Anomali ThreatStream Deprecated

commonfields:
  id: Anomali ThreatStream
  version: -1
name: Anomali ThreatStream
display: Anomali ThreatStream (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: Anomali
description: Deprecated. Use Anomali ThreatStream v3 instead. Use Anomali ThreatStream to query and submit threats
deprecated: true
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: https://api.threatstream.com
  type: 0
  required: true
- display: Username
  name: username
  defaultvalue: ""
  type: 0
  required: false
- display: API Key
  name: apikey
  defaultvalue: ""
  type: 4
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: ""
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: ""
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: threatstream-intelligence
    arguments:
    - name: limit
      description: limit the amount of records in response
      defaultValue: "20"
    - name: asn
      description: Autonomous System (AS) number associated with the indicator
    - name: confidence
      description: Confidence value assigned to the indicator
    - name: country
      description: Country associated with the indicator
    - name: created_ts
      description: When the indicator was first seen on the ThreatStream cloud platform. For example, 2014-10-02T20:44:35
    - name: expiration_ts
      description: Time stamp of when intelligence will expire on ThreatStream, in UTC time
    - name: feed_id
      description: Numeric ID of the threat feed that generated the indicator
    - name: id
      description: Unique ID for the indicator
    - name: import_session_ id
      description: ID of import session in which the indicator was imported
    - name: ip
      description: The IP address associated with the indicator if the imported indicator is a domain or a URL
    - name: is_public
      description: Classification of the indicator—public or private
    - name: itype
      description: Indicator type
    - name: latitude
      description: Latitude associated with the Geo location of the IP
    - name: longitude
      description: Longitude associated with the Geo location of the IP
    - name: meta.detail
      description: A string that contains a tag associated with the indicator; the tag can be used to search for related indicators
    - name: meta.detail2
      description: Additional details associated with state of an indicator. For example, details such as why is an indicator marked false positive
    - name: meta.maltype
      description: Tag that specifies the malware associated with an indicator
    - name: meta.severity
      description: Severity assigned to the indicator through machine-learning algorithms ThreatStream deploys
    - name: modified_ts
      description: When the indicator was last updated on the ThreatStream cloud platform
    - name: org
      description: Registered owner (organization) of the IP address associated with the indicator
    - name: owner_ organization_id
      description: ID of the (ThreatStream)organization that brought in the indicator, either through a threat feed or through the import process
    - name: rdns
      description: Domain name (obtained through reverse domain name lookup) associated with the IP address that is associated with the indicator
    - name: source_reported_ confidence
      description: A risk score from 0 to 100, provided by the source of the indicator
    - name: status
      description: Status assigned to the indicator
    - name: tags.name
      description: Tag assigned to the indicator
    - name: threat_type
      description: Summarized threat type of the indicator. For example, malware, compromised, apt, c2, and so on
    - name: trusted_circle_ids
      description: IDs of the trusted circles with which the indicator is shared
    - name: type
      description: Type of indicator—domain, email, ip, md5, string, url
    - name: update_id
      description: An incrementing numeric identifier associated with each update to intelligence on ThreatStream
    - name: value
      description: Value of the indicator
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    description: To retrieve threat intelligence from the ThreatStream cloud
  - name: domain
    arguments:
    - name: domain
      required: true
      description: The domain name to check
    - name: threshold
      description: If ThreatScore is greater or equal than the threshold, then domain will be considered malicious
      defaultValue: "3"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: Domain.DNS
      description: Domain IP Address
    - contextPath: Domain.Name
      description: Domain name
    - contextPath: Domain.Score
      description: A value assigned to the indicator through machine-learning algorithms ThreatStream deploys. Higher the threatscore, higher the risk. Threatscore ranges from 0-100, in increasing order of risk.
    - contextPath: IP.Address
      description: Domain IP Address
    - contextPath: IP.Geo.Country
      description: Country associated with the indicator.
    - contextPath: IP.Geo.Location
      description: Longitude and Latitude of the IP address
    - contextPath: IP.Geo.Organization
      description: Registered owner (organization) of the IP address associated with the indicator.
    - contextPath: IP.Hostname
      description: Domain name (obtained through reverse domain name lookup) associated with the IP address that is associated with the indicator.
    - contextPath: IP.Malicious.Vendor
      description: Usually an obfuscated description of the source of the indicator; the description may not be obfuscated if the user belongs to your organization.
    - contextPath: IP.Score
      description: A value assigned to the indicator through machine-learning algorithms ThreatStream deploys. Higher the threatscore, higher the risk. Threatscore ranges from 0-100, in increasing order of risk.
    description: Checks the reputation of the given IP or domain name
  - name: file
    arguments:
    - name: file
      required: true
      description: The checksum to check
    - name: threshold
      description: If ThreatScore is greater or equal than the threshold, then file will be considered malicious
      defaultValue: "3"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: File.MD5
      description: File MD5
    - contextPath: File.Malicious.Vendor
      description: Usually an obfuscated description of the source of the indicator; the description may not be obfuscated if the user belongs to your organization.
    - contextPath: File.Score
      description: A value assigned to the indicator through machine-learning algorithms ThreatStream deploys. Higher the threatscore, higher the risk. Threatscore ranges from 0-100, in increasing order of risk.
    description: Checks the reputation of the given checksum
  - name: threatstream-email-reputation
    arguments:
    - name: email
      required: true
      description: The email address to check
    - name: threshold
      description: If ThreatScore is greater or equal than the threshold, then email will be considered malicious
      defaultValue: "3"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: ThreatStream.EmailReputation.Itype
      description: The indicator type.
    - contextPath: ThreatStream.EmailReputation.Created
      description: When the indicator was first seen on the ThreatStream cloud platform. For example, 2014-10-02T20:44:35
    - contextPath: ThreatStream.EmailReputation.Modified
      description: When the indicator was last updated on the ThreatStream cloud platform
    - contextPath: ThreatStream.EmailReputation.Confidence
      description: Confidence value assigned to the indicator. Confidence score can range from 0-100, in increasing order of confidence.
    - contextPath: ThreatStream.EmailReputation.Details1
      description: A string that contains a tag associated with the indicator; the tag can be used to search for related indicators.
    - contextPath: ThreatStream.EmailReputation.Details2
      description: Additional details associated with state of an indicator. For example, details such as why is an indicator marked false positive.
    - contextPath: ThreatStream.EmailReputation.Status
      description: Status assigned to the indicator
    - contextPath: ThreatStream.EmailReputation.ThreatScore
      description: A value assigned to the indicator through machine-learning algorithms ThreatStream deploys. Higher the threatscore, higher the risk. Threatscore ranges from 0-100, in increasing order of risk.
    - contextPath: ThreatStream.EmailReputation.Email
      description: The email address
    - contextPath: ThreatStream.EmailReputation.Severity
      description: 'Severity assigned to the indicator through machine-learning algorithms ThreatStream deploys. Possible values: low, medium, high, very high'
    description: Checks the reputation of the given email
  - name: ip
    arguments:
    - name: ip
      required: true
      description: The IP to check
    - name: threshold
      description: If ThreatScore is greater or equal than the threshold, then ip will be considered malicious
      defaultValue: "3"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: IP.ASN
      description: Autonomous System (AS) number associated with the indicator
    - contextPath: IP.Address
      description: IP Address
    - contextPath: IP.Geo.Country
      description: Country associated with the indicator.
    - contextPath: IP.Geo.Organization
      description: Registered owner (organization) of the IP address associated with the indicator.
    - contextPath: IP.Geo.Location
      description: Longitude and Latitude of the IP address
    - contextPath: IP.Malicious.Vendor
      description: Usually an obfuscated description of the source of the indicator; the description may not be obfuscated if the user belongs to your organization.
    - contextPath: IP.Score
      description: A value assigned to the indicator through machine-learning algorithms ThreatStream deploys. Higher the threatscore, higher the risk. Threatscore ranges from 0-100, in increasing order of risk.
    - contextPath: IP.Hostname
      description: Domain name (obtained through reverse domain name lookup) associated with the IP address that is associated with the indicator.
    description: Checks the reputation of the given IP
  - name: threatstream-push-indicator
    arguments:
    - name: confidenceWeight
      required: true
      description: To use your source's confidence entirely, set source_confidence_ weight to 100.
      defaultValue: "100"
    - name: indicator
      required: true
      description: indicator value (1.2.3.4/google.com etc)
    - name: indicatorType
      required: true
      auto: PREDEFINED
      predefined:
      - srcip
      - domain
      - url
      - email
      - md5
      description: type of indicator to insert
    - name: itype
      required: true
      auto: PREDEFINED
      predefined:
      - bot_ip
      - mal_domain
      - mal_url
      - compromised_email
      - apt_md5
      description: indicator type (internal by threat stream, complete list can be found in API docs)
    - name: classification
      required: true
      auto: PREDEFINED
      predefined:
      - public
      - private
      description: Classification of the indicator—public or private
      defaultValue: private
    - name: confidence
      required: true
      description: Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence
      defaultValue: "100"
    - name: severity
      required: true
      description: 'Severity you want to assign to the indicator when it is imported. Possible values: low, medium, high, very-high'
      defaultValue: "100"
    description: Push indicator into ThreatStream
tests:
- Anomali_ThreatStream_Test
fromversion: 5.0.0