Alexa Rank Indicator v2

Details

ID	`Alexa Rank Indicator v2`
Provider	Amazon
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.10.9.42476`
Supported Modules	Agentix

README

Alexa provides website ranking information that can be used to help determine if a domain has a strong web presence.
This integration was integrated and tested with Alexa Rank Indicator V2.

New: Alexa Rank Indicator v2

Use of the Alexa API rank.
Domains that are not in the Alexa database, are considered “Unknown” instead of “Suspicious”.
If the domain doesn’t exist, there is an error.
Default values changed: 1000 for Top Domain Threshold and unspecified for Suspicous Domain Threshold.

Configure Alexa Rank Indicator V2 in Cortex

Parameter	Description	Required
Source Reliability	Reliability of the source providing the intelligence data.	True
Rank threshold for suspicious domain	If the domain’s Alexa rank is over this threshold, the domain is marked as suspicious. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown.	True
Base API URL		True
Rank threshold for top domains	If the domain’s Alexa rank is under this threshold, the domain is considered trusted and marked as good. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown.	True
Use system proxy settings		False
Trust any certificate (not secure)		False
API Key		True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

domain

Provides the Alexa ranking of a domain.

Base Command

domain

Input

Argument Name	Description	Required
domain	Domain(s) to search.	Required

Context Output

Path	Type	Description
Domain.Name	String	The domain being checked.
DBotScore.Score	number	The actual score.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Type	String	The indicator type.
DBotScore.Indicator	String	The indicator that was tested.
Alexa.Domain.Indicator	String	The domain being checked.
Alexa.Domain.Name	String	The domain being checked.
Alexa.Domain.Rank	String	Alexa rank as determined by Amazon.

Command Example

```!domain domain=”google.com,xsoar.com”

Context Example

{
    "Alexa": {
        "Domain": [
            {
                "Indicator": "google.com",
                "Name": "google.com",
                "Rank": "1"
            },
            {
                "Indicator": "xsoar.com",
                "Name": "xsoar.com",
                "Rank": "Unknown"
            }
        ]
    },
    "DBotScore": [
        {
            "Indicator": "google.com",
            "Reliability": "A - Completely reliable",
            "Score": 0,
            "Type": "domain",
            "Vendor": "Alexa Rank Indicator V2"
        },
        {
            "Indicator": "xsoar.com",
            "Reliability": "A - Completely reliable",
            "Score": 2,
            "Type": "domain",
            "Vendor": "Alexa Rank Indicator V2"
        }
    ],
    "Domain": [
        {
            "Name": "google.com"
        },
        {
            "Name": "xsoar.com"
        }
    ]
}

Human Readable Output

Alexa Rank for xsoar.com

Domain Alexa Rank Reputation

xsoar.com Suspicous

Domain	Alexa Rank	Reputation
xsoar.com		Suspicous

Configuration parameters

base_url — Base API URL (required)
credentials — (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
suspicious_domain_threshold — Rank Threshold For Suspicious Domain
top_domain_threshold — Rank Threshold For Top Domains (required)
integrationReliability — Source Reliability (required)

Commands (1)

domain
Provides an Alexa ranking of the domain.

Source

AlexaV2.py AlexaV2_test.py AlexaV2.yml AlexaV2_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Amazon
commonfields:
  id: Alexa Rank Indicator v2
  version: -1
configuration:
- defaultvalue: 'https://awis.api.alexa.com/api'
  display: Base API URL
  name: base_url
  required: true
  type: 0
- displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- additionalinfo: If the domain's Alexa rank is over this threshold, the domain is marked as suspicious. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown.
  display: Rank Threshold For Suspicious Domain
  name: suspicious_domain_threshold
  type: 0
  required: false
- additionalinfo: If the domain's Alexa rank is under this threshold, the domain is considered trusted and marked as good. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown.
  defaultvalue: '1000'
  display: Rank Threshold For Top Domains
  name: top_domain_threshold
  required: true
  type: 0
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
description: Deprecated. Vendor has declared end of life for this product. No available replacement.
deprecated: true
display: Alexa Rank Indicator v2 (Deprecated)
name: Alexa Rank Indicator v2
script:
  commands:
  - arguments:
    - default: true
      description: Domain(s) to search.
      isArray: true
      name: domain
      required: true
    description: Provides an Alexa ranking of the domain.
    name: domain
    outputs:
    - contextPath: Domain.Name
      description: The domain being checked.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: Alexa.Domain.Indicator
      description: The domain being checked.
      type: String
    - contextPath: Alexa.Domain.Name
      description: The domain being checked.
      type: String
    - contextPath: Alexa.Domain.Rank
      description: Alexa rank as determined by Amazon.
      type: String
  dockerimage: demisto/python3:3.10.9.42476
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- AlexaV2 Test Playbook
fromversion: 5.5.0

Alexa Rank Indicator v2 Deprecated