Anomali Enterprise

Use Anomali Match to search indicators and enrich domains.

Configure Anomali Match in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anomali-enterprise-retro-forensic-search

Initiates a forensic search of the indicators.

Base Command

anomali-enterprise-retro-forensic-search

Input

Context Output

Command Example

!anomali-enterprise-retro-forensic-search indicators=1.1.1.1 from="1 month"

Context Example

{
    "AnomaliEnterprise": {
        "ForensicSearch": {
            "job_id": "job1271604409989806",
            "status": "in progress"
        }
    }
}

Human Readable Output

Forensic search started

job_id	status
job1271604409989806	in progress

anomali-enterprise-retro-forensic-search-results

Retrieves the forensic search results.

Base Command

anomali-enterprise-retro-forensic-search-results

Input

Context Output

Command Example

!anomali-enterprise-retro-forensic-search-results job_id=job1251604409794526

Context Example

{
    "AnomaliEnterprise": {
        "ForensicSearch": {
            "category": "forensic_api_result",
            "complete": true,
            "job_id": "job1251604409794526",
            "processedFiles": 1,
            "result_file_name": "org0_20201103_job1251604409794526_result.tar.gz",
            "scannedEvents": 361295,
            "status": "completed",
            "streamResults": [
                {
                    "age": "",
                    "confidence": "",
                    "count": "1",
                    "event.dest": "1.1.1.1",
                    "event.src": "1.1.1.1",
                    "event_time": "2020-10-14T09:10:00.000+0000",
                    "indicator": "",
                    "itype": "",
                    "severity": ""
                }
            ],
            "totalFiles": 1,
            "totalMatches": 1
        }
    }
}

Human Readable Output

Forensic search metadata

status	job_id	category	totalFiles	scannedEvents
completed	job1251604409794526	forensic_api_result	1	361295

Forensic search results

count	event.dest	event.src	event_time
1	1.1.1.1	1.1.1.1	2020-10-14T09:10:00.000+0000

anomali-enterprise-dga-domain-status

The search domains Domain Generation Algorithm (DGA).

Base Command

anomali-enterprise-dga-domain-status

Input

Context Output

Command Example

!anomali-enterprise-dga-domain-status domains=amazon.com

Context Example

{
    "AnomaliEnterprise": {
        "DGA": {
            "domain": "amazon.com",
            "malware_family": "",
            "probability": 0
        }
    }
}

Human Readable Output

Domains DGA

domain	probability
amazon.com	0

domain

The search domains Domain Generation Algorithm (DGA). Includes DBotScore and domain information.
There is no distinction between benign to unknown domains in Anomali Enterprise.
The Domain reputation is calculated per the product documentation.
if malware family exists and prob > 0.6 the reputation is Malicious,
if malware family exists and prob < 0.6 the reputation is Suspicious,
else, the reputation is Unknown.

Base Command

domain

Input

Context Output

Command Example

!domain domain=google.com

Context Example

{
    "AnomaliEnterprise": {
        "DGA": {
            "domain": "google.com",
            "malware_family": "",
            "probability": 0
        }
    },
    "DBotScore": {
        "Indicator": "google.com",
        "Score": 0,
        "Type": "domain",
        "Vendor": "Anomali Enterprise"
    },
    "Domain": {
        "Name": "google.com"
    }
}

Human Readable Output

Domains DGA

domain	probability
google.com	0