Alexa Rank Indicator v2 Deprecated
Deprecated. Vendor has declared end of life for this product. No available replacement.
Data Enrichment & Threat Intelligence · Alexa Rank Indicator (Deprecated)
Details
| ID | Alexa Rank Indicator v2 |
|---|---|
| Provider | Amazon |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.10.9.42476 |
| Supported Modules | Agentix |
README
Alexa provides website ranking information that can be used to help determine if a domain has a strong web presence.
This integration was integrated and tested with Alexa Rank Indicator V2.
New: Alexa Rank Indicator v2
- Use of the Alexa API rank.
- Domains that are not in the Alexa database, are considered “Unknown” instead of “Suspicious”.
- If the domain doesn’t exist, there is an error.
- Default values changed: 1000 for Top Domain Threshold and unspecified for Suspicous Domain Threshold.
Configure Alexa Rank Indicator V2 in Cortex
| Parameter | Description | Required |
|---|---|---|
| Source Reliability | Reliability of the source providing the intelligence data. | True |
| Rank threshold for suspicious domain | If the domain’s Alexa rank is over this threshold, the domain is marked as suspicious. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown. | True |
| Base API URL | True | |
| Rank threshold for top domains | If the domain’s Alexa rank is under this threshold, the domain is considered trusted and marked as good. If the rank is between the threshold for suspicious domains and top domains, the domain is marked as unknown. | True |
| Use system proxy settings | False | |
| Trust any certificate (not secure) | False | |
| API Key | True |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
domain
Provides the Alexa ranking of a domain.
Base Command
domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | Domain(s) to search. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain being checked. |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
| Alexa.Domain.Indicator | String | The domain being checked. |
| Alexa.Domain.Name | String | The domain being checked. |
| Alexa.Domain.Rank | String | Alexa rank as determined by Amazon. |
Command Example
```!domain domain=”google.com,xsoar.com”
Context Example
{
"Alexa": {
"Domain": [
{
"Indicator": "google.com",
"Name": "google.com",
"Rank": "1"
},
{
"Indicator": "xsoar.com",
"Name": "xsoar.com",
"Rank": "Unknown"
}
]
},
"DBotScore": [
{
"Indicator": "google.com",
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "domain",
"Vendor": "Alexa Rank Indicator V2"
},
{
"Indicator": "xsoar.com",
"Reliability": "A - Completely reliable",
"Score": 2,
"Type": "domain",
"Vendor": "Alexa Rank Indicator V2"
}
],
"Domain": [
{
"Name": "google.com"
},
{
"Name": "xsoar.com"
}
]
}
Human Readable Output
Alexa Rank for xsoar.com
Domain Alexa Rank Reputation xsoar.com Suspicous
Configuration parameters
base_url— Base API URL (required)credentials— (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)suspicious_domain_threshold— Rank Threshold For Suspicious Domaintop_domain_threshold— Rank Threshold For Top Domains (required)integrationReliability— Source Reliability (required)
Commands (1)
-
domainProvides an Alexa ranking of the domain.
import pytest from AlexaV2 import Client, rank_to_context, alexa_domain from CommonServerPython import * # noqa def create_client(proxy: bool = False, verify: bool = False, top_domain_threshold: int = 100, suspicious_domain_threshold: Optional[int] = None, reliability: str = DBotScoreReliability.A_PLUS): return Client(proxy=proxy, verify=verify, top_domain_threshold=top_domain_threshold, suspicious_domain_threshold=suspicious_domain_threshold, reliability=reliability, api_key='', base_url='https://awis.api.alexa.com/api') def load_json(file: str) -> Dict: with open(file, 'r') as f: return json.load(f) client = create_client() def test_domain_rank(mocker): """ Given: - A domain to be ranked by Alexa API When: - running the domain command: 1. when getting a valid response with an existing domain. 2. when getting a valid response with an non-existing domain. Then: - Ensure that the rank the domain got is valid - Ensure the context data is valid with the expected outputs. """ raw_result = load_json('test_data/google_response.json') mocker.patch.object(client, 'alexa_rank', return_value=raw_result) result = alexa_domain(client, ['google.com'])[0] rank_result = result.outputs.get('Rank') if result.outputs.get('Rank') != 'Unknown' else None assert demisto.get(raw_result, 'Awis.Results.Result.Alexa.TrafficData.Rank') == rank_result def test_multi_domains(mocker): """ Given: - A list of domains to be ranked by Alexa API When: - running the domain command on the input Then: - Ensure that: 1. The length of the result is the same as the length of the domains list 2. Valid responses for both of the domains """ domains = 'google.com,xsoar.com' raw_res = load_json('test_data/google_response.json') mocker.patch.object(client, 'alexa_rank', return_value=raw_res) result = alexa_domain(client, argToList(domains)) assert len(result) == len(argToList(domains)) for res in result: assert res.outputs.get('Rank') == demisto.get(raw_res, 'Awis.Results.Result.Alexa.TrafficData.Rank') DOMAINS_BAD_RESULTS = [('xsoar.com', load_json('test_data/negative_rank_response.json')), ('xsoar.com', load_json('test_data/nan_rank_response.json')), ('xsoar.com', load_json('test_data/404_response.json'))] @pytest.mark.parametrize('domain, raw_result', DOMAINS_BAD_RESULTS) def test_domain_invalid_rank(mocker, domain, raw_result): """ Given: - A domain to be ranked by Alexa API When: - The API responds with an invalid rank Then: - Ensure there is an exception """ mocker.patch.object(client, 'alexa_rank', return_value=raw_result) with pytest.raises((DemistoException, ValueError)): alexa_domain(client, [domain]) SCORE_TESTS = [(1, 100, 200, DBotScoreReliability.A_PLUS, 1), (None, 100, 200, DBotScoreReliability.A_PLUS, 0), (0, 100, 200, DBotScoreReliability.A_PLUS, 0), (4000, 100, 1000, DBotScoreReliability.A_PLUS, 2), (200, 100, None, DBotScoreReliability.A_PLUS, 0)] @pytest.mark.parametrize('rank, top_domain_threshold, suspicious_domain_threshold, reliability, score', SCORE_TESTS) def test_rank_to_score(rank, top_domain_threshold, suspicious_domain_threshold, reliability, score): """ Given: - The parameters for the integration, with the rank from the API When: - After getting the rank, calling the rank_to_Score to get the score based on the parameters and the rank Then: - Ensure that the score returned corresponds to the algorithm """ context = rank_to_context('google.com', rank, top_domain_threshold, suspicious_domain_threshold, reliability) assert context.dbot_score.score == score def test_rank_to_score_invalid(): """ Given: - The parameters for the integration, with the rank from the API When: - After getting the rank, calling the rank_to_Score to get the score based on the parameters and a rank with is invalid Then: - Ensure that Exception is being raised """ with pytest.raises(DemistoException): rank_to_context('google.com', -1, 0, 200, DBotScoreReliability.A_PLUS)