ACTI Indicator Query

ACTI provides intelligence regarding security threats and vulnerabilities.

Data Enrichment & Threat Intelligence · Accenture CTI v2

Details

IDACTI Indicator Query
ProviderAccenture
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

ACTI provides intelligence regarding security threats and vulnerabilities.
This integration was integrated and tested with version 2.93.0 of ACTI

Configure ACTI Indicator Query in Cortex

Parameter Description Required
url URL True
API Token The API Token to use for connection True
Source Reliability Reliability of the source providing the intelligence data. True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Checks the reputation of the given IP address.

Base Command

ip

Input

Argument Name Description Required
ip IP address to check. Optional

Context Output

Path Type Description
IP.Address String The IP address that was checked.
IP.Malicious.Vendor String For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description String For malicious IP addresses, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score String The actual score.

Command Example

!ip ip=0.0.0.0

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.0",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "ip",
        "Vendor": "ACTI Indicator Query"
    },
    "IP": {
        "Address": "0.0.0.0"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
0 2 2018-04-25 14:20:30 0.0.0.0 Cyber Espionage MALWARE_DOWNLOAD, MALWARE_C2

domain

Checks the reputation of the given domain.

Base Command

domain

Input

Argument Name Description Required
domain The domain to check. Optional

Context Output

Path Type Description
Domain.Name String The name of the domain that was checked.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!domain domain=example.org

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "ACTI Indicator Query"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
50 2 2019-09-18 15:56:49 example.org Cyber Crime MALWARE_C2

url

Checks the reputation of the given URL.

Base Command

url

Input

Argument Name Description Required
url The URL to check (must start with “http://”). Optional

Context Output

Path Type Description
URL.Data String The URL that was checked.
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
URL.Malicious.Description String For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!url url=http://example.com

Context Example

{
    "DBotScore": {
        "Indicator": "http://example.com",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "url",
        "Vendor": "ACTI Indicator Query"
    },
    "URL": {
        "Data": "http://example.com"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
50 2 2020-09-16 20:29:35 http://example.com Cyber Crime MALWARE_C2

acti-get-ioc-by-uuid

Checks reputation of a specific indicator(URL/IP/Domain) uuid.

Base Command

acti-get-ioc-by-uuid

Input

Argument Name Description Required
uuid Unique User ID. Required

Context Output

Path Type Description
IP.Address String The IP address.
IP.Malicious.Vendor String For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description String For malicious IP addresses, the reason the vendor made that decision.
Domain.Name String The domain name.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason the vendor made that decision.
URL.Data String The URL.
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
URL.Malicious.Description String For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!acti-get-ioc-by-uuid uuid=xxxx

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "ACTI Indicator Query"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
0 2 2017-01-11 20:56:22 example.org Cyber Espionage MALWARE_C2

acti-get-fundamentals-by-uuid

Checks reputation of a specific Malware Family/ Threat Campaign/ Threat Group/ Threat Actor.

Base Command

acti-get-fundamentals-by-uuid

Input

Argument Name Description Required
uuid Unique ID of the specific Malware Family/ Threat Campaign/ Threat Group/ Threat Actor. Required

Context Output

Path Type Description
ACTI_MalwareFamily.display_text String The display text of the Malware Family, for example, ‘Artemis’
ACTI_MalwareFamily.threat_types String The threat type of the Malware Family.
ACTI_MalwareFamily.type String The type of fundamental i.e. an Malware Family , for example, ‘malware_family’
ACTI_MalwareFamily.last_published String The last published date of the Malware Family, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_MalwareFamily.last_modified String The last modified date of the Malware Family, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_MalwareFamily.index_timestamp String The index timestamp of the Malware Family, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_MalwareFamily.created_on String The creation timestamp of the Malware Family, for example, ‘2020-03-12T22:22:25.000Z’
ACTI_MalwareFamily.description String The description of the Malware Family
ACTI_MalwareFamily.analysis String The analysis of the Malware Family
ACTI_ThreatGroup.display_text String The display text of the Threat Group, for example, ‘Black Shadow’
ACTI_ThreatGroup.threat_types String The threat type of the Threat Group.
ACTI_ThreatGroup.type String The type of fundamental i.e. an Threat Group, for example, ‘threat_group’
ACTI_ThreatGroup.last_published String The last published date of the Threat Group, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatGroup.last_modified String The last modified date of the Threat Group, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatGroup.index_timestamp String The index timestamp of the Threat Group, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatGroup.created_on String The creation timestamp of the Threat Group, for example, ‘2020-03-12T22:22:25.000Z’
ACTI_ThreatGroup.description String The description of the Threat Group
ACTI_ThreatGroup.analysis String The analysis of the Threat Group
ACTI_ThreatActor.display_text String The display text of the Threat Actor, for example, ‘RastaFarEye’
ACTI_ThreatActor.threat_types String The threat type of the Threat Actor.
ACTI_ThreatActor.type String The type of fundamental i.e. an Threat Actor, for example, ‘threat_actor’
ACTI_ThreatActor.last_published String The last published date of the Threat Actor, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatActor.last_modified String The last modified date of the Threat Actor, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatActor.index_timestamp String The index timestamp of the Threat Actor, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatActor.created_on String The creation timestamp of the Threat Actor, for example, ‘2020-03-12T22:22:25.000Z’
ACTI_ThreatActor.description String The description of the Threat Actor
ACTI_ThreatActor.analysis String The analysis of the Threat Actor
ACTI_ThreatCampaign.display_text String The display text of the Threat Campaign, for example, ‘FBI Flash CU-000141-MW’
ACTI_ThreatCampaign.threat_types String The threat type of the Threat Campaign.
ACTI_ThreatCampaign.type String The type of fundamental i.e. an Threat Campaign , for example, ‘threat_campaign’
ACTI_ThreatCampaign.last_published String The last published date of the Threat Campaign, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatCampaign.last_modified String The last modified date of the Threat Campaign, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatCampaign.index_timestamp String The index timestamp of the Threat Campaign, for example, ‘2022-02-11T17:24:03.604Z’
ACTI_ThreatCampaign.created_on String The creation timestamp of the Threat Campaign, for example, ‘2020-03-12T22:22:25.000Z’
ACTI_ThreatCampaign.description String The description of the Threat Campaign
ACTI_ThreatCampaign.analysis String The analysis of the Threat Campaign
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!acti-get-fundamentals-by-uuid uuid=7q2b129s-6421-4e22-a276-22be5f76cba8

Context Example

{
    "DBotScore": {
        "Indicator": "7q2b129s-6421-4e22-a276-22be5f76cba8",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "ACTI Malware Family",
        "Vendor": "ACTI Indicator Query"
    },
    "ACTI_MalwareFamily": {
        "Name": "Danabot",
        "DbotReputation": 2,
        "ThreatTypes": "Cyber Crime",
        "Type": "malware_family",
        "LastPublished": "2021-04-02T04:40:19.000Z",
        "LastModified": "2021-04-02T04:40:19.000Z",
        "IndexTimestamp": "2021-04-02T04:40:19.000Z",
        "Severity": 3,
        "CreatedOn": "2021-04-02T04:40:19.000Z"
    }
}

Human Readable Output

Danabot

For more insight click: https://intelgraph.idefense.com/#/node/malware_family/view/7q2b129s-6421-4e22-a276-22be5f76cba8

CreatedOn DBotReputation IndexTimestamp LastModified LastPublished Name Severity ThreatTypes Type
2021-04-02 04:40:19 2 2021-04-02 04:40:19 2021-04-02 04:40:19 2021-04-02 04:40:19 Danabot 3 Cyber Crime malware_family

acti-getThreatIntelReport

Fetches Intelligence Alerts & Intelligence Reports.

Base Command

acti-getThreatIntelReport

Input

Argument Name Description Required
uuid uuid of Intelligence Alert/Report (IA/IR) in the ACTI IntelGraph platform. Required

Context Output

Path Type Description
IAIR.abstract String This field is specific to Intelligence Alert and provides a summarised context, for example, ‘The worldwide COVID-19 outbreak…’
IAIR.last_published String The last published timestamp of the IA/IR, for example, ‘2020-06-26T01:14:56.000Z’
IAIR.index_timestamp String The index timestamp of the IA/IR, for example, ‘2022-02-11T17:24:03.604Z’
IAIR.display_text String The display text of the IA/IR, for example, ‘SITREP Cybersecurity Risks Related to COVID-19’
IAIR.value String The value of the IA/IR, for example, ‘8b8b48f1-92a0-411a-a073-3241f6819f8b’
IAIR.last_modified String The last modified timestamp of the IA/IR, for example, ‘2022-02-11T17:21:48.000Z’
IAIR.threat_types String The threat type of the IA/IR, for example, ‘- Hacktivism- Cyber Espionage- Cyber Crime- Vulnerability’. It’s formatted in such a way that it gets displayed better.
IAIR.created_on String The creation timestamp of the IA/IR, for example, ‘2020-03-12T22:22:25.000Z’
IAIR.title String The title of the IA/IR, for example, ‘SITREP Cybersecurity Risks Related to COVID-19’
IAIR.type String The type of report i.e. an IA/IR , for example, ‘intelligence_alert’
IAIR.uuid String The uuid of the IA/IR, for example, ‘8b8b48f1-92a0-411a-a073-3241f6819f8b’
IAIR.analysis String The analysis of the IA/IR, for example, ‘COVID-19 Introduces Cyberthreat Opportunities…’
IAIR.attachment_links String Provides with the document links related to the Intelligence Alert. This field is specific to Intelligence Alert, for example, ‘https://intelgraph.idefense.com/rest/files/download/…’
IAIR.severity String Provides severity rating. This field is specific to Intelligence Alert, for example, ‘4’
IAIR.mitigation String Provides info on how to mitigate. This field is specific to Intelligence Alert, for example, ‘## Expert, Experienced Advice Will be CriticalTo minimize targeting opportunities…’
IAIR.conclusion String Provides conclusion of the report. This field is specific to Intelligence Report
IAIR.summary String Provides with a summary of the report. This field is specific to Intelligence Report.
IAIR.dynamic_properties String Provides with the dynamic properties related to the intelligence alert/report.
IAIR.links String Provides details of the linked fields related to the intelligence alert/report.
IAIR.sources_external String Provides with external sources related to the intelligence alert/report.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor that was used to calculate the score.
DBotScore.Score String The actual score.

Command Example

!acti-getThreatIntelReport uuid=8b8b48f1-92a0-411a-a073-3241f6819f8b

Context Example

{
    "DBotScore": {
        "Indicator": "8b8b48f1-92a0-411a-a073-3241f6819f8b",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "ACTI Intelligence Alert",
        "Vendor": "ACTI Indicator Query"
    },
    "IAIR": {
        "abstract": "The worldwide COVID-19 outbreak, which the World Health Organization (WHO) declared a pandemic......",
        "last_published": "2020-06-26T01:14:56.000Z",
        "index_timestamp": "2022-02-11T17:24:03.604Z",
        "display_text": "SITREP: Cybersecurity Risks Related to COVID-19",
        "value": "8b8b48f1-92a0-411a-a073-3241f6819f8b",
        "sources_external": {},
        "last_modified":"2022-02-11T17:21:48.000Z",
        "dynamic_properties": {},
        "threat_types": "- Hacktivism- Cyber Espionage- Cyber Crime- Vulnerability",
        "created_on": "2020-03-12T22:22:25.000Z",
        "title": "SITREP: Cybersecurity Risks Related to COVID-19",
        "links":{},
        "type": "intelligence_alert",
        "uuid": "8b8b48f1-92a0-411a-a073-3241f6819f8b",
        "analysis": "##COVID-19 Introduces Cyberthreat Opportunities####Exploitation of Work-from-Home.....",
        "attachment_links": "- https://intelgraph.idefense.com/rest/files/download/08/f0/05/7f1f609e7659dc......",
        "severity": 4,
        "mitigation": "##Expert, Experienced Advice Will be CriticalTo minimize targeting opportunities...."
    }
}

Human Readable Output

Report has been fetched!
UUID: 8b8b48f1-92a0-411a-a073-3241f6819f8b
Link to view report: https://intelgraph.idefense.com/#/node/intelligence_alert/view/8b8b48f1-92a0-411a-a073-3241f6819f8b

Configuration parameters

  • url — URL (required)
  • api_token — (required)
  • integrationReliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)
  • use_proxy — Use system proxy settings

Commands (6)

  • acti-get-fundamentals-by-uuid

    Checks reputation of a specific Malware Family/ Threat Campaign/ Threat Group/ Threat Actor.

  • acti-get-ioc-by-uuid

    Checks reputation of a specific indicator(URL/IP/Domain) uuid.

  • acti-getThreatIntelReport

    Fetches Intelligence Alerts & Intelligence Reports.

  • domain

    Checks the reputation of the given domain.

  • ip

    Checks the reputation of the given IP address.

  • url

    Checks the reputation of the given URL.

Source

ACTIIndicatorQuery.py ACTIIndicatorQuery_test.py ACTIIndicatorQuery.yml ACTIIndicatorQuery_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Accenture
commonfields:
  id: ACTI Indicator Query
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: URL
  name: url
  defaultvalue: https://api.intelgraph.idefense.com/
  type: 0
  required: true
  section: Connect
- displaypassword: API Token
  additionalinfo: The API Token to use for connection
  name: api_token
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: use_proxy
  type: 8
  required: false
  section: Connect
description: ACTI provides intelligence regarding security threats and vulnerabilities.
display: ACTI Indicator Query
name: ACTI Indicator Query
script:
  commands:
  - name: ip
    arguments:
    - name: ip
      default: true
      description: IP address to check.
      isArray: true
    outputs:
    - contextPath: IP.Address
      description: The IP address that was checked.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: String
    description: Checks the reputation of the given IP address.
  - name: domain
    arguments:
    - name: domain
      default: true
      description: The domain to check.
      isArray: true
    outputs:
    - contextPath: Domain.Name
      description: The name of the domain that was checked.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: String
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Checks the reputation of the given domain.
  - name: url
    arguments:
    - name: url
      default: true
      description: The URL to check (must start with "http://").
      isArray: true
    outputs:
    - contextPath: URL.Data
      description: The URL that was checked.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Checks the reputation of the given URL.
  - name: acti-get-ioc-by-uuid
    description: Checks reputation of a specific indicator(URL/IP/Domain) uuid.
    arguments:
    - name: uuid
      required: true
      description: Unique User ID.
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason the vendor made that decision.
      type: String
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: String
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason the vendor made that decision.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  - name: acti-get-fundamentals-by-uuid
    description: Checks reputation of a specific Malware Family/ Threat Campaign/ Threat Group/ Threat Actor.
    arguments:
    - name: uuid
      required: true
      default: true
      description: Unique ID of the specific Malware Family/ Threat Campaign/ Threat Group/ Threat Actor.
    outputs:
    - contextPath: ACTI_MalwareFamily.display_text
      description: The display text of the Malware Family, for example, 'Artemis'.
      type: String
    - contextPath: ACTI_MalwareFamily.threat_types
      description: The threat type of the Malware Family.
      type: String
    - contextPath: ACTI_MalwareFamily.type
      description: The type of fundamental i.e. an Malware Family , for example, 'malware_family'.
      type: String
    - contextPath: ACTI_MalwareFamily.last_published
      description: The last published date of the Malware Family, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_MalwareFamily.last_modified
      description: The last modified date of the Malware Family, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_MalwareFamily.index_timestamp
      description: The index timestamp of the Malware Family, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_MalwareFamily.created_on
      description: The creation timestamp of the Malware Family, for example, '2020-03-12T22:22:25.000Z'.
      type: String
    - contextPath: ACTI_MalwareFamily.description
      description: The description of the Malware Family.
      type: String
    - contextPath: ACTI_MalwareFamily.analysis
      description: The analysis of the Malware Family.
      type: String
    - contextPath: ACTI_ThreatGroup.display_text
      description: The display text of the Threat Group, for example, 'Black Shadow'.
      type: String
    - contextPath: ACTI_ThreatGroup.threat_types
      description: The threat type of the Threat Group.
      type: String
    - contextPath: ACTI_ThreatGroup.type
      description: The type of fundamental i.e. an Threat Group, for example, 'threat_group'.
      type: String
    - contextPath: ACTI_ThreatGroup.last_published
      description: The last published date of the Threat Group, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatGroup.last_modified
      description: The last modified date of the Threat Group, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatGroup.index_timestamp
      description: The index timestamp of the Threat Group, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatGroup.created_on
      description: The creation timestamp of the Threat Group, for example, '2020-03-12T22:22:25.000Z'.
      type: String
    - contextPath: ACTI_ThreatGroup.description
      description: The description of the Threat Group.
      type: String
    - contextPath: ACTI_ThreatGroup.analysis
      description: The analysis of the Threat Group.
      type: String
    - contextPath: ACTI_ThreatActor.display_text
      description: The display text of the Threat Actor, for example, 'RastaFarEye'.
      type: String
    - contextPath: ACTI_ThreatActor.threat_types
      description: The threat type of the Threat Actor.
      type: String
    - contextPath: ACTI_ThreatActor.type
      description: The type of fundamental i.e. an Threat Actor, for example, 'threat_actor'.
      type: String
    - contextPath: ACTI_ThreatActor.last_published
      description: The last published date of the Threat Actor, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatActor.last_modified
      description: The last modified date of the Threat Actor, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatActor.index_timestamp
      description: The index timestamp of the Threat Actor, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatActor.created_on
      description: The creation timestamp of the Threat Actor, for example, '2020-03-12T22:22:25.000Z'.
      type: String
    - contextPath: ACTI_ThreatActor.description
      description: The description of the Threat Actor.
      type: String
    - contextPath: ACTI_ThreatActor.analysis
      description: The analysis of the Threat Actor.
      type: String
    - contextPath: ACTI_ThreatCampaign.display_text
      description: The display text of the Threat Campaign, for example, 'FBI Flash CU-000141-MW'.
      type: String
    - contextPath: ACTI_ThreatCampaign.threat_types
      description: The threat type of the Threat Campaign.
      type: String
    - contextPath: ACTI_ThreatCampaign.type
      description: The type of fundamental i.e. an Threat Campaign , for example, 'threat_campaign'.
      type: String
    - contextPath: ACTI_ThreatCampaign.last_published
      description: The last published date of the Threat Campaign, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatCampaign.last_modified
      description: The last modified date of the Threat Campaign, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatCampaign.index_timestamp
      description: The index timestamp of the Threat Campaign, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: ACTI_ThreatCampaign.created_on
      description: The creation timestamp of the Threat Campaign, for example, '2020-03-12T22:22:25.000Z'.
      type: String
    - contextPath: ACTI_ThreatCampaign.description
      description: The description of the Threat Campaign.
      type: String
    - contextPath: ACTI_ThreatCampaign.analysis
      description: The analysis of the Threat Campaign.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  - name: acti-getThreatIntelReport
    description: Fetches Intelligence Alerts & Intelligence Reports.
    arguments:
    - name: uuid
      default: true
      description: uuid of Intelligence Alert/Report (IA/IR) in the ACTI IntelGraph platform.
      required: true
    outputs:
    - contextPath: IAIR.abstract
      description: This field is specific to Intelligence Alert and provides a summarised context, for example, 'The worldwide COVID-19 outbreak...'.
      type: String
    - contextPath: IAIR.last_published
      description: The last published timestamp of the IA/IR, for example, '2020-06-26T01:14:56.000Z'.
      type: String
    - contextPath: IAIR.index_timestamp
      description: The index timestamp of the IA/IR, for example, '2022-02-11T17:24:03.604Z'.
      type: String
    - contextPath: IAIR.display_text
      description: The display text of the IA/IR, for example, 'SITREP Cybersecurity Risks Related to COVID-19'.
      type: String
    - contextPath: IAIR.value
      description: The value of the IA/IR, for example, '8b8b48f1-92a0-411a-a073-3241f6819f8b'.
      type: String
    - contextPath: IAIR.last_modified
      description: The last modified timestamp of the IA/IR, for example, '2022-02-11T17:21:48.000Z'.
      type: String
    - contextPath: IAIR.threat_types
      description: The threat type of the IA/IR, for example, '- Hacktivism- Cyber Espionage- Cyber Crime- Vulnerability'. It's formatted in such a way that it gets displayed better.
      type: String
    - contextPath: IAIR.created_on
      description: The creation timestamp of the IA/IR, for example, '2020-03-12T22:22:25.000Z'.
      type: String
    - contextPath: IAIR.title
      description: The title of the IA/IR, for example, 'SITREP Cybersecurity Risks Related to COVID-19'.
      type: String
    - contextPath: IAIR.type
      description: The type of report i.e. an IA/IR , for example, 'intelligence_alert'.
      type: String
    - contextPath: IAIR.uuid
      description: The uuid of the IA/IR, for example, '8b8b48f1-92a0-411a-a073-3241f6819f8b'.
      type: String
    - contextPath: IAIR.analysis
      description: The analysis of the IA/IR, for example, 'COVID-19 Introduces Cyberthreat Opportunities...'.
      type: String
    - contextPath: IAIR.attachment_links
      description: Provides with the document links related to the Intelligence Alert. This field is specific to Intelligence Alert, for example, 'https://intelgraph.idefense.com/rest/files/download/...'.
      type: String
    - contextPath: IAIR.severity
      description: Provides severity rating. This field is specific to Intelligence Alert, for example, '4'.
      type: String
    - contextPath: IAIR.mitigation
      description: Provides info on how to mitigate. This field is specific to Intelligence Alert, for example, '## Expert, Experienced Advice Will be CriticalTo minimize targeting opportunities...'.
      type: String
    - contextPath: IAIR.conclusion
      description: Provides conclusion of the report. This field is specific to Intelligence Report.
      type: String
    - contextPath: IAIR.summary
      description: Provides with a summary of the report. This field is specific to Intelligence Report.
      type: String
    - contextPath: IAIR.dynamic_properties
      description: Provides with the dynamic properties related to the intelligence alert/report.
      type: String
    - contextPath: IAIR.links
      description: Provides details of the linked fields related to the intelligence alert/report.
      type: String
    - contextPath: IAIR.sources_external
      description: Provides with external sources related to the intelligence alert/report.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor that was used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- ACTI Indicator Query Test