Skip to main content

Recorded Future URL Reputation

URL reputation using Recorded Future SOAR Enrichment

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • Recorded Future v2

Scripts#

This playbook does not use any scripts.

Commands#

  • url

Playbook Inputs#


NameDescriptionDefault ValueRequired
URLURL to get reputation of.URL.DataOptional

Playbook Outputs#


PathDescriptionType
DBotScore.IndicatorThe indicator that was testedstring
DBotScore.TypeIndicator typestring
DBotScore.VendorVendor used to calculate the scorestring
DBotScore.ScoreThe actual scorenumber
URL.Malicious.VendorFor malicious URLs, the vendor that made the decisionstring
URL.Malicious.DescriptionFor malicious URLs, the reason that the vendor made the decisionstring
URL.DataURL namestring
RecordedFuture.URL.riskScoreRecorded Future URL Risk Scorenumber
RecordedFuture.URL.riskLevelRecorded Future URL Risk Levelstring
RecordedFuture.URL.Evidence.ruleRecorded Risk Rule Namestring
RecordedFuture.URL.Evidence.mitigationRecorded Risk Rule Mitigationstring
RecordedFuture.URL.Evidence.descriptionRecorded Risk Rule descriptionstring
RecordedFuture.URL.Evidence.timestampRecorded Risk Rule timestampdate
RecordedFuture.URL.Evidence.levelRecorded Risk Rule Levelnumber
RecordedFuture.URL.Evidence.ruleidRecorded Risk Rule IDstring
RecordedFuture.URL.nameURLstring
RecordedFuture.URL.maxRulesMaximum count of Recorded Future URL Risk Rulesnumber
RecordedFuture.URL.ruleCountNumber of triggered Recorded Future URL Risk Rulesnumber

Playbook Image#


Recorded Future URL Reputation