The last seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.

Command Example

!threatstream-get-passive-dns type="domain" value="y.gp" limit="1"

Context Example

{

"ThreatStream": {

"PassiveDNS": [

{

"Domain": "y.gp",

"FirstSeen": "2015-07-20 02:33:47",

"Ip": "78.78.78.67",

"LastSeen": "2015-12-19 06:44:35",

"Rrtype": "A",

"Source": "Anomali Labs"

}

]

}

}

Human Readable Output

Passive DNS enrichment data for: y.gp

Domain	FirstSeen	Ip	LastSeen	Rrtype	Source
y.gp	2015-07-20 02:33:47	78.78.78.67	2015-12-19 06:44:35	A	Anomali Labs

threatstream-import-indicator-with-approval

---

Imports indicators (observables) into ThreatStream. The imported data must be approved using the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL.

Base Command

threatstream-import-indicator-with-approval

Input

Argument Name	Description	Required
confidence	The observable certainty level of a reported indicator type. Default is 50.	Optional
classification	Whether the indicator data is public or private to the organization. Possible values are: private, public. Default is private.	Optional
threat_type	Type of threat associated with the imported observables. Can be "adware", "anomalous", "anonymization", "apt", "bot", "brute", "c2", "compromised", "crypto", "data_leakage", "ddos", "dyn_dns", "exfil", "exploit", "hack_tool", "i2p", "informational", "malware", "p2p", "parked", "phish", "scan", "sinkhole", "spam", "suppress", "suspicious", "tor", or "vps". Possible values are: adware, anomalous, anonymization, apt, bot, brute, c2, compromised, crypto, data_leakage, ddos, dyn_dns, exfil, exploit, hack_tool, i2p, informational, malware, p2p, parked, phish, scan, sinkhole, spam, suppress, suspicious, tor, vps. Default is exploit.	Optional
severity	The potential impact of the indicator type with which the observable is believed to be associated. Can be "low", "medium", "high", or "very-high". Possible values are: low, medium, high, very-high. Default is low.	Optional
import_type	The import type of the indicator. Can be "datatext", "file-id", or "url". Possible values are: datatext, file-id, url.	Required
import_value	The source of imported data. Can be one of the following: url, datatext of file-id of uploaded file to the War Room. Supported file types for file-id are: CSV, HTML, IOC, JSON, PDF, TXT.	Required
ip_mapping	Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported IP-type observable when an explicit itype is not specified for it.	Optional
domain_mapping	Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported domain-type observable when an explicit itype is not specified for it.	Optional
url_mapping	Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported URL-type observable when an explicit itype is not specified for it.	Optional
email_mapping	Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported email-type observable when an explicit itype is not specified for it.	Optional
md5_mapping	Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported MD5-type observable when an explicit itype is not specified for it.	Optional

Context Output

There is no context output for this command.

Command Example

!threatstream-import-indicator-with-approval import_type=datatext import_value=78.78.78.67

Context Example

{

"ThreatStream": {

"Import": {

"ImportID": "36118"

}

}

}

Human Readable Output

The data was imported successfully. The ID of imported job is: 36118

threatstream-import-indicator-without-approval

---

Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API.

Base Command

threatstream-import-indicator-without-approval

Input

Argument Name	Description	Required
confidence	The observable certainty level of a reported indicator type. Default is 50.	Optional
source_confidence_weight	To use your specified confidence entirely and not re-assess the value using machine learning algorithms, set sourceconfidence weight to 100.	Optional
expiration_ts	The time stamp when intelligence will expire on ThreatStream, in ISO format. For example, 2020-12-24T00:00:00.	Optional
severity	The severity to assign to the observable when it is imported. Can be "low", "medium", "high" , or "very-high". Possible values are: low, medium, high, very-high.	Optional
tags	A comma-separated list of tags. For example, tag1,tag2.	Optional
trustedcircles	A comma-separated list of trusted circle IDs with which threat data should be shared.	Optional
classification	Denotes whether the indicator data is public or private to the organization. Possible values are: private, public.	Required
allow_unresolved	Whether unresolved domain observables are included in the file will be accepted as valid in ThreatStream and imported. Possible values are: yes, no.	Optional
file_id	The entry ID of a file (containing a JSON with an "objects" array and "meta" maps) that is uploaded to the War Room.	Required

Context Output

There is no context output for this command.

Command Example

!threatstream-import-indicator-without-approval classification=private file_id=2761@3c9bd2a0-9eac-465b-8799-459df4997b2d

Human Readable Output

The data was imported successfully.

threatstream-get-model-list

---

Returns a list of threat models.

Base Command

threatstream-get-model-list

Input

Argument Name	Description	Required
model	The threat model of the returned list. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.	Required
limit	Limits the model size list. Specifying limit=0 returns up to a maximum of 1000 models. For limit=0, the output is not set in the context. Default is 50.	Optional

Context Output

Path	Type	Description
ThreatStream.List.Type	String	The threat model type.
ThreatStream.List.Name	String	The threat model name.
ThreatStream.List.ID	String	The threat model ID.
ThreatStream.List.CreatedTime	String	The date and time of threat model creation. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time in UTC time.

Command Example

!threatstream-get-model-list model=actor limit=10

Context Example

{

"ThreatStream": {

"List": [

{

"CreatedTime": "2019-02-19T16:42:00.933984",

"ID": 1,

"Name": "Fleahopper Actor",

"Type": "Actor"

},

{

"CreatedTime": "2019-08-24T02:47:29.204380",

"ID": 10158,

"Name": "report actor 1",

"Type": "Actor"

},

{

"CreatedTime": "2019-08-28T16:35:39.316135",

"ID": 10159,

"Name": "report actor 1",

"Type": "Actor"

},

{

"CreatedTime": "2020-10-14T12:28:54.937276",

"ID": 10909,

"Name": "MANDRA",

"Type": "Actor"

},

{

"CreatedTime": "2021-09-14T13:37:02.111599",

"ID": 26769,

"Name": "New_Created_Actor",

"Type": "Actor"

}

]

}

}

Human Readable Output

List of Actors

CreatedTime	ID	Name	Type
2019-02-19T16:42:00.933984	1	Fleahopper Actor	Actor
2019-08-24T02:47:29.204380	10158	report actor 1	Actor
2019-08-28T16:35:39.316135	10159	report actor 1	Actor
2020-10-14T12:28:54.937276	10909	MANDRA	Actor
2021-09-14T13:37:02.111599	26769	New_Created_Actor	Actor

threatstream-get-model-description

---

Returns an HTML file with a description of the threat model.

Base Command

threatstream-get-model-description

Input

Argument Name	Description	Required
model	The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.	Required
id	The threat model ID.	Required

Context Output

Path	Type	Description
File.Name	String	The file name of the model description.
File.EntryID	String	The entry ID of the model description.

Command Example

!threatstream-get-model-description model=actor id=1

Context Example

{

"File": {

"EntryID": "3171@3c9bd2a0-9eac-465b-8799-459df4997b2d",

"Extension": "html",

"Info": "text/html; charset=utf-8",

"MD5": "18d7610f85c1216e78c59cbde5c470d9",

"Name": "actor_1.html",

"SHA1": "c778f72fd7799108db427f632ca6b2bb07c9bde4",

"SHA256": "6d06bdc613490216373e2b189c8d41143974c7a128da26e8fc4ba4f45a7e718b",

"SHA512": "989b0ae32b61b3b5a7ea1c3e629b50f07e7086310f8e4057ec046b368e55fc82cae873bd81eada657d827c96c71253b6ba3688561844ce983cdc5019d9666aa4",

"SSDeep": "48:32u8P32apgpIph9/gldn2++TnlCC4i72gSmB2rXpzNZx:32tuapgpCglM++TCE2gSN/",

"Size": 1868,

"Type": "ASCII text, with very long lines, with no line terminators"

}

}

Human Readable Output

threatstream-get-indicators-by-model

---

Returns a list of indicators associated with the specified model and ID of the model.

Base Command

threatstream-get-indicators-by-model

Input

Argument Name	Description	Required
model	The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, signature, ttp, vulnerability, tipreport.	Required
id	The model ID.	Required
limit	The maximum number of results to return. Default is 20.	Optional

Context Output

Path	Type	Description
ThreatStream.Model.ModelType	String	The threat model type.
ThreatStream.Model.ModelID	String	The threat model ID.
ThreatStream.Model.Indicators.Value	String	The value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ID	String	The ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IType	String	The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity	String	The indicator severity associated with the specified model.
ThreatStream.Model.Indicators.Confidence	String	The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country	String	The country of the indicator associated with the specified model
ThreatStream.Model.Indicators.Organization	String	The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN	String	The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status	String	The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags	String	The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified	String	The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source	String	The indicator source.
ThreatStream.Model.Indicators.Type	String	The indicator type.

Command Example

!threatstream-get-indicators-by-model id=731 model=incident

Context Example

{

"ThreatStream": {

"Model": {

"Indicators": [

{

"ASN": "",

"Confidence": 50,

"Country": null,

"ID": 181481953,

"IType": "mal_email",

"Modified": "2021-03-25T13:27:58.922Z",

"Organization": "",

"Severity": "low",

"Source": "Analyst",

"Status": "inactive",

"Tags": "tag-approved",

"Type": "email",

"Value": "testemail123@test.com"

}

],

"ModelID": "731",

"ModelType": "Incident"

}

}

}

Human Readable Output

Indicators list for Threat Model Incident with id 731

ASN	Confidence	Country	ID	IType	Modified	Organization	Severity	Source	Status	Tags	Type	Value
	50		181481953	mal_email	2021-03-25T13:27:58.922Z		low	Analyst	inactive	tag-approved	email	testemail123@test.com

threatstream-submit-to-sandbox

---

Submits a file or URL to the ThreatStream-hosted sandbox for detonation.

Base Command

threatstream-submit-to-sandbox

Input

Argument Name	Description	Required
submission_classification	Classification of the Sandbox submission. Can be "private" or "public". Possible values are: private, public. Default is private.	Optional
report_platform	The platform on which the submitted URL or file is run. To obtain a list supported platforms run the threatstream-supported-platforms command. Can be "WINDOWS7", or "WINDOWSXP". Possible values are: WINDOWS7, WINDOWSXP. Default is WINDOWS7.	Optional
submission_type	The detonation type. Can be "file" or "url". Possible values are: file, url. Default is file.	Required
submission_value	The submission value. Possible values are a valid URL or a file ID that was uploaded to the War Room to detonate.	Required
premium_sandbox	Whether the premium sandbox should be used for detonation. Possible values are: false, true. Default is false.	Optional
detail	A comma-separated list of additional details for the indicator. This information is displayed in the Tag column of the ThreatStream UI.	Optional
import_indicators	If you want to initiate an import job for observables discovered during detonation, set this value to true. Default value is true.	Optional

Context Output

Path	Type	Description
ThreatStream.Analysis.ReportID	String	The report ID submitted to the sandbox.
ThreatStream.Analysis.Status	String	The analysis status.
ThreatStream.Analysis.Platform	String	The platform of the submission submitted to the sandbox.

Command Example

!threatstream-submit-to-sandbox submission_classification="private" report_platform="WINDOWS7" submission_type="file" submission_value="1711@3c9bd2a0-9eac-465b-8799-459df4997b2d" premium_sandbox="false"

Context Example

{

"ThreatStream": {

"Analysis": {

"Platform": "WINDOWS7",

"ReportID": 12418,

"Status": "processing"

}

}

}

Human Readable Output

The submission info for 1711@3c9bd2a0-9eac-465b-8799-459df4997b2d

Platform	ReportID	Status
WINDOWS7	12418	processing

threatstream-get-analysis-status

---

Returns the current status of the report submitted to the sandbox. The report ID is returned from the threatstream-submit-to-sandbox command.

Base Command

threatstream-get-analysis-status

Input

Argument Name	Description	Required
report_id	The report ID to check the status.	Required

Context Output

Path	Type	Description
ThreatStream.Analysis.ReportID	String	The report ID of the file or URL that was detonated in the sandbox.
ThreatStream.Analysis.Status	String	The report status of the file or URL that was detonated in the sandbox.
ThreatStream.Analysis.Platform	String	The platform used for detonation.
ThreatStream.Analysis.Verdict	String	The report verdict of the file or URL detonated in the sandbox. The verdict remains "benign" until detonation is complete.

Command Example

!threatstream-get-analysis-status report_id=12414

Context Example

{

"ThreatStream": {

"Analysis": {

"Platform": "WINDOWS7",

"ReportID": "12414",

"Status": "errors",

"Verdict": "Benign"

}

}

}

Human Readable Output

The analysis status for id 12414

Platform	ReportID	Status	Verdict
WINDOWS7	12414	errors	Benign

threatstream-analysis-report

---

Returns the report of a file or URL submitted to the sandbox.

Base Command

threatstream-analysis-report

Input

Argument Name	Description	Required
report_id	The report ID to return.	Required

Context Output

Path	Type	Description
ThreatStream.Analysis.ReportID	String	The ID of the report submitted to the sandbox.
ThreatStream.Analysis.Category	String	The report category.
ThreatStream.Analysis.Started	String	The detonation start time.
ThreatStream.Analysis.Completed	String	The detonation completion time.
ThreatStream.Analysis.Duration	Number	The duration of the detonation (in seconds).
ThreatStream.Analysis.VmName	String	The VM name.
ThreatStream.Analysis.VmID	String	The VM ID.
ThreatStream.Analysis.Network.UdpSource	String	The UDP source.
ThreatStream.Analysis.Network.UdpDestination	String	The UDP destination.
ThreatStream.Analysis.Network.UdpPort	String	The UDP port.
ThreatStream.Analysis.Network.IcmpSource	String	The ICMP source.
ThreatStream.Analysis.Network.IcmpDestination	String	The ICMP destination.
ThreatStream.Analysis.Network.IcmpPort	String	The ICMP port.
ThreatStream.Analysis.Network.TcpSource	String	The TCP source.
ThreatStream.Analysis.Network.TcpDestination	String	The TCP destination.
ThreatStream.Analysis.Network.TcpPort	String	The TCP port.
ThreatStream.Analysis.Network.HttpSource	String	The source of the HTTP address.
ThreatStream.Analysis.Network.HttpDestinaton	String	The destination of the HTTP address.
ThreatStream.Analysis.Network.HttpPort	String	The port of the HTTP address.
ThreatStream.Analysis.Network.HttpsSource	String	The source of the HTTPS address.
ThreatStream.Analysis.Network.HttpsDestinaton	String	The destination of the HTTPS address.
ThreatStream.Analysis.Network.HttpsPort	String	The port of the HTTPS address.
ThreatStream.Analysis.Network.Hosts	String	The network analysis hosts.
ThreatStream.Analysis.Verdict	String	The verdict of the sandbox detonation.

Command Example

!threatstream-analysis-report report_id="12212"

Context Example

{

"ThreatStream": {

"Analysis": {

"Category": "Url",

"Completed": "2021-08-19 06:51:52",

"Duration": 152,

"Network": [

{

"UdpDestinaton": "8.8.8.8",

"UdpPort": 53,

"UdpSource": "192.168.2.4"

},

{

"Hosts": "78.78.78.67"

}

],

"ReportID": "12212",

"Started": "2021-08-19 06:49:20",

"Verdict": "Benign",

"VmID": "",

"VmName": ""

}

}

}

Human Readable Output

Report 12212 analysis results

Category	Completed	Duration	ReportID	Started	Verdict	VmID	VmName
Url	2021-08-19 06:51:52	152	12212	2021-08-19 06:49:20	Benign

threatstream-get-indicators

---

Return filtered indicators from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.

Base Command

threatstream-get-indicators

Input

Argument Name	Description	Required
query	The Anomali Observable Search Filter Language query to filter indicator results. If a query is passed as an argument, it overrides all other arguments.	Optional
asn	The Autonomous System (AS) number associated with the indicator.	Optional
confidence	The observable certainty level of a reported indicator type. Confidence scores range from 0-100 in increasing order of confidence, and are assigned by ThreatStream based on several factors.	Optional
country	The country associated with the indicator.	Optional
created_ts	When the indicator was first seen on the ThreatStream cloud platform. The date must be specified in this format: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.	Optional
id	The unique ID for the indicator.	Optional
is_public	Whether the classification of the indicator is public. Default is "false". Possible values are: false, true.	Optional
indicator_severity	The severity assigned to the indicator by ThreatStream.	Optional
org	The registered owner (organization) of the IP address associated with the indicator.	Optional
status	The status assigned to the indicator. Can be "active", "inactive", or "falsepos". Possible values are: active, inactive, falsepos.	Optional
tags_name	The tag assigned to the indicator.	Optional
type	The type of indicator. Can be "domain", "email", "ip", "MD5", "string", or "url". Possible values are: domain, email, ip, md5, string, url.	Optional
indicator_value	The value of the indicator. .	Optional
limit	The maximum number of results to return from ThreatStream. Default is 20. Default is 20.	Optional

Context Output

Path	Type	Description
ThreatStream.Indicators.IType	String	The indicator type.
ThreatStream.Indicators.Modified	String	The date and time the indicator was last updated in ThreatStream. The date format is: YYYYMMDDThhmmss, where T denotes the start of the value
for time in UTC time.
ThreatStream.Indicators.Confidence	String	The observable certainty level of a reported indicator type.
ThreatStream.Indicators.Value	String	The indicator value.
ThreatStream.Indicators.Status	String	The indicator status.
ThreatStream.Indicators.Organization	String	The registered owner (organization) of the IP address associated with the indicator.
ThreatStream.Indicators.Country	String	The country associated with the indicator.
ThreatStream.Indicators.Tags	String	The tag assigned to the indicator.
ThreatStream.Indicators.Source	String	The indicator source.
ThreatStream.Indicators.ID	String	The indicator ID.
ThreatStream.Indicators.ASN	String	The Autonomous System (AS) number associated with the indicator.
ThreatStream.Indicators.Severity	String	The severity assigned to the indicator.

Command Example

!threatstream-get-indicators type=ip status=active limit=5

Context Example

{

"ThreatStream": {

"Indicators": [

{

"ASN": "",

"Confidence": 100,

"Country": null,

"ID": 239450621,

"IType": "apt_ip",

"Modified": "2021-05-24T16:42:09.245Z",

"Organization": "",

"Severity": "very-high",

"Source": "Analyst",

"Status": "active",

"Tags": null,

"Type": "ip",

"Value": "78.78.78.67"

},

{

"ASN": "",

"Confidence": -1,

"Country": null,

"ID": 235549247,

"IType": "apt_ip",

"Modified": "2021-04-29T16:02:17.558Z",

"Organization": "",

"Severity": "very-high",

"Source": "Analyst",

"Status": "active",

"Tags": null,

"Type": "ip",

"Value": "78.78.78.67"

}

]

}

}

Human Readable Output

The indicators results

ASN	Confidence	Country	ID	IType	Modified	Organization	Severity	Source	Status	Tags	Type	Value
	100		239450621	apt_ip	2021-05-24T16:42:09.245Z		very-high	Analyst	active		ip	78.78.78.67
	-1		235549247	apt_ip	2021-04-29T16:02:17.558Z		very-high	Analyst	active		ip	78.78.78.67

threatstream-add-tag-to-model

---

Adds tags to intelligence to filter for related entities.

Base Command

threatstream-add-tag-to-model

Input

Argument Name	Description	Required
model	The type of threat model entity to which to add the tag. Can be "actor", "campaign", "incident", "intelligence", "signature", "tipreport", "ttp", or "vulnerability". Possible values are: actor, campaign, incident, intelligence, signature, tipreport, ttp, vulnerability. Default is intelligence.	Optional
tags	A comma separated list of tags applied to the specified threat model entities or observable. .	Required
model_id	The ID of the model to which to add the tag.	Required

Context Output

There is no context output for this command.

Command Example

!threatstream-add-tag-to-model model=incident model_id=130 tags="suspicious,not valid"

Human Readable Output

Added successfully tags: ['suspicious', 'not valid'] to incident with 130

threatstream-create-model

---

Creates a threat model with the specified parameters.

Base Command

threatstream-create-model

Input

Argument Name	Description	Required
model	The type of threat model to create. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, ttp, vulnerability, tipreport.	Required
name	The name of the threat model to create.	Required
is_public	Whether the scope of threat model is visible. Possible values are: true, false. Default is false.	Optional
tlp	The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". Possible values are: red, amber, green, white. Default is red.	Optional
tags	A comma separated list of tags.	Optional
intelligence	A comma separated list of indicators IDs associated with the threat model on the ThreatStream platform.	Optional
description	The description of the threat model.	Optional

Context Output

Path	Type	Description
ThreatStream.Model.ModelType	String	The threat model type.
ThreatStream.Model.ModelID	String	The threat model ID.
ThreatStream.Model.Indicators.Value	String	The value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ID	String	The ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IType	String	The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity	String	The severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Confidence	String	The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country	String	The country of the indicator associated with the specified model
ThreatStream.Model.Indicators.Organization	String	The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN	String	The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status	String	The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags	String	The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified	String	The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source	String	The indicator source.
ThreatStream.Model.Indicators.Type	String	The indicator type.

Command Example

!threatstream-create-model model=actor name="New_Created_Actor_1" description="Description of the actor threat model" intelligence=191431508 tags="new actor,test" tlp=red

Context Example

{

"ThreatStream": {

"Model": {

"Indicators": [

{

"ASN": "",

"Confidence": 50,

"Country": null,

"ID": 191431508,

"IType": "apt_md5",

"Modified": "2021-09-13T12:40:42.596Z",

"Organization": "",

"Severity": "medium",

"Source": "TestSource",

"Status": "active",

"Tags": null,

"Type": "SHA256",

"Value": "178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1"

}

],

"ModelID": 26770,

"ModelType": "Actor"

}

}

}

Human Readable Output

Indicators list for Threat Model Actor with id 26770

ASN	Confidence	Country	ID	IType	Modified	Organization	Severity	Source	Status	Tags	Type	Value
	50		191431508	apt_md5	2021-09-13T12:40:42.596Z		medium	TestSource	active		SHA256	178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1

threatstream-update-model

---

Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overrides previous data stored in ThreatStream.

Base Command

threatstream-update-model

Input

Argument Name	Description	Required
model	The type of threat model to update. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". Possible values are: actor, campaign, incident, ttp, vulnerability, tipreport.	Required
model_id	The ID of the threat model to update.	Required
name	The name of the threat model to update.	Optional
is_public	Whether the scope of threat model is visible. Possible values are: true, false. Default is false.	Optional
tlp	The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". Possible values are: red, amber, green, white. Default is red.	Optional
tags	A comma separated list of tags.	Optional
intelligence	A comma separated list of indicator IDs associated with the threat model on the ThreatStream platform.	Optional
description	The description of the threat model.	Optional

Context Output

Path	Type	Description
ThreatStream.Model.ModelType	String	The threat model type.
ThreatStream.Model.ModelID	String	The threat model ID.
ThreatStream.Model.Indicators.Value	String	The value of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ID	String	The ID of the indicator associated with the specified model.
ThreatStream.Model.Indicators.IType	String	The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity	String	The severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Confidence	String	The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country	String	The country of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Organization	String	The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN	String	The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status	String	The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags	String	The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified	String	The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source	String	The indicator source.
ThreatStream.Model.Indicators.Type	String	The indicator type.

Command Example

!threatstream-update-model model=actor model_id=26769 intelligence=191431508 tags="updated tag,gone"

Context Example

{

"ThreatStream": {

"Model": {

"Indicators": [

{

"ASN": "",

"Confidence": 50,

"Country": null,

"ID": 191431508,

"IType": "apt_md5",

"Modified": "2021-09-13T12:40:42.596Z",

"Organization": "",

"Severity": "medium",

"Source": "TestSource",

"Status": "active",

"Tags": null,

"Type": "SHA256",

"Value": "178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1"

}

],

"ModelID": "26769",

"ModelType": "Actor"

}

}

}

Human Readable Output

Indicators list for Threat Model Actor with id 26769

ASN	Confidence	Country	ID	IType	Modified	Organization	Severity	Source	Status	Tags	Type	Value
	50		191431508	apt_md5	2021-09-13T12:40:42.596Z		medium	TestSource	active		SHA256	178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1

threatstream-supported-platforms

---

Returns a list of supported platforms for default or premium sandbox.

Base Command

threatstream-supported-platforms

Input

Argument Name	Description	Required
sandbox_type	The type of sandbox ("default" or "premium"). Possible values are: default, premium. Default is default.	Optional

Context Output

Path	Type	Description
ThreatStream.PremiumPlatforms.Name	String	The name of the supported platform for premium sandbox.
ThreatStream.PremiumPlatforms.Types	String	The type of supported submissions for premium sandbox.
ThreatStream.PremiumPlatforms.Label	String	The display name of the supported platform of premium sandbox.
ThreatStream.DefaultPlatforms.Name	String	The name of the supported platform for standard sandbox.
ThreatStream.DefaultPlatforms.Types	String	The type of the supported submissions for standard sandbox.
ThreatStream.DefaultPlatforms.Label	String	The display name of the supported platform of standard sandbox.

Command Example

!threatstream-supported-platforms sandbox_type=default

Context Example

{

"ThreatStream": {

"DefaultPlatforms": [

{

"Label": "Windows 7",

"Name": "WINDOWS7",

"Platform": "windows",

"Types": [

"file",

"url"

]

}

]

}

}

Human Readable Output

Supported platforms for default sandbox

Label	Name	Platform	Types
Windows 7	WINDOWS7	windows	file, url

url

---

Checks the reputation of the given URL.

Base Command

url

Input

Argument Name	Description	Required
url	The URL to check.	Required
threshold	If confidence is greater than the threshold the URL is considered malicious, otherwise it is considered good. This argument overrides the default URL threshold defined as a parameter.	Optional
include_inactive	Whether to include results with an inactive status. Possible values are: True, False.	Optional
threat_model_association	Enhance generic reputation commands to include additional information such as Threat Bulletins, Attach patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values are: True, False. Default is False.	Optional

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
URL.Data	String	The URL of the indicator.
URL.Malicious.Vendor	String	The vendor that reported the indicator as malicious.
ThreatStream.URL.Modified	String	The date and time the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
for time in UTC time.
ThreatStream.URL.Confidence	String	The observable certainty level of a reported indicator type. Confidence score ranges from 0-100, in increasing order of confidence.
ThreatStream.URL.Status	String	The indicator status.
ThreatStream.URL.Organization	String	The name of the business that owns the IP address associated with the indicator.
ThreatStream.URL.Address	String	The indicator URL.
ThreatStream.URL.Country	String	The country associated with the indicator.
ThreatStream.URL.Type	String	The indicator type.
ThreatStream.URL.Source	String	The indicator source.
ThreatStream.URL.Severity	String	The indicator severity ("very-high", "high", "medium", or "low").
ThreatStream.URL.Tags	Unknown	Tags assigned to the URL.
ThreatStream.URL.IType	String	The itype of the indicator associated with the specified model.
URL.Tags	Unknown	List of URL tags.
URL.ThreatTypes	Unknown	Threat types associated with the url.
ThreatStream.URL.Actor.assignee_user	Unknown	The assignee user of the threat actor.
ThreatStream.URL.Actor.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.URL.Actor.association_info.created	Date	The date the association info was created.
ThreatStream.URL.Actor.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.URL.Actor.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.URL.Actor.created_ts	Date	The date the threat actor was created.
ThreatStream.URL.Actor.feed_id	Number	The feed ID of the threat actor.
ThreatStream.URL.Actor.id	Number	The ID of the threat actor.
ThreatStream.URL.Actor.is_anonymous	Boolean	Whether the threat actor is anonymous.
ThreatStream.URL.Actor.is_cloneable	String	Whether the threat actor is cloneable.
ThreatStream.URL.Actor.is_public	Boolean	Whether the threat actor is public.
ThreatStream.URL.Actor.is_team	Boolean	Whether the threat actor is a team.
ThreatStream.URL.Actor.modified_ts	Date	The date the threat actor was modified.
ThreatStream.URL.Actor.name	String	The name of the threat actor.
ThreatStream.URL.Actor.organization_id	Number	The organization ID of the threat actor.
ThreatStream.URL.Actor.owner_user_id	Number	The owner user ID of the threat actor.
ThreatStream.URL.Actor.primary_motivation	Unknown	The primary motivation of the threat actor.
ThreatStream.URL.Actor.publication_status	String	The publication status of the threat actor.
ThreatStream.URL.Actor.published_ts	Date	The date the threat actor was published.
ThreatStream.URL.Actor.resource_level	Unknown	The resource level of the threat actor.
ThreatStream.URL.Actor.resource_uri	String	The resource URI of the threat actor.
ThreatStream.URL.Actor.source_created	Unknown	The date the source was created.
ThreatStream.URL.Actor.source_modified	Unknown	The date the source was modified.
ThreatStream.URL.Actor.start_date	Unknown	The start date.
ThreatStream.URL.Actor.tags	String	The tags of the threat indicator.
ThreatStream.URL.Actor.tags_v2.id	String	The ID of the tag.
ThreatStream.URL.Actor.tags_v2.name	String	The name of the tag.
ThreatStream.URL.Actor.tlp	String	The TLP of the threat actor.
ThreatStream.URL.Actor.uuid	String	The UUID of the threat actor.
ThreatStream.URL.Signature.assignee_user	Unknown	The assignee user of the signature.
ThreatStream.URL.Signature.association_info.comment	Unknown	The comment in the association info of the signature.
ThreatStream.URL.Signature.association_info.created	Date	The date the association info was created.
ThreatStream.URL.Signature.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.URL.Signature.can_add_public_tags	Boolean	Whether you can add public tags to the signature.
ThreatStream.URL.Signature.created_ts	Date	The date the signature was created.
ThreatStream.URL.Signature.feed_id	Number	The feed ID of the signature.
ThreatStream.URL.Signature.id	Number	The ID of the signature.
ThreatStream.URL.Signature.is_anonymous	Boolean	Whether the signature is anonymous.
ThreatStream.URL.Signature.is_cloneable	String	Whether the signature is cloneable.
ThreatStream.URL.Signature.is_public	Boolean	Whether the signature is public.
ThreatStream.URL.Signature.is_team	Boolean	Whether the signature is a team signature.
ThreatStream.URL.Signature.modified_ts	Date	The date the signature was modified.
ThreatStream.URL.Signature.name	String	The name of the signature.
ThreatStream.URL.Signature.organization_id	Number	The organization ID of the signature.
ThreatStream.URL.Signature.owner_user_id	Number	The owner user ID of the signature.
ThreatStream.URL.Signature.primary_motivation	Unknown	The primary motivation of the signature.
ThreatStream.URL.Signature.publication_status	String	The publication status of the signature.
ThreatStream.URL.Signature.published_ts	Date	The date the signature was published.
ThreatStream.URL.Signature.resource_level	Unknown	The resource level of the signature.
ThreatStream.URL.Signature.resource_uri	String	The resource URI of the signature.
ThreatStream.URL.Signature.source_created	Unknown	The date the source was created.
ThreatStream.URL.Signature.source_modified	Unknown	The date the source was modified.
ThreatStream.URL.Signature.start_date	Unknown	The start date.
ThreatStream.URL.Signature.tags	String	The tags of the threat indicator.
ThreatStream.URL.Signature.tags_v2.id	String	The ID of the tag.
ThreatStream.URL.Signature.tags_v2.name	String	The name of the tag.
ThreatStream.URL.Signature.tlp	String	The TLP of the signature.
ThreatStream.URL.Signature.uuid	String	The UUID of the signature.
ThreatStream.URL.ThreatBulletin.all_circles_visible	Boolean	Whether all of the circles are visible.
ThreatStream.URL.ThreatBulletin.assignee_org	String	The assignee organization.
ThreatStream.URL.ThreatBulletin.assignee_org_id	String	The assignee organization ID.
ThreatStream.URL.ThreatBulletin.assignee_org_name	String	The assignee organization name.
ThreatStream.URL.ThreatBulletin.assignee_user	String	The assignee user.
ThreatStream.URL.ThreatBulletin.assignee_user_id	String	The assignee user ID.
ThreatStream.URL.ThreatBulletin.assignee_user_name	Unknown	The assignee user name.
ThreatStream.URL.ThreatBulletin.association_info.comment	Unknown	The comment in the association info of the threat actor.
ThreatStream.URL.ThreatBulletin.association_info.created	Date	The date the association info was created.
ThreatStream.URL.ThreatBulletin.association_info.from_id	String	The ID from which the association info is related.
ThreatStream.URL.ThreatBulletin.body_content_type	String	The body content type.
ThreatStream.URL.ThreatBulletin.campaign	Unknown	The campaign of the threat bulletin.
ThreatStream.URL.ThreatBulletin.can_add_public_tags	Boolean	Whether you can add public tags.
ThreatStream.URL.ThreatBulletin.created_ts	Date	The date the threat bulletin was created.
ThreatStream.URL.ThreatBulletin.feed_id	Number	The feed ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.id	String	The ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.is_anonymous	Boolean	Whether the threat bulletin is anonymous.
ThreatStream.URL.ThreatBulletin.is_cloneable	String	Whether the threat bulletin is cloneable.
ThreatStream.URL.ThreatBulletin.is_editable	Boolean	Whether the threat bulletin is editable.
ThreatStream.URL.ThreatBulletin.is_email	Boolean	Whether the threat bulletin is an email.
ThreatStream.URL.ThreatBulletin.is_public	Boolean	Whether the threat bulletin is public.
ThreatStream.URL.ThreatBulletin.modified_ts	Date	The date the threat bulletin was modified.
ThreatStream.URL.ThreatBulletin.name	String	The name of the threat bulletin.
ThreatStream.URL.ThreatBulletin.original_source	String	The original source of the threat bulletin.
ThreatStream.URL.ThreatBulletin.original_source_id	Unknown	The original source ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.owner_org.id	String	The owner organization ID.
ThreatStream.URL.ThreatBulletin.owner_org.name	String	The owner organization name.
ThreatStream.URL.ThreatBulletin.owner_org.resource_uri	String	The owner organization URI.
ThreatStream.URL.ThreatBulletin.owner_org_id	Number	The ID of the owner user.
ThreatStream.URL.ThreatBulletin.owner_org_name	String	The name of the owner organization.
ThreatStream.URL.ThreatBulletin.owner_user.avatar_s3_url	Unknown	The URL of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.can_share_intelligence	Boolean	Whether you can share intelligence.
ThreatStream.URL.ThreatBulletin.owner_user.email	String	The email of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.id	String	The ID of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user.is_active	Boolean	Whether the owner user is active.
ThreatStream.URL.ThreatBulletin.owner_user.is_readonly	Boolean	Whether the owner user has read-only permission.
ThreatStream.URL.ThreatBulletin.owner_user.must_change_password	Boolean	Whether the owner user must change the password.
ThreatStream.URL.ThreatBulletin.owner_user.name	String	The owner user name.
ThreatStream.URL.ThreatBulletin.owner_user.nickname	String	The owner user nickname.
ThreatStream.URL.ThreatBulletin.owner_user.organization.id	String	The ID of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.organization.name	String	The name of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.organization.resource_uri	String	The resource URI of the owner user organization.
ThreatStream.URL.ThreatBulletin.owner_user.resource_uri	String	The resource URI of the owner user.
ThreatStream.URL.ThreatBulletin.owner_user_id	Number	The owner user ID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.owner_user_name	String	The owner user name of the threat bulletin.
ThreatStream.URL.ThreatBulletin.parent	Unknown	The parent of the threat bulletin.
ThreatStream.URL.ThreatBulletin.published_ts	Unknown	The date the threat bulletin was published.
ThreatStream.URL.ThreatBulletin.resource_uri	String	The resource URI of the threat bulletin.
ThreatStream.URL.ThreatBulletin.source	Unknown	The source of the threat bulletin.
ThreatStream.URL.ThreatBulletin.source_created	Unknown	The date the source was created.
ThreatStream.URL.ThreatBulletin.source_modified	Unknown	The date the source was modified.
ThreatStream.URL.ThreatBulletin.starred_by_me	Boolean	Whether the threat bulletin was started by me.
ThreatStream.URL.ThreatBulletin.starred_total_count	Number	The total number of times the threat bulletin was starred.
ThreatStream.URL.ThreatBulletin.status	String	The status of the threat bulletin.
ThreatStream.URL.ThreatBulletin.threat_actor	Unknown	The threat actor of the threat bulletin.
ThreatStream.URL.ThreatBulletin.tlp	Unknown	The TLP of the threat bulletin.
ThreatStream.URL.ThreatBulletin.ttp	Unknown	The TTP of the threat bulletin.
ThreatStream.URL.ThreatBulletin.uuid	String	The UUID of the threat bulletin.
ThreatStream.URL.ThreatBulletin.votes.me	Unknown	The number of votes by me.
ThreatStream.URL.ThreatBulletin.votes.total	Number	The number of total votes.
ThreatStream.URL.ThreatBulletin.watched_by_me	Boolean	Whether the threat bulletin was watched by me.
ThreatStream.URL.ThreatBulletin.watched_total_count	Number	The total number of watchers.
ThreatStream.URL.TTP.assignee_user	Unknown	The assignee user of the TTP.
ThreatStream.URL.TTP.association_info.comment	Unknown	The comment in the association info of the TTP.
ThreatStream.URL.TTP.association_info.created	Date	The date the association info was created.
ThreatStream.URL.TTP.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.URL.TTP.can_add_public_tags	Boolean	Whether you can add public tags to the TTP.
ThreatStream.URL.TTP.created_ts	Date	The date the TTP was created.
ThreatStream.URL.TTP.feed_id	Number	The feed ID of the TTP.
ThreatStream.URL.TTP.id	Number	The ID of the TTP.
ThreatStream.URL.TTP.is_anonymous	Boolean	Whether the TTP was anonymous.
ThreatStream.URL.TTP.is_cloneable	String	Whether the TTP was cloneable.
ThreatStream.URL.TTP.is_public	Boolean	Whether the TTP is public.
ThreatStream.URL.TTP.is_team	Boolean	Whether the TTP is a team.
ThreatStream.URL.TTP.modified_ts	Date	The date the TTP was modified.
ThreatStream.URL.TTP.name	String	The name of the TTP.
ThreatStream.URL.TTP.organization_id	Number	The organization ID of the TTP.
ThreatStream.URL.TTP.owner_user_id	Number	The owner user ID of the TTP.
ThreatStream.URL.TTP.primary_motivation	Unknown	The primary motivation of the TTP.
ThreatStream.URL.TTP.publication_status	String	The publication status of the TTP.
ThreatStream.URL.TTP.published_ts	Date	The date the TTP was published.
ThreatStream.URL.TTP.resource_level	Unknown	The resource level of the TTP.
ThreatStream.URL.TTP.resource_uri	String	The resource URI of the TTP.
ThreatStream.URL.TTP.source_created	Unknown	The date the source was created.
ThreatStream.URL.TTP.source_modified	Unknown	The date the source was modified.
ThreatStream.URL.TTP.start_date	Unknown	The start date.
ThreatStream.URL.TTP.tags	String	The tags of the threat indicator.
ThreatStream.URL.TTP.tags_v2.id	String	The ID of the tag.
ThreatStream.URL.TTP.tags_v2.name	String	The name of the tag.
ThreatStream.URL.TTP.tlp	String	The TLP of the TTP.
ThreatStream.URL.TTP.uuid	String	The UUID of the TTP.
ThreatStream.URL.Vulnerability.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.URL.Vulnerability.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.URL.Vulnerability.association_info.created	Date	The date the association info was created.
ThreatStream.URL.Vulnerability.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.URL.Vulnerability.can_add_public_tags	Boolean	Whether you can add public tags to the threat actor.
ThreatStream.URL.Vulnerability.circles.id	String	The ID of the circle.
ThreatStream.URL.Vulnerability.circles.name	String	The name of the circle.
ThreatStream.URL.Vulnerability.circles.resource_uri	String	The resource URI of the circle.
ThreatStream.URL.Vulnerability.created_ts	Date	The date the vulnerability was created.
ThreatStream.URL.Vulnerability.feed_id	Number	The feed ID of the vulnerability.
ThreatStream.URL.Vulnerability.id	Number	The ID of the vulnerability.
ThreatStream.URL.Vulnerability.is_anonymous	Boolean	Whether the vulnerability is anonymous.
ThreatStream.URL.Vulnerability.is_cloneable	String	Whether the vulnerability is cloneable.
ThreatStream.URL.Vulnerability.is_public	Boolean	Whether the vulnerability is public.
ThreatStream.URL.Vulnerability.is_system	Boolean	Whether the vulnerability is in the system.
ThreatStream.URL.Vulnerability.modified_ts	Date	The date the vulnerability was modified.
ThreatStream.URL.Vulnerability.name	String	The name of the vulnerability.
ThreatStream.URL.Vulnerability.organization_id	Number	The organization ID of the vulnerability.
ThreatStream.URL.Vulnerability.owner_user_id	Unknown	The owner user ID of the vulnerability.
ThreatStream.URL.Vulnerability.publication_status	String	The publication status of the vulnerability.
ThreatStream.URL.Vulnerability.published_ts	Date	The date the vulnerability was published.
ThreatStream.URL.Vulnerability.resource_uri	String	The resource URI of the vulnerability.
ThreatStream.URL.Vulnerability.source	String	The source of the vulnerability.
ThreatStream.URL.Vulnerability.source_created	Unknown	The feed ID of the vulnerability.
ThreatStream.URL.Vulnerability.source_modified	Unknown	Whether the source was modified.
ThreatStream.URL.Vulnerability.tags	String	The tags of the vulnerability.
ThreatStream.URL.Vulnerability.tags_v2.id	String	The ID of the tag.
ThreatStream.URL.Vulnerability.tags_v2.name	String	The name of the tag.
ThreatStream.URL.Vulnerability.tlp	String	The TLP of the vulnerability.
ThreatStream.URL.Vulnerability.update_id	Number	The update ID of the vulnerability.
ThreatStream.URL.Vulnerability.uuid	String	The UUID of the vulnerability.
ThreatStream.URL.Campaign.assignee_user	Unknown	The assignee user of the vulnerability.
ThreatStream.URL.Campaign.association_info.comment	Unknown	The comment in the association info of the vulnerability.
ThreatStream.URL.Campaign.association_info.created	Date	The date the association info was created.
ThreatStream.URL.Campaign.association_info.from_id	Number	The ID from which the association info is related.
ThreatStream.URL.Campaign.can_add_public_tags	Boolean	Whether you can add public tags to the campaign.
ThreatStream.URL.Campaign.created_ts	Date	The date the campaign was created.
ThreatStream.URL.Campaign.end_date	Unknown	The end date of the campaign.
ThreatStream.URL.Campaign.feed_id	Number	The feed ID of the campaign.
ThreatStream.URL.Campaign.id	Number	The ID of the campaign.
ThreatStream.URL.Campaign.is_anonymous	Boolean	Whether the campaign is anonymous.
ThreatStream.URL.Campaign.is_cloneable	String	Whether the campaign is cloneable.
ThreatStream.URL.Campaign.is_public	Boolean	Whether the campaign is public.
ThreatStream.URL.Campaign.modified_ts	Date	The date the campaign was modified.
ThreatStream.URL.Campaign.name	String	The name of the campaign.
ThreatStream.URL.Campaign.objective	Unknown	The objective of the campaign.
ThreatStream.URL.Campaign.organization_id	Number	The organization ID of the campaign.
ThreatStream.URL.Campaign.owner_user_id	Number	The owner user ID of the campaign.
ThreatStream.URL.Campaign.publication_status	String	The publication status of the campaign.
ThreatStream.URL.Campaign.published_ts	Unknown	The date the campaign was published.
ThreatStream.URL.Campaign.resource_uri	String	The resource URI of the campaign.
ThreatStream.URL.Campaign.source_created	Date	The date the campaign was created.
ThreatStream.URL.Campaign.source_modified	Date	Whether the source was modified.
ThreatStream.URL.Campaign.start_date	Unknown	The start date of the campaign.
ThreatStream.URL.Campaign.status.display_name	String	The display name of the status.
ThreatStream.URL.Campaign.status.id	Number	The ID of the status of the campaign.
ThreatStream.URL.Campaign.status.resource_uri	String	The resource URI of the status of the campaign.
ThreatStream.URL.Campaign.tlp	String	The TLP of the campaign.
ThreatStream.URL.Campaign.uuid	String	The UUID of the campaign.

Command example

!url url=http://www.ujhy1.com/ threat_model_association=True

Context Example

{

"DBotScore": {

"Indicator": "http://www.ujhy1.com/",

"Message": "No results found.",

"Reliability": "B - Usually reliable",

"Score": 0,

"Type": "url",

"Vendor": "Anomali ThreatStream v3 May"

},

"URL": {

"Data": "http://www.ujhy1.com/"

}

}

Human Readable Output

Anomali ThreatStream v3 May:

URL	Result
http://www.ujhy1.com/	Not found

Additional Considerations for this version

• Remove the default_threshold integration parameter.
• Add integration parameter for global threshold in ip, domain, file, url, and threatstream-email-reputation commands.
• Add Include inactive results checkbox in integration settings for the ability to get inactive results.

threatstream-search-intelligence

---

Returns filtered intelligence from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.

Base Command

threatstream-search-intelligence

Input

Argument Name	Description	Required
value	The value of an intelligence.	Optional
uuid	The UUID of an intelligence. When several UUIDs stated, an “OR” operator is used.	Optional
type	The type of an intelligence. Possible values are: domain, email, ip, md5, string, url.	Optional
itype	The itType of an intelligence. (e.g., apt_ip, apt_email).	Optional
status	The status of an intelligence. Possible values are: active, inactive, falsepos.	Optional
tags	The tags of an intelligence. Comma-separated list. When several tags are stated, an “OR” operator is used.	Optional
asn	The ASN of an intelligence.	Optional
confidence	The confidence of an intelligence. Input will be operator then value, i.e., “gt 65” or “lt 85”. If only a value is stated, then it must match exactly.	Optional
threat_type	The threat type of an intelligence.	Optional
is_public	Whether the intelligence is public.	Optional
query	Query that overrides all other arguments. The filter operators used for the filter language query are the symbolic form (=, <, >, and so on) and not the descriptive form (exact, lt, gt, and so on). E.g., (confidence>=90+AND+(itype="apt_ip"+OR+itype="bot_ip"+OR+itype="c2_ip")).	Optional
update_id_gt	An incrementing numeric identifier associated with each update to intelligence on ThreatStream. If specified, then it is recommended to use order_by=update_id.	Optional
order_by	How to order the results.	Optional
limit	The maximum number of results to return from ThreatStream. The maximum number of returned results is 1000. For more results, use the page and page_size arguments. Default is 50.	Optional
page	Page number to get result from. Needs to be used with page_size argument.	Optional
page_size	The page size of the returned results. Needs to be used with the page argument.	Optional

Context Output

Path	Type	Description
ThreatStream.Intelligence.source_created	String	The source from which the intelligence was created.
ThreatStream.Intelligence.status	String	The status of the intelligence.
ThreatStream.Intelligence.itype	String	The itype of the intelligence.
ThreatStream.Intelligence.expiration_ts	Date	The expiration timestamp of the intelligence.
ThreatStream.Intelligence.ip	String	The IP address of the intelligence.
ThreatStream.Intelligence.is_editable	Boolean	Whether the intelligence is editable.
ThreatStream.Intelligence.feed_id	String	The feed ID of the intelligence.
ThreatStream.Intelligence.update_id	String	The update ID of the intelligence.
ThreatStream.Intelligence.value	String	The value of the intelligence.
ThreatStream.Intelligence.is_public	Boolean	Whether the intelligence is public.
ThreatStream.Intelligence.threattype	String	The threat type of the intelligence.
ThreatStream.Intelligence.workgroups	String	The work groups of the intelligence.
ThreatStream.Intelligence.confidence	String	The confidence of the intelligence.
ThreatStream.Intelligence.uuid	String	The UUID of the intelligence.
ThreatStream.Intelligence.retina_confidence	String	The retina confidence of the intelligence.
ThreatStream.Intelligence.trusted_circle_ids	String	The trusted circleIDs of the intelligence.
ThreatStream.Intelligence.id	String	The ID of the intelligence.
ThreatStream.Intelligence.source	String	The source of the iIntelligence.
ThreatStream.Intelligence.owner_organization_id	String	The owner organization ID of the intelligence.
ThreatStream.Intelligence.import_session_id	String	The import session ID of the intelligence.
ThreatStream.Intelligence.source_modified	Boolean	Whether the the source was modified.
ThreatStream.Intelligence.type	String	The type of the intelligence.
ThreatStream.Intelligence.description	String	The description of the intelligence.
ThreatStream.Intelligence.tags	String	The tags of the intelligence.
ThreatStream.Intelligence.threatscore	String	The threat score of the intelligence.
ThreatStream.Intelligence.latitude	String	The latitude of the intelligence.
ThreatStream.Intelligence.longitude	String	The longitude of the intelligence.
ThreatStream.Intelligence.modified_ts	Date	The date the intelligence was modified.
ThreatStream.Intelligence.org	String	The organization of the intelligence.
ThreatStream.Intelligence.asn	Number	The ASN of the intelligence.
ThreatStream.Intelligence.created_ts	Date	The date the intelligence was created.
ThreatStream.Intelligence.tlp	String	The TLP of the intelligence.
ThreatStream.Intelligence.is_anonymous	Boolean	Whether the intelligence is anonymous.
ThreatStream.Intelligence.country	String	The country of the intelligence.
ThreatStream.Intelligence.source_reported_confidence	String	The confidence of the reported source.
ThreatStream.Intelligence.subtype	String	The subtype of the intelligence.
ThreatStream.Intelligence.resource_uri	String	The resource URI of the intelligence
ThreatStream.Intelligence.severity	String	The severity of the intelligence.

Command example

!threatstream-search-intelligence limit=1 status=inactive value=1.2.4.5

Context Example

{

"ThreatStream": {

"Intelligence": [

{

"asn": "",

"can_add_public_tags": true,

"confidence": 100,

"country": null,

"created_ts": "2022-04-21T14:27:51.242Z",

"description": null,

"expiration_ts": "2022-07-20T14:27:51.041Z",

"feed_id": 0,

"id": 355250247,

"import_session_id": null,

"ip": "1.2.4.5",

"is_anonymous": false,

"is_editable": false,

"is_public": true,

"itype": "c2_ip",

"latitude": null,

"longitude": null,

"meta": {

"detail2": "bifocals_deactivated_on_2022-07-20_14:30:00.151050",

"severity": "medium"

},

"modified_ts": "2022-07-20T14:30:02.307Z",

"org": "",

"owner_organization_id": 67,

"rdns": null,

"resource_uri": "/api/v2/intelligence/355250247/",

"retina_confidence": -1,

"sort": [

1658327402307,

"355250247"

],

"source": "Analyst",

"source_created": null,

"source_modified": null,

"source_reported_confidence": 100,

"status": "inactive",

"subtype": null,

"tags": [

{

"id": "4w0",

"name": "abc"

},

{

"id": "o8x",

"name": "feb3fbcf-d18c-4a1a-89af-fbe054e16f6c"

},

{

"id": "vuj",

"name": "Playboook_source_without_approval_on_cloud"

}

],

"threat_type": "c2",

"threatscore": 70,

"tlp": null,

"trusted_circle_ids": null,

"type": "ip",

"update_id": 940700580,

"uuid": "3e141a49-6fc9-4567-8efb-919565a39752",

"value": "1.2.4.5",

"workgroups": []

}

]

}

}

Human Readable Output

The intelligence results

Can Add Public Tags	Confidence	Created Ts	Expiration Ts	Feed Id	Id	Ip	Is Anonymous	Is Editable	Is Public	Itype	Meta	Modified Ts	Owner Organization Id	Resource Uri	Retina Confidence	Sort	Source	Source Reported Confidence	Status	Tags	Threat Type	Threatscore	Type	Update Id	Uuid	Value
true	100	2022-04-21T14:27:51.242Z	2022-07-20T14:27:51.041Z	0	355250247	1.2.4.5	false	false	true	c2_ip	detail2: bifocals_deactivated_on_2022-07-20_14:30:00.151050 severity: medium	2022-07-20T14:30:02.307Z	67	/api/v2/intelligence/355250247/	-1	1658327402307, 355250247	Analyst	100	inactive	{'id': '4w0', 'name': 'abc'}, {'id': 'o8x', 'name': 'feb3fbcf-d18c-4a1a-89af-fbe054e16f6c'}, {'id': 'vuj', 'name': 'Playboook_source_without_approval_on_cloud'}	c2	70	ip	940700580	3e141a49-6fc9-4567-8efb-919565a39752	1.2.4.5