URL Enrichment - Generic v2
This Playbook is part of the Common Playbooks Pack.#
Enrich URLs using one or more integrations.
URL enrichment includes:
- SSL verification for URLs.
- Threat information.
- Providing of URL screenshots.
- URL Reputation using !url.
Limitation#
The "Get URL screenshot" task has a timeout of 10 minutes when using the Rasterize integration. This allows processing a large number of URLs. If the task still fails due to timeout because the Rasterize command is processing too many URLs, the timeout value of the task needs to be increased.
Dependencies#
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks#
This playbook does not use any sub-playbooks.
Integrations#
- Rasterize
Scripts#
- Exists
- URLSSLVerification
Commands#
- rasterize
- url
Playbook Inputs#
| Name | Description | Default Value | Required |
|---|---|---|---|
| URL | The URLs to enrich. | URL.Data | Optional |
| Rasterize | Define if you would like the system take safe screenshots of input URLs. Possible values: True / False. The default value is true. | True | Optional |
| VerifyURL | Define if you would like the system perform SSL certificate verification on the URLs. Possible values: True / False. The default value is false. | False | Optional |
| UseReputationCommand | Define if you would like to use the !url command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false. | False | Required |
Playbook Outputs#
| Path | Description | Type |
|---|---|---|
| URL | The URL object. | uknown |
| URL.Data | The enriched URL. | string |
| DBotScore | The DBotScore object. | unknown |
| URL.Malicious | Whether the detected URL was malicious. | unknown |
| URL.Malicious.Vendor | For malicious URLs, the vendor that made the decision. | unknown |
| URL.Malicious.Description | For malicious URLs, the reason that the vendor made the decision. | unknown |
| DBotScore.Indicator | The indicator | string |
| DBotScore.Type | The indicator's type | string |
| DBotScore.Vendor | The reputation vendor | string |
| DBotScore.Score | The reputation score | number |
| DBotScore.Reliability | Reliability of the source providing the intelligence data. | unknown |
| URL.Relationships.EntityA | The source of the relationship. | unknown |
| URL.Relationships.EntityB | The destination of the relationship. | unknown |
| URL.Relationships.Relationship | The name of the relationship. | unknown |
| URL.Relationships.EntityAType | The type of the source of the relationship. | unknown |
| URL.Relationships.EntityBType | The type of the destination of the relationship. | unknown |
| InfoFile.EntryID | The EntryID of the image/pdf file. | unknown |
| InfoFile.Extension | The extension of the image/pdf file. | unknown |
| InfoFile.Name | The name of the image/pdf file. | unknown |
| InfoFile.Info | The info of the image/pdf file. | unknown |
| InfoFile.Size | The size of the image/pdf file. | unknown |
| InfoFile.Type | The type of the image/pdf file. | unknown |
Playbook Image#
