Anomali Enterprise

Details

ID	`Anomali Enterprise`
Provider	Anomali
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use Anomali Match to search indicators and enrich domains.

Configure Anomali Match in Cortex

Parameter	Description	Required
url	Server URL (e.g., https://www.test.com)	True
credentials	Username	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anomali-enterprise-retro-forensic-search

Initiates a forensic search of the indicators.

Base Command

anomali-enterprise-retro-forensic-search

Input

Argument Name	Description	Required
from	The time the indicators first appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is 1 day ago.	Optional
to	The time the indicators last appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is now.	Optional
indicators	A comma-separated list of indicators to search.	Required

Context Output

Path	Type	Description
AnomaliEnterprise.ForensicSearch.job_id	String	The job ID of the search.
AnomaliEnterprise.ForensicSearch.status	String	The status of the search.

Command Example

!anomali-enterprise-retro-forensic-search indicators=1.1.1.1 from="1 month"

Context Example

{
    "AnomaliEnterprise": {
        "ForensicSearch": {
            "job_id": "job1271604409989806",
            "status": "in progress"
        }
    }
}

Human Readable Output

Forensic search started

job_id status

job1271604409989806 in progress

job_id	status
job1271604409989806	in progress

anomali-enterprise-retro-forensic-search-results

Retrieves the forensic search results.

Base Command

anomali-enterprise-retro-forensic-search-results

Input

Argument Name	Description	Required
job_id	The forensic search job ID.	Required
limit	Limit the stream results to return. Default is 20.	Optional
verbose	Whether to print the stream results to the War Room. Default is “true”.	Optional

Context Output

Path	Type	Description
AnomaliEnterprise.ForensicSearch.job_id	String	The job ID of the search.
AnomaliEnterprise.ForensicSearch.status	String	The status of the search.
AnomaliEnterprise.ForensicSearch.scannedEvents	Number	The number of scanned events.
AnomaliEnterprise.ForensicSearch.processedFiles	Number	The number of processed files.
AnomaliEnterprise.ForensicSearch.result_file_name	String	The matched file name.
AnomaliEnterprise.ForensicSearch.totalMatches	Number	The number of total matches.
AnomaliEnterprise.ForensicSearch.complete	Bool	Whether the search was complete.
AnomaliEnterprise.ForensicSearch.category	String	The search category.
AnomaliEnterprise.ForensicSearch.streamResults	Unknown	The stream results for the search.

Command Example

!anomali-enterprise-retro-forensic-search-results job_id=job1251604409794526

Context Example

{
    "AnomaliEnterprise": {
        "ForensicSearch": {
            "category": "forensic_api_result",
            "complete": true,
            "job_id": "job1251604409794526",
            "processedFiles": 1,
            "result_file_name": "org0_20201103_job1251604409794526_result.tar.gz",
            "scannedEvents": 361295,
            "status": "completed",
            "streamResults": [
                {
                    "age": "",
                    "confidence": "",
                    "count": "1",
                    "event.dest": "1.1.1.1",
                    "event.src": "1.1.1.1",
                    "event_time": "2020-10-14T09:10:00.000+0000",
                    "indicator": "",
                    "itype": "",
                    "severity": ""
                }
            ],
            "totalFiles": 1,
            "totalMatches": 1
        }
    }
}

Human Readable Output

Forensic search metadata

status job_id category totalFiles scannedEvents

completed job1251604409794526 forensic_api_result 1 361295

status	job_id	category	totalFiles	scannedEvents
completed	job1251604409794526	forensic_api_result	1	361295

Forensic search results

count event.dest event.src event_time

1 1.1.1.1 1.1.1.1 2020-10-14T09:10:00.000+0000

count	event.dest	event.src	event_time
1	1.1.1.1	1.1.1.1	2020-10-14T09:10:00.000+0000

anomali-enterprise-dga-domain-status

The search domains Domain Generation Algorithm (DGA).

Base Command

anomali-enterprise-dga-domain-status

Input

Argument Name	Description	Required
domains	A comma-separated list of domains to search.	Required

Context Output

Path	Type	Description
AnomaliEnterprise.DGA.domain	String	The domain that was checked.
AnomaliEnterprise.DGA.malware_family	String	The malware family associated with the domain.
AnomaliEnterprise.DGA.domain	Number	The probability of the domain being malicious.

Command Example

!anomali-enterprise-dga-domain-status domains=amazon.com

Context Example

{
    "AnomaliEnterprise": {
        "DGA": {
            "domain": "amazon.com",
            "malware_family": "",
            "probability": 0
        }
    }
}

Human Readable Output

Domains DGA

domain probability

amazon.com 0

domain	probability
amazon.com	0

domain

The search domains Domain Generation Algorithm (DGA). Includes DBotScore and domain information.
There is no distinction between benign to unknown domains in Anomali Enterprise.
The Domain reputation is calculated per the product documentation.
if malware family exists and prob > 0.6 the reputation is Malicious,
if malware family exists and prob < 0.6 the reputation is Suspicious,
else, the reputation is Unknown.

Base Command

domain

Input

Argument Name	Description	Required
domain	A comma-separated list of domains to search.	Optional

Context Output

Path	Type	Description
AnomaliEnterprise.DGA.domain	String	The domain that was checked.
AnomaliEnterprise.DGA.malware_family	String	The malware family associated with the domain.
AnomaliEnterprise.DGA.domain	Number	The probability of the domain being malicious.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
Domain.Name	String	The domain name. For example, “google.com”.
Domain.Malicious.Vendor	String	The vendor that reported that the domain is malicious.
Domain.Malicious.Description	String	A description of the malicious domain.

Command Example

!domain domain=google.com

Context Example

{
    "AnomaliEnterprise": {
        "DGA": {
            "domain": "google.com",
            "malware_family": "",
            "probability": 0
        }
    },
    "DBotScore": {
        "Indicator": "google.com",
        "Score": 0,
        "Type": "domain",
        "Vendor": "Anomali Enterprise"
    },
    "Domain": {
        "Name": "google.com"
    }
}

Human Readable Output

Domains DGA

domain probability

google.com 0

domain	probability
google.com	0

Configuration parameters

url — Server URL (e.g., https://www.test.com) (required)
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (4)

anomali-enterprise-dga-domain-status
The search domains Domain Generation Algorithm (DGA).
anomali-enterprise-retro-forensic-search
Initiates a forensic search of the indicators.
anomali-enterprise-retro-forensic-search-results
Retrieves the forensic search results.
domain
The search domains Domain Generation Algorithm (DGA). Includes DBotScore and domain information.

Source

Anomali_Enterprise.py Anomali_Enterprise_test.py Anomali_Enterprise.yml Anomali_Enterprise_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Anomali
commonfields:
  id: Anomali Enterprise
  version: -1
configuration:
- defaultvalue: https://127.0.0.1:8080
  display: Server URL (e.g., https://www.test.com)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: Use Anomali Match to search indicators and enrich domains.
display: Anomali Match
name: Anomali Enterprise
script:
  commands:
  - arguments:
    - description: 'The time the indicators first appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is 1 day ago.'
      name: from
    - description: 'The time the indicators last appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is now.'
      name: to
    - description: A comma-separated list of indicators to search.
      isArray: true
      name: indicators
      required: true
    description: Initiates a forensic search of the indicators.
    name: anomali-enterprise-retro-forensic-search
    outputs:
    - contextPath: AnomaliEnterprise.ForensicSearch.job_id
      description: The job ID of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.status
      description: The status of the search.
      type: String
  - arguments:
    - description: The forensic search job ID.
      isArray: true
      name: job_id
      required: true
    - defaultValue: '20'
      description: Limit the stream results to return. Default is 20.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether to print the stream results to the War Room. Default is "true".
      predefined:
      - 'false'
      - 'true'
      name: verbose
    description: Retrieves the forensic search results.
    name: anomali-enterprise-retro-forensic-search-results
    outputs:
    - contextPath: AnomaliEnterprise.ForensicSearch.job_id
      description: The job ID of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.status
      description: The status of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.scannedEvents
      description: The number of scanned events.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.processedFiles
      description: The number of processed files.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.result_file_name
      description: The matched file name.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.totalMatches
      description: The number of total matches.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.complete
      description: Whether the search was complete.
      type: Bool
    - contextPath: AnomaliEnterprise.ForensicSearch.category
      description: The search category.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.streamResults
      description: The stream results for the search.
      type: Unknown
  - arguments:
    - description: A comma-separated list of domains to search.
      isArray: true
      name: domains
      required: true
    description: The search domains Domain Generation Algorithm (DGA).
    name: anomali-enterprise-dga-domain-status
    outputs:
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The domain that was checked.
      type: String
    - contextPath: AnomaliEnterprise.DGA.malware_family
      description: The malware family associated with the domain.
      type: String
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The probability of the domain being malicious.
      type: Number
  - arguments:
    - default: true
      description: A comma-separated list of domains to search.
      isArray: true
      name: domain
    description: The search domains Domain Generation Algorithm (DGA). Includes DBotScore and domain information.
    name: domain
    outputs:
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The domain that was checked.
      type: String
    - contextPath: AnomaliEnterprise.DGA.malware_family
      description: The malware family associated with the domain.
      type: String
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The probability of the domain being malicious.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Name
      description: The domain name. For example, "google.com".
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor that reported that the domain is malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description of the malicious domain.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- Anomali Match Forensic Search - Test