Anomali ThreatStream v2 Deprecated

Deprecated. Use Anomali ThreatStream v3 integration instead.

Data Enrichment & Threat Intelligence · Anomali ThreatStream

Details

IDAnomali ThreatStream v2
ProviderAnomali
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/py3-tools:1.0.0.43697
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use Anomali ThreatStream to query and submit threats.

Anomali ThreatStream v2 Playbook

  • Detonate File - ThreatStream
  • Detonate URL - ThreatStream

Use Cases

  1. Get threat intelligence from the ThreatStream platform.
  2. Create and manage threat models.
  3. Import indicators to ThreatStream platform.
  4. Submit file or URL to sandbox and receive an analysis report.

Configure Anomali ThreatStream v2 in Cortex

Parameter Description Required
url Server URL (e.g., https://www.test.com) True
username Username True
apikey API Key True
default_threshold Threshold of the indicator. True
Source Reliability Reliability of the source providing the intelligence data. The default value is B - Usually reliable. True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Checks the reputation of the given IP.

Base Command

ip

Input

Argument Name Description Required
ip The IP to check. Required
threshold If severity is greater than or equal to the threshold, then the IP address will be considered malicious. This argument will override the default threshold defined as a parameter. Optional
include_inactive Whether to include results with the status “Inactive”. Default is “False”. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
IP.ASN String Autonomous System (AS) number associated with the indicator.
IP.Address String IP address of the indicator.
IP.Geo.Country String Country associated with the indicator.
IP.Geo.Location String Longitude and latitude of the IP address.
IP.Tags Unknown (List) Tags of the IP.
ThreatStream.IP.ASN String Autonomous System (AS) number associated with the indicator.
ThreatStream.IP.Address String IP address of the indicator.
ThreatStream.IP.Country String Country associated with the indicator.
ThreatStream.IP.Type String The indicator type.
ThreatStream.IP.Modified String Time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.IP.Severity String The indicator severity (“very-high”, “high”, “medium”, or “low”.
ThreatStream.IP.Confidence String Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.IP.Status String Status assigned to the indicator.
ThreatStream.IP.Organization String Name of the business that owns the IP address associated with the indicator.
ThreatStream.IP.Source String The source of the indicator.
ThreatStream.IP.Tags Unknown Tags assigned to the IP.
DBotScore.Score Number The actual score.
IP.Malicious.Vendor String Vendor that reported the indicator as malicious.

Command Example

ip ip=39.41.26.166 using-brand="Anomali ThreatStream v2"

Context Example

{
    "IP": {
        "Geo": {
            "Country": "PK", 
            "Location": "33.6007,73.0679"
        }, 
        "ASN": "45595", 
        "Address": "39.41.26.166",
        "Tags": ["phish-target", "victim-hi-tech"]
    }, 
    "DBotScore": {
        "Vendor": "TOR Exit Nodes", 
        "Indicator": "39.41.26.166", 
        "Score": 2, 
        "Type": "ip"
    }, 
    "ThreatStream.IP": {
        "Status": "active", 
        "Confidence": 96, 
        "Severity": "low", 
        "Country": "PK", 
        "Modified": "2019-06-24T10:10:12.289Z", 
        "Source": "TOR Exit Nodes", 
        "Address": "39.41.26.166", 
        "Organization": "PTCL", 
        "Type": "ip", 
        "Tags": [{"id": "4wq", "name": "phish-target", "org_id": "88"}, {"id": "ezn", "name": "victim-hi-tech", "org_id": "88"}],
        "ASN": "45595"
    }
}

Human Readable Output

IP reputation for: 39.41.26.166
Address Confidence Source Type Status Modified Organization ASN Country Severity
39.41.26.166 96 TOR Exit Nodes ip active 2019-06-24T10:10:12.289Z PTCL 45595 PK low

domain

Checks the reputation of the given domain name.

Base Command

domain

Input

Argument Name Description Required
domain The domain name to check. Required
threshold If severity is greater than or equal to the threshold, then the IP address will be considered malicious. This argument will override the default threshold defined as a parameter. Optional
include_inactive Whether to include results with status of “Inactive”. Default is “False”. Optional

Context Output

Path Type Description
Domain.Name String The domain name.
Domain.DNS String IPs resolved by DNS.
Domain.Tags Unknown (List) Tags of the domain.
Domain.WHOIS.CreationDate Date Date the domain was created. The date format is: YYYYMMDDThhmmss. Where T denotes the start of the value for time, in UTC time.
Domain.WHOIS.UpdatedDate Date Date the domain was last updated. The date format is: YYYYMMDDThhmmss. Where T denotes the start of the value for time, in UTC time.
Domain.WHOIS.Registrant.Name String Name of the registrant.
Domain.WHOIS.Registrant.Email String Email address of the registrant.
Domain.WHOIS.Registrant.Phone String Phone number of the registrant.
ThreatStream.Domain.ASN String Autonomous System (AS) number associated with the indicator.
ThreatStream.Domain.Address String The domain name of the indicator.
ThreatStream.Domain.Country String Country associated with the indicator.
ThreatStream.Domain.Type String The indicator type.
ThreatStream.Domain.Modified String Date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.Domain.Severity String The indicator severity (“very-high”, “high”, “medium”, “low”).
ThreatStream.Domain.Confidence String Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.Domain.Status String Status assigned to the indicator.
ThreatStream.Domain.Organization String Name of the business that owns the IP address associated with the indicator.
ThreatStream.Domain.Source String The source of the indicator.
ThreatStream.Domain.Tags Unknown Tags assigned to the domain.
Domain.Malicious.Vendor String Vendor that reported the indicator as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

domain domain="microsoftfaq.com" using-brand="Anomali ThreatStream v2" 
Context Example
{
    "ThreatStream.Domain": {
        "Status": "active", 
        "Confidence": 38, 
        "Severity": "high", 
        "Country": null, 
        "Modified": "2019-06-24T08:39:04.644Z", 
        "Source": "Analyst", 
        "Address": "microsoftfaq.com", 
        "Organization": "", 
        "Type": "domain", 
        "Tags": ["phish-target", "victim-hi-tech"],
        "ASN": ""
    }, 
    "Domain": {
        "Malicious": {
            "Vendor": "ThreatStream"
        }, 
        "Name": "microsoftfaq.com", 
        "DNS": "127.0.0.1", 
        "WHOIS": {
            "UpdatedDate": "2019-06-24T08:39:04.644Z", 
            "CreationDate": "2019-06-24T08:38:53.246Z", 
            "Registrant": {
                "Phone": "", 
                "Email": "", 
                "Name": "Registrant City:"
            }
        },
        "Tags": [{"id": "4wq", "name": "phish-target", "org_id": "88"}, {"id": "ezn", "name": "victim-hi-tech", "org_id": "88"}]
    }, 
    "DBotScore": {
        "Vendor": "Analyst", 
        "Indicator": "microsoftfaq.com", 
        "Score": 3, 
        "Type": "domain"
    }
}

Human Readable Output

Domain reputation for: microsoftfaq.com

Address Confidence Source Type Status Modified Organization ASN Country Severity
microsoftfaq.com 38 Analyst domain active 2019-06-24T08:39:04.644Z       high

file

Checks the reputation of the given hash of the file.

Base Command

file

Input

Argument Name Description Required
file The hash of file to check. Required
threshold If severity is greater than or equal to the threshold, then the hash of file will be considered malicious. This argument will override the default threshold defined as a parameter. Optional
include_inactive Whether to include results with the status “Inactive”. Default is “False”. Optional

Context Output

Path Type Description
File.MD5 String MD5 hash of the file.
File.SHA1 String SHA1 hash of the file.
File.SHA256 String SHA256 hash of the file.
File.SHA512 String SHA512 hash of the file.
File.Malicious.Vendor String Vendor that reported the indicator as malicious.
File.Tags Unknown (List) Tags of the file.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
ThreatStream.File.Severity String The indicator severity (“very-high”, “high”, “medium”, “low”).
ThreatStream.File.Confidence String Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.File.Status String Status assigned to the indicator.
ThreatStream.File.Type String The indicator type.
ThreatStream.File.MD5 String The MD5 hash of the indicator.
ThreatStream.File.SHA1 String The SHA1 hash of the indicator.
ThreatStream.File.SHA256 String The SHA256 hash of the indicator.
ThreatStream.File.SHA512 String The SHA512 hash of the indicator.
ThreatStream.File.Modified String Date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.File.Source String The source of the indicator.
ThreatStream.File.Tags Unknown Tags assigned to the file.

Command Example

file file=07df6c1d9a76d81f191be288d463784b using-brand="Anomali ThreatStream v2"

Context Example

{
    "DBotScore": {
        "Vendor": "URLHaus Hashes", 
        "Indicator": "07df6c1d9a76d81f191be288d463784b", 
        "Score": 2, 
        "Type": "md5"
    }, 
    "ThreatStream.File": {
        "Status": "active", 
        "Confidence": 75, 
        "Severity": "medium", 
        "Modified": "2019-06-24T10:13:27.284Z", 
        "Source": "URLHaus Hashes", 
        "Type": "md5", 
        "Tags": [{"id": "4wq", "name": "phish-target", "org_id": "88"}, {"id": "ezn", "name": "victim-hi-tech", "org_id": "88"}],
        "MD5": "07df6c1d9a76d81f191be288d463784b"
    }, 
    "File": {
        "MD5": "07df6c1d9a76d81f191be288d463784b",
        "Tags": ["phish-target", "victim-hi-tech"]
    }
}

Human Readable Output

MD5 reputation for: 07df6c1d9a76d81f191be288d463784b
Confidence Source Type Status Modified Severity MD5
75 URLHaus Hashes md5 active 2019-06-24T10:13:27.284Z medium 07df6c1d9a76d81f191be288d463784b

threatstream-email-reputation

Checks the reputation of the given email address.

Base Command

threatstream-email-reputation

Input

Argument Name Description Required
email The email address to check. Required
threshold If severity is greater or equal than the threshold, then the IP address will be considered malicious. This argument will override the default threshold defined as a parameter. Optional
include_inactive Whether to include results with the status “Inactive”. Default is “False”. Optional

Context Output

Path Type Description
DBotScore.Indicator String The tested indicator.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
ThreatStream.EmailReputation.Severity String The indicator severity (“very-high”, “high”, “medium”, “low”).
ThreatStream.EmailReputation.Confidence String Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.EmailReputation.Status String Status assigned to the indicator.
ThreatStream.EmailReputation.Type String The indicator type.
ThreatStream.EmailReputation.Email String The email address of the indicator.
ThreatStream.EmailReputation.Source String The source of the indicator.
ThreatStream.EmailReputation.Modified String Date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.EmailReputation.Tags Unknown Tags assigned to the email.

Command Example

threatstream-email-reputation email=goo@test.com

Context Example

{
    "DBotScore": {
        "Vendor": "Anomali Labs Compromised Credentials", 
        "Indicator": "goo@test.com", 
        "Score": 2, 
        "Type": "email"
    }, 
    "ThreatStream.EmailReputation": {
        "Status": "active", 
        "Confidence": 100, 
        "Severity": "low", 
        "Modified": "2019-06-24T09:50:23.810Z", 
        "Source": "Anomali Labs Compromised Credentials", 
        "Type": "email", 
        "Tags": [{"id": "4wq", "name": "phish-target", "org_id": "88"}, {"id": "ezn", "name": "victim-hi-tech", "org_id": "88"}],
        "Email": "goo@test.com"
    }
}

Human Readable Output

Email reputation for: foo@test.com
Confidence Source Type Status Modified Severity Email
100 Anomali Labs Compromised Credentials email active 2019-06-24T09:50:23.810Z low foo@test.com

threatstream-get-passive-dns

Returns enrichment data for Domain or IP for availabe observables.

Base Command

threatstream-get-passive-dns

Input

Argument Name Description Required
type The type of passive DNS search (“ip”, “domain”). Required
value Possible values are “IP” or “Domain”. Required
limit Maximum number of results to return. Default is 50. Optional

Context Output

Path Type Description
ThreatStream.PassiveDNS.Domain String The domain value.
ThreatStream.PassiveDNS.Ip String The IP value.
ThreatStream.PassiveDNS.Rrtype String The Rrtype value.
ThreatStream.PassiveDNS.Source String The source value.
ThreatStream.PassiveDNS.FirstSeen String The first seen date. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.PassiveDNS.LastSeen String The last seen date. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.

Command Example

threatstream-get-passive-dns type=domain value=discoverer.blog

Context Example

{
    "ThreatStream.PassiveDNS": [
        {
            "Domain": "discoverer.blog", 
            "Ip": "184.168.221.52", 
            "Rrtype": "A", 
            "Source": "Spamhaus", 
            "LastSeen": "2019-06-23T08:09:54", 
            "FirstSeen": "2019-06-23T08:09:54"
        }, 
        {
            "Domain": "discoverer.blog", 
            "Ip": "50.63.202.51", 
            "Rrtype": "A", 
            "Source": "Spamhaus", 
            "LastSeen": "2019-06-21T10:33:54", 
            "FirstSeen": "2019-06-21T10:33:54"
        }
    ]
}

Human Readable Output

Passive DNS enrichment data for: discoverer.blog
Domain Ip Rrtype Source FirstSeen LastSeen
discoverer.blog 184.168.221.52 A Spamhaus 2019-06-23T08:09:54 2019-06-23T08:09:54
discoverer.blog 50.63.202.51 A Spamhaus 2019-06-21T10:33:54 2019-06-21T10:33:54

threatstream-import-indicator-with-approval

Imports indicators (observables) into ThreatStream. Approval of the imported data is required, usingh the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL. Only one argument can be used.

Base Command

threatstream-import-indicator-with-approval

Input

Argument Name Description Required
confidence The level of certainty that an observable is of the reported indicator type. Default is 50. Optional
classification Denotes whether the indicator data is public or private to the organization. Default is “private”. Optional
threat_type Type of threat associated with the imported observables. Default is “exploit”. Optional
severity The potential impact of the indicator type with which the observable is thought to be associated. Default is “low”. Optional
import_type The import type of the indicator. Can be datatext, file-id, or url. Required
import_value The source of imported data. Can be one of the following: url, datatext of file-id of uploaded file to the War Rroom. Supported file types for file-id are: CSV, HTML, IOC, JSON, PDF, TXT. Required
ip_mapping Whether to include IP mapping. Whether to include url mapping. Can be yes or no. Default is no. Optional
domain_mapping Whether to include domain mapping. Whether to include url mapping. Can be yes or no. Default is no. Optional
url_mapping Whether to include url mapping. Can be yes or no. Default is no. Optional
email_mapping Whether to include email mapping. Whether to include url mapping. Can be yes or no. Default is no. Optional
md5_mapping Whether to include MD5 mapping. Whether to include url mapping. Can be yes or no. Default is no. Optional

Command Example

threatstream-import-indicator-with-approval import_type="file-id" import_value=5403@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0

Context Example

{
    "File": {
        "EntryID": "5403@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "MD5": "5b7ed7973e4deb3c98ee3a4bd6d911af",
        "Name": "input.csv",
        "SHA1": "055c5002eb5a4d4abe2eb1768e925bfc3a1a763e",
        "SHA256": "fd16220852b39e2c8fa51766750e3991670766512836212c799c5a0537e3ef8c",
        "SSDeep": "3:Wg8oEIjOH9+KS3qvRBTdRi690oVqzBUGyT0/n:Vx0HgKnTdE6eoVafY8",
        "Size": 102,
        "Type": "UTF-8 Unicode (with BOM) text, with CRLF line terminators\n"
    },
    "ThreatStream": {
        "Import": {
            "ImportID": "894516"
        }
    }
}

Human Readable Output

The data was imported successfully. The ID of imported job is: 894514

threatstream-import-indicator-without-approval

Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API.

Base Command

threatstream-import-indicator-without-approval

Input

Argument Name Description Required
confidence The level of certainty that an observable is of the reported indicator type. Default is 50. Optional
source_confidence_weight To use your specified confidence entirely, set source_confidence_ weight to 100. Optional
expiration_ts Time stamp of when intelligence will expire on ThreatStream, in ISO format. For example, 2020-12-24T00:00:00. Optional
severity Severity you want to assign to the observable when it is imported. Optional
tags Comma-separated list of tags. e.g. tag1,tag2. Optional
trustedcircles ID of the trusted circle with which this threat data should be shared. If you want to import the threat data to multiple trusted circles, enter a list of comma-separated IDs. Optional
classification Denotes whether the indicator data is public or private to the organization. Required
allow_unresolved When set to true, domain observables included in the file which do not resolve will be accepted as valid in ThreatStream and imported. Optional
file_id Entry id of uploaded file to war room containing a json with “objects” array and “meta” maps. Required

threatstream-get-model-list

Returns a list of threat model.

Base Command

threatstream-get-model-list

Input

Argument Name Description Required
model Threat model of the returned list. Required
limit Limits the list of models size. Specifying limit=0 will return up to a maximum of 1000 models. In case of limit=0 the output won’t be set in the context. Optional

Context Output

Path Type Description
ThreatStream.List.Type String The type of threat model.
ThreatStream.List.Name String The name of the threat model.
ThreatStream.List.ID String The ID of the threat model.
ThreatStream.List.CreatedTime String Date and time of threat model creation. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.

Command Example

threatstream-get-model-list model=actor limit=10

Context Example

{
    "ThreatStream.List": [
        {
            "CreatedTime": "2015-06-29T17:02:01.885011", 
            "Type": "Actor", 
            "ID": 2, 
            "Name": "Pirpi"
        }, 
        {
            "CreatedTime": "2015-06-30T19:20:05.930697", 
            "Type": "Actor", 
            "ID": 3, 
            "Name": "TeamCyberGhost"
        }, 
        {
            "CreatedTime": "2015-07-01T18:10:53.241301", 
            "Type": "Actor", 
            "ID": 4, 
            "Name": "Wekby"
        }, 
        {
            "CreatedTime": "2015-07-01T19:27:06.180602", 
            "Type": "Actor", 
            "ID": 5, 
            "Name": "Axiom"
        }, 
        {
            "CreatedTime": "2015-07-01T19:52:56.019862", 
            "Type": "Actor", 
            "ID": 7, 
            "Name": "Peace (Group) a/k/a C0d0s0"
        }, 
        {
            "CreatedTime": "2015-07-01T19:58:50.741202", 
            "Type": "Actor", 
            "ID": 8, 
            "Name": "Nitro"
        }, 
        {
            "CreatedTime": "2015-07-06T16:06:12.123839", 
            "Type": "Actor", 
            "ID": 9, 
            "Name": "Comment Crew"
        }, 
        {
            "CreatedTime": "2015-07-07T17:40:04.920012", 
            "Type": "Actor", 
            "ID": 10, 
            "Name": "Comfoo"
        }, 
        {
            "CreatedTime": "2015-07-07T18:53:12.331221", 
            "Type": "Actor", 
            "ID": 11, 
            "Name": "Syrian Electronic Army"
        }, 
        {
            "CreatedTime": "2015-07-08T20:59:29.751919", 
            "Type": "Actor", 
            "ID": 12, 
            "Name": "DD4BC"
        }
    ]
}

Human Readable Output

List of Actors
CreatedTime ID Name Type
2015-06-29T17:02:01.885011 2 Pirpi Actor
2015-06-30T19:20:05.930697 3 TeamCyberGhost Actor
2015-07-01T18:10:53.241301 4 Wekby Actor
2015-07-01T19:27:06.180602 5 Axiom Actor
2015-07-01T19:52:56.019862 7 Peace (Group) a/k/a C0d0s0 Actor
2015-07-01T19:58:50.741202 8 Nitro Actor
2015-07-06T16:06:12.123839 9 Comment Crew Actor
2015-07-07T17:40:04.920012 10 Comfoo Actor
2015-07-07T18:53:12.331221 11 Syrian Electronic Army Actor
2015-07-08T20:59:29.751919 12 DD4BC Actor

threatstream-get-model-description

Returns an HTML file with a description of the threat model.

Base Command

threatstream-get-model-description

Input

Argument Name Description Required
model The threat model. Required
id The ID of the threat model. Required

Context Output

Path Type Description
File.Name String The file name of the model desctiption.
File.EntryID String The entry ID of the model desctipton.

Command Example

threatstream-get-model-description model=campaign id=1406
Context Example
{
    "File": {
        "EntryID": "5384@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0",
        "Extension": "html",
        "Info": "text/html; charset=utf-8",
        "MD5": "66eabc1c704fdac429939eb09bc5346f",
        "Name": "campaign_1406.html",
        "SHA1": "69f3dfe8ae037253e782dd201904aa583d83bcd7",
        "SHA256": "49635483962b38a2fd5d50ebbb51b7002ecab3fd23e0f9f99e915f7b33d3f739",
        "SSDeep": "96:XZcBqz4xqHC2AwALc+nvJN7GBoBGK1IW7h:XC40W/tixmoLTh",
        "Size": 3686,
        "Type": "HTML document text, ASCII text, with very long lines, with no line terminators\n"
    }
}

threatstream-get-indicators-by-model

Returns a list of indicators associated with the specified model and ID of the model.

Base Command

threatstream-get-indicators-by-model

Input

Argument Name Description Required
model The threat model. Required
id The ID of the model. Required
limit Maximum number of results to return. Default is 20. Optional

Context Output

Path Type Description
ThreatStream.Model.ModelType String The type of the threat model.
ThreatStream.Model.ModelID String The ID of the threat model.
ThreatStream.Model.Indicators.Value String The value of indicator associated with the specified model.
ThreatStream.Model.Indicators.ID String The ID of indicator associated with the specified model.
ThreatStream.Model.Indicators.IType String The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity String The severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Confidence String The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country String The courty of the indicator associated with the specified model
ThreatStream.Model.Indicators.Organization String The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN String The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status String The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags String The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified String The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source String The source of the inidicator.
ThreatStream.Model.Indicators.Type String The type of the inidicator.

Command Example

threatstream-get-indicators-by-model id=11885 model=incident
Context Example
{
    "ThreatStream.Model": {
        "Indicators": [
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.446", 
                "Value": "417072b246af74647897978902f7d903562e0f6f", 
                "ID": "50117813617", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.455", 
                "Value": "d3c65377d39e97ab019f7f00458036ee0c7509a7", 
                "ID": "50117813616", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.462", 
                "Value": "5f51084a4b81b40a8fcf485b0808f97ba3b0f6af", 
                "ID": "50117813615", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.469", 
                "Value": "220a8eacd212ecc5a55d538cb964e742acf039c6", 
                "ID": "50117813614", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.477", 
                "Value": "a16ef7d96a72a24e2a645d5e3758c7d8e6469a55", 
                "ID": "50117813612", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.485", 
                "Value": "275e76fc462b865fe1af32f5f15b41a37496dd97", 
                "ID": "50117813611", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.493", 
                "Value": "df4b8c4b485d916c3cadd963f91f7fa9f509723f", 
                "ID": "50117813610", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.500", 
                "Value": "66eccea3e8901f6d5151b49bca53c126f086e437", 
                "ID": "50117813609", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.507", 
                "Value": "3d90630ff6c151fc2659a579de8d204d1c2f841a", 
                "ID": "50117813608", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.513", 
                "Value": "a6d14b104744188f80c6c6b368b589e0bd361607", 
                "ID": "50117813607", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.520", 
                "Value": "e3f183e67c818f4e693b69748962eecda53f7f88", 
                "ID": "50117813606", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.527", 
                "Value": "f326479a4aacc2aaf86b364b78ed5b1b0def1fbe", 
                "ID": "50117813605", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.534", 
                "Value": "c4d1fb784fcd252d13058dbb947645a902fc8935", 
                "ID": "50117813604", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.541", 
                "Value": "fb4a4143d4f32b0af4c2f6f59c8d91504d670b41", 
                "ID": "50117813603", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.548", 
                "Value": "400e4f843ff93df95145554b2d574a9abf24653f", 
                "ID": "50117813602", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.555", 
                "Value": "f82d18656341793c0a6b9204a68605232f0c39e7", 
                "ID": "50117813601", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.562", 
                "Value": "c33fe4c286845a175ee0d83db6d234fe24dd2864", 
                "ID": "50117813600", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.569", 
                "Value": "d9294b86b3976ddf89b66b8051ccf98cfae2e312", 
                "ID": "50117813599", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.576", 
                "Value": "9fc71853d3e6ac843bd36ce9297e398507e5b2bd", 
                "ID": "50117813597", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }, 
            {
                "Status": "active", 
                "Confidence": 100, 
                "IType": "mal_md5", 
                "Severity": "very-high", 
                "Tags": "FINSPY,FinSpy,community-threat-briefing,Weaponization", 
                "Country": null, 
                "Modified": "2017-09-25T11:43:54.583", 
                "Value": "c0ad9c242c533effd50b51e94874514a5b9f2219", 
                "ID": "50117813596", 
                "Source": "ThreatStream", 
                "Organization": "", 
                "Type": "md5", 
                "ASN": ""
            }
        ], 
        "ModelType": "Incident", 
        "ModelID": "11885"
    }
}

Human Readable Output

Indicators list for Threat Model Incident with id 11885
IType Value ID Confidence Source Type Status Tags Modified Organization ASN Country Severity
mal_md5 417072b246af74647897978902f7d903562e0f6f 50117813617 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.446       very-high
mal_md5 d3c65377d39e97ab019f7f00458036ee0c7509a7 50117813616 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.455       very-high
mal_md5 5f51084a4b81b40a8fcf485b0808f97ba3b0f6af 50117813615 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.462       very-high
mal_md5 220a8eacd212ecc5a55d538cb964e742acf039c6 50117813614 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.469       very-high
mal_md5 a16ef7d96a72a24e2a645d5e3758c7d8e6469a55 50117813612 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.477       very-high
mal_md5 275e76fc462b865fe1af32f5f15b41a37496dd97 50117813611 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.485       very-high
mal_md5 df4b8c4b485d916c3cadd963f91f7fa9f509723f 50117813610 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.493       very-high
mal_md5 66eccea3e8901f6d5151b49bca53c126f086e437 50117813609 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.500       very-high
mal_md5 3d90630ff6c151fc2659a579de8d204d1c2f841a 50117813608 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.507       very-high
mal_md5 a6d14b104744188f80c6c6b368b589e0bd361607 50117813607 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.513       very-high
mal_md5 e3f183e67c818f4e693b69748962eecda53f7f88 50117813606 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.520       very-high
mal_md5 f326479a4aacc2aaf86b364b78ed5b1b0def1fbe 50117813605 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.527       very-high
mal_md5 c4d1fb784fcd252d13058dbb947645a902fc8935 50117813604 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.534       very-high
mal_md5 fb4a4143d4f32b0af4c2f6f59c8d91504d670b41 50117813603 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.541       very-high
mal_md5 400e4f843ff93df95145554b2d574a9abf24653f 50117813602 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.548       very-high
mal_md5 f82d18656341793c0a6b9204a68605232f0c39e7 50117813601 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.555       very-high
mal_md5 c33fe4c286845a175ee0d83db6d234fe24dd2864 50117813600 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.562       very-high
mal_md5 d9294b86b3976ddf89b66b8051ccf98cfae2e312 50117813599 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.569       very-high
mal_md5 9fc71853d3e6ac843bd36ce9297e398507e5b2bd 50117813597 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.576       very-high
mal_md5 c0ad9c242c533effd50b51e94874514a5b9f2219 50117813596 100 ThreatStream md5 active FINSPY,FinSpy,community-threat-briefing,Weaponization 2017-09-25T11:43:54.583       very-high

threatstream-submit-to-sandbox

Submits a file or URL to the ThreatStream-hosted Sandbox for detonation.

Base Command

threatstream-submit-to-sandbox

Input

Argument Name Description Required
submission_classification Classification of the Sandbox submission. Optional
report_platform Platform on which the submitted URL or file will be run. To obtain a list supported platforms run the threatstream-get-sandbox-platforms command. Optional
submission_type The detonation type (“file” or “url”. Required
submission_value The submission value. Possible values are a valid URL or a file ID that was uploaded to the War Room to detonate. Required
premium_sandbox Specifies whether the premium sandbox should be used for detonation. Default is “false”. Optional
detail A CSV list of additional details for the indicator. This information is displayed in the Tag column of the ThreatStream UI. Optional

Context Output

Path Type Description
ThreatStream.Analysis.ReportID String The report ID that was submitted to the sandbox.
ThreatStream.Analysis.Status String The analysis status.
ThreatStream.Analysis.Platform String The platform of the submission submitted to the sanbox.

Command Example

threatstream-submit-to-sandbox submission_type=file submission_value=5358@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0 premium_sandbox=false report_platform=WINDOWS7

Context Example

{
    "File": {
        "EntryID": "5358@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0",
        "Extension": "png",
        "Info": "image/png",
        "MD5": "a36544c75d1253d8dd32070908adebd0",
        "Name": "input_file.png",
        "SHA1": "15868fbe28e34f601b4e07b0f356ecb1f3a14876",
        "SHA256": "5126eb938b3c2dc53837d4805df01c8522a3bd4e5e77e9bc4f825b9ee178e6ab",
        "SSDeep": "98304:pKOjdLh3d35gcNMjnN+FOLEdhVb2t6lLPP9nuyxJ4iQzxKxOduLT/GzxS3UvtT:pHhhvglN+F+GwUlLPP9PxnQzxKxOdEUR",
        "Size": 4938234,
        "Type": "PNG image data, 2572 x 1309, 8-bit/color RGBA, non-interlaced\n"
    },
    "ThreatStream": {
        "Analysis": {
            "Platform": "WINDOWS7",
            "ReportID": 422662,
            "Status": "processing"
        }
    }
}

Human Readable Output

The submission info for 5358@6cf3881e-1cfd-48b5-8fc3-0b9fcfb791f0
ReportID Status Platform
422662 processing WINDOWS7

threatstream-get-analysis-status

Returns the current status of the report that was submitted to the sandbox. The report ID is returned from threatstream-submit-to-sandbox command.

Base Command

threatstream-get-analysis-status

Input

Argument Name Description Required
report_id Report ID for which to check the status. Required

Context Output

Path Type Description
ThreatStream.Analysis.ReportID String The report ID of the file or URL that was detonated to sandbox.
ThreatStream.Analysis.Status String The report status of the file or URL that was detonated in the sandbox.
ThreatStream.Analysis.Platform String The platfrom that was used for detonation.
ThreatStream.Analysis.Verdict String The report verdict of the file or URL that was detonated in the sandbox. The verdict will remain “benign” until detonation is complete.

Command Example

``````

Human Readable Output

Report 413336 analysis results
Category Started Completed Duration VmName VmID ReportID Verdict
File 2019-05-30 14:05:25 2019-05-30 14:06:33 68     413336 Benign

threatstream-analysis-report

Returns the report of a file or URL that was submitted to the sandbox.

Base Command

threatstream-analysis-report

Input

Argument Name Description Required
report_id Report ID to return. Required

Context Output

Path Type Description
ThreatStream.Analysis.ReportID String The ID of the report submitted to the sandbox.
ThreatStream.Analysis.Category String The report category.
ThreatStream.Analysis.Started String Detonation start time.
ThreatStream.Analysis.Completed String Detonation completion time.
ThreatStream.Analysis.Duration Number Duration of the detonation (in seconds).
ThreatStream.Analysis.VmName String The name of the VM.
ThreatStream.Analysis.VmID String The ID of the VM.
ThreatStream.Analysis.Network.UdpSource String The source of UDP.
ThreatStream.Analysis.Network.UdpDestination String The destination of UDP.
ThreatStream.Analysis.Network.UdpPort String The port of the UDP.
ThreatStream.Analysis.Network.IcmpSource String The ICMP source.
ThreatStream.Analysis.Network.IcmpDestination String The destinaton of ICMP.
ThreatStream.Analysis.Network.IcmpPort String The port of the ICMP.
ThreatStream.Analysis.Network.TcpSource String The source of TCP.
ThreatStream.Analysis.Network.TcpDestination String The destination of TCP.
ThreatStream.Analysis.Network.TcpPort String The port of TCP.
ThreatStream.Analysis.Network.HttpSource String The source of HTTP.
ThreatStream.Analysis.Network.HttpDestinaton String The destination of HTTP.
ThreatStream.Analysis.Network.HttpPort String The port of HTTP.
ThreatStream.Analysis.Network.HttpsSource String The source of HTTPS.
ThreatStream.Analysis.Network.HttpsDestinaton String The destination of HTTPS.
ThreatStream.Analysis.Network.HttpsPort String The port of HTTPS.
ThreatStream.Analysis.Network.Hosts String The hosts of network analysis.
ThreatStream.Analysis.Verdict String The verdict of the sandbox detonation.

Command Example

threatstream-get-analysis-status report_id=422662

Context Example

{
    "ThreatStream": {
        "Analysis": {
            "Platform": "WINDOWS7",
            "ReportID": "422662",
            "Status": "processing",
            "Verdict": "Benign"
        }
    }
}

Human Readable Output

The analysis status for id 422662
Category Started Completed Duration VmName VmID ReportID Verdict
File 2019-05-30 14:05:25 2019-05-30 14:06:33 68     413336 Benign

threatstream-get-indicators

Return filtered indicators from ThreatStream. If a query is defined, it overides all othe arguments that were passed to the command.

Base Command

threatstream-get-indicators

Input

Argument Name Description Required
query Anomali Observable Search Filter Language query to filter indicatorts results. If a query is passed as an argument, it overides all other arguments. Optional
asn Autonomous System (AS) number associated with the indicator. Optional
confidence Level of certainty that an observable
is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.		 Optional
country Country associated with the indicator. Optional
created_ts When the indicator was first seen on
the ThreatStream cloud platform. Date must be specified in this format:
YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
For example, 2014-10-02T20:44:35.		 Optional
id Unique ID for the indicator. Optional
is_public Classification of the indicator. Optional
indicator_severity Severity assigned to the indicator by ThreatStream. Optional
org Registered owner (organization) of the IP address associated with the indicator. Optional
status Status assigned to the indicator. Optional
tags_name Tag assigned to the indicator. Optional
type Type of indicator. Optional
indicator_value Value of the indicator. Optional
limit Maximum number of results to return from ThreatStrem. Default is 20. Optional

Context Output

Path Type Description
ThreatStream.Indicators.IType String The indicator type.
ThreatStream.Indicators.Modified String Date and time when the indicator was last updated on the ThreatStream. Format: YYYYMMDDThhmmss, where T denotes the start of the value for time, in UTC time.
ThreatStream.Indicators.Confidence String Level of certainty that an observable is of the reported indicator type.
ThreatStream.Indicators.Value String The indicator value.
ThreatStream.Indicators.Status String The indicator status.
ThreatStream.Indicators.Organization String Registered owner (organization) of the IP address associated with the indicator.
ThreatStream.Indicators.Country String Country associated with the indicator.
ThreatStream.Indicators.Tags String Tag assigned to the indicator.
ThreatStream.Indicators.Source String The source of the indicator.
ThreatStream.Indicators.ID String The ID of the indicator.
ThreatStream.Indicators.ASN String Autonomous System (AS) number associated with the indicator.
ThreatStream.Indicators.Severity String The severity assigned to the indicator.

Command Example

threatstream-get-indicators type=ip status=active asn=4837 country=CN confidence=84 indicator_severity=medium org="China Unicom Guangxi" limit=5

Context Example

{
    "ThreatStream.Indicators": [
        {
            "Status": "active", 
            "Confidence": 84, 
            "IType": "scan_ip", 
            "Severity": "medium", 
            "Tags": null, 
            "Country": "CN", 
            "Modified": "2019-06-24T10:19:52.077Z", 
            "Value": "121.31.166.99", 
            "ID": 53042398831, 
            "Source": "Anomali Labs MHN", 
            "Organization": "China Unicom Guangxi", 
            "Type": "ip", 
            "ASN": "4837"
        }, 
        {
            "Status": "active", 
            "Confidence": 84, 
            "IType": "scan_ip", 
            "Severity": "medium", 
            "Tags": "port-1433,suricata,TCP", 
            "Country": "CN", 
            "Modified": "2019-06-24T09:51:04.804Z", 
            "Value": "121.31.166.99", 
            "ID": 53042253345, 
            "Source": "Anomali Labs MHN Tagged", 
            "Organization": "China Unicom Guangxi", 
            "Type": "ip", 
            "ASN": "4837"
        }, 
        {
            "Status": "active", 
            "Confidence": 84, 
            "IType": "scan_ip", 
            "Severity": "medium", 
            "Tags": null, 
            "Country": "CN", 
            "Modified": "2019-06-24T06:08:12.585Z", 
            "Value": "182.88.27.168", 
            "ID": 53016547378, 
            "Source": "DShield Scanning IPs", 
            "Organization": "China Unicom Guangxi", 
            "Type": "ip", 
            "ASN": "4837"
        }, 
        {
            "Status": "active", 
            "Confidence": 84, 
            "IType": "scan_ip", 
            "Severity": "medium", 
            "Tags": "AlienVault,OTX", 
            "Country": "CN", 
            "Modified": "2019-06-23T19:38:05.782Z", 
            "Value": "182.91.129.165", 
            "ID": 53038621037, 
            "Source": "Alien Vault OTX Malicious IPs", 
            "Organization": "China Unicom Guangxi", 
            "Type": "ip", 
            "ASN": "4837"
        }, 
        {
            "Status": "active", 
            "Confidence": 84, 
            "IType": "scan_ip", 
            "Severity": "medium", 
            "Tags": null, 
            "Country": "CN", 
            "Modified": "2019-06-23T17:52:51.165Z", 
            "Value": "182.91.129.207", 
            "ID": 52970998522, 
            "Source": "DShield Scanning IPs", 
            "Organization": "China Unicom Guangxi", 
            "Type": "ip", 
            "ASN": "4837"
        }
    ]
}

Human Readable Output

The indicators results
IType Value Confidence ID Source Type Status Tags Modified Organization ASN Country Severity
scan_ip 121.31.166.99 84 53042398831 Anomali Labs MHN ip active   2019-06-24T10:19:52.077Z China Unicom Guangxi 4837 CN medium
scan_ip 121.31.166.99 84 53042253345 Anomali Labs MHN Tagged ip active port-1433,suricata,TCP 2019-06-24T09:51:04.804Z China Unicom Guangxi 4837 CN medium
scan_ip 182.88.27.168 84 53016547378 DShield Scanning IPs ip active   2019-06-24T06:08:12.585Z China Unicom Guangxi 4837 CN medium
scan_ip 182.91.129.165 84 53038621037 Alien Vault OTX Malicious IPs ip active AlienVault,OTX 2019-06-23T19:38:05.782Z China Unicom Guangxi 4837 CN medium
scan_ip 182.91.129.207 84 52970998522 DShield Scanning IPs ip active   2019-06-23T17:52:51.165Z China Unicom Guangxi 4837 CN medium

threatstream-add-tag-to-model

Add tags to intelligence for purposes of filtering for related entities.

Base Command

threatstream-add-tag-to-model

Input

Argument Name Description Required
model The type of threat model entity on which to add the tag. Default is “intelligence” (indicator). Optional
tags A CSV list of tags applied to the specified threat model entities or observable. Required
model_id The ID of the model on which to add the tag. Required

Context Output

There is no context output for this command.

threatstream-add-tag-to-model model=intelligence model_id=51375607503 tags="suspicious,not valid"

Human Readable Output

Added successfully tags: [‘suspicious’, ‘not valid’] to intelligence
with 51375607503

threatstream-create-model

Creates a threat model with the specified parameters.

Base Command

threatstream-create-model

Input

Argument Name Description Required
model The type of threat model to create. Required
name The name of the threat model to create. Required
is_public The scope of threat model visibility. Optional
tlp Traffic Light Protocol designation for the threat model. Optional
tags A CSV list of tags. Optional
intelligence A CSV list of indicators IDs associated with the threat model on the ThreatStream platform. Optional
description The description of the threat model. Optional

Context Output

Path Type Description
ThreatStream.Model.ModelType String The type of the threat model.
ThreatStream.Model.ModelID String The ID of the threat model.
ThreatStream.Model.Indicators.Value String The value of indicator associated with the specified model.
ThreatStream.Model.Indicators.ID String The ID of indicator associated with the specified model.
ThreatStream.Model.Indicators.IType String The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity String The severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Confidence String The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country String The courty of the indicator associated with the specified model
ThreatStream.Model.Indicators.Organization String The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN String The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status String The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags String The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified String The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source String The source of the inidicator.
ThreatStream.Model.Indicators.Type String The type of the inidicator.

Command Example

threatstream-create-model model=actor name="New_Created_Actor" description="Description of the actor threat model" intelligence=53042425466,53042425532,53042425520 tags="new actor,test" tlp=red

Context Example

{
    "ThreatStream.Model": {
        "Indicators": [
            {
                "Status": "active", 
                "Confidence": 86, 
                "IType": "suspicious_domain", 
                "Severity": "high", 
                "Tags": "Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech", 
                "Country": "US", 
                "Modified": "2019-06-24T10:51:16.384", 
                "Value": "chatbotshq.com", 
                "ID": "53042425532", 
                "Source": "Analyst", 
                "Organization": "Hostinger International Limited", 
                "Type": "domain", 
                "ASN": "12769"
            }, 
            {
                "Status": "active", 
                "Confidence": 85, 
                "IType": "suspicious_domain", 
                "Severity": "high", 
                "Tags": "Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech", 
                "Country": "US", 
                "Modified": "2019-06-24T10:51:16.589", 
                "Value": "marketshq.com", 
                "ID": "53042425520", 
                "Source": "Analyst", 
                "Organization": "GoDaddy.com, LLC", 
                "Type": "domain", 
                "ASN": "26496"
            }, 
            {
                "Status": "active", 
                "Confidence": 77, 
                "IType": "suspicious_domain", 
                "Severity": "high", 
                "Tags": "Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech", 
                "Country": "US", 
                "Modified": "2019-06-24T10:54:31.318", 
                "Value": "leanomalie.com", 
                "ID": "53042425466", 
                "Source": "Analyst", 
                "Organization": "GoDaddy.com, LLC", 
                "Type": "domain", 
                "ASN": "26496"
            }
        ], 
        "ModelType": "Actor", 
        "ModelID": 26697
    }
}

Human Readable Output

Indicators list for Threat Model Actor with id 26697
IType Value ID Confidence Source Type Status Tags Modified Organization ASN Country Severity
suspicious_domain chatbotshq.com 53042425532 86 Analyst domain active Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech 2019-06-24T10:51:16.384 Hostinger International Limited 12769 US high
suspicious_domain marketshq.com 53042425520 85 Analyst domain active Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech 2019-06-24T10:51:16.589 GoDaddy.com, LLC 26496 US high
suspicious_domain leanomalie.com 53042425466 77 Analyst domain active Suspicious-Domain-Registration,TSLABS,victim-Hi-Tech 2019-06-24T10:54:31.318 GoDaddy.com, LLC 26496 US high

threatstream-update-model

Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overides previous data stored in ThreatStream.

Base Command

threatstream-update-model

Input

Argument Name Description Required
model The type of threat model to update. Required
model_id The ID of the threat model to update. Required
name The name of the threat model to update. Optional
is_public The scope of threat model visibility. Optional
tlp Traffic Light Protocol designation for the threat model. Optional
tags A CSV list of tags. Optional
intelligence A CSV list of indicators IDs associated with the threat model on the ThreatStream platform. Optional
description The description of the threat model. Optional

Context Output

Path Type Description
ThreatStream.Model.ModelType String The type of the threat model.
ThreatStream.Model.ModelID String The ID of the threat model.
ThreatStream.Model.Indicators.Value String The value of indicator associated with the specified model.
ThreatStream.Model.Indicators.ID String The ID of indicator associated with the specified model.
ThreatStream.Model.Indicators.IType String The iType of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Severity String The severity of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Confidence String The confidence of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Country String The courty of the indicator associated with the specified model
ThreatStream.Model.Indicators.Organization String The organization of the indicator associated with the specified model.
ThreatStream.Model.Indicators.ASN String The ASN of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Status String The status of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Tags String The tags of the indicator associated with the specified model.
ThreatStream.Model.Indicators.Modified String The date and time the indicator was last modified.
ThreatStream.Model.Indicators.Source String The source of the inidicator.
ThreatStream.Model.Indicators.Type String The type of the inidicator.

Command Example

threatstream-update-model model=actor model_id=26697 intelligence=53042694591 tags="updated tag,gone"

Context Example

{
    "ThreatStream": {
        "Model": {
            "Indicators": [
                {
                    "ASN": "",
                    "Confidence": 36,
                    "Country": "CA",
                    "ID": "53042694591",
                    "IType": "exploit_ip",
                    "Modified": "2019-06-24T11:28:31.185",
                    "Organization": "OVH Hosting",
                    "Severity": "high",
                    "Source": "Analyst",
                    "Status": "active",
                    "Tags": "HoneyDB",
                    "Type": "ip",
                    "Value": "54.39.20.14"
                }
            ],
            "ModelID": "26697",
            "ModelType": "Actor"
        }
    }
}

Human Readable Output

Indicators list for Threat Model Actor with id 26697
IType Value ID Confidence Source Type Status Tags Modified Organization ASN Country Severity
exploit_ip 54.39.20.14 53042694591 36 Analyst ip active HoneyDB 2019-06-24T11:28:31.185 OVH Hosting   CA high

threatstream-supported-platforms

Returns list of supported platforms for default or premium sandbox.

Base Command

threatstream-supported-platforms

Input

Argument Name Description Required
sandbox_type The type of sandbox (“default” or “premium”). Optional

Context Output

Path Type Description
ThreatStream.PremiumPlatforms.Name String Name of the supported platform for premium sadnbox.
ThreatStream.PremiumPlatforms.Types String Type of supported submissions for premium sanbox.
ThreatStream.PremiumPlatforms.Label String The display name of the supported platform of premium sandbox.
ThreatStream.DefaultPlatforms.Name String Name of the supported platform for standard sadnbox.
ThreatStream.DefaultPlatforms.Types String Type of supported submissions for standard sanbox.
ThreatStream.DefaultPlatforms.Label String The display name of the supported platform of standard sandbox.

Command Example

threatstream-supported-platforms sandbox_type=default

Context Example

{
    "ThreatStream.DefaultPlatforms": [
        {
            "Name": "WINDOWSXP", 
            "Types": [
                "file", 
                "url"
            ], 
            "Label": "Windows XP"
        }, 
        {
            "Name": "WINDOWS7", 
            "Types": [
                "file", 
                "url"
            ], 
            "Label": "Windows 7"
        }, 
        {
            "Name": "ALL", 
            "Types": [
                "file", 
                "url"
            ], 
            "Label": "All"
        }
    ]
}

Human Readable Output

Supported platforms for default sandbox
Name Types Label
WINDOWSXP file, url Windows XP
WINDOWS7 file, url Windows 7
ALL file, url All

url

Checks the reputation of the given URL.

Base Command

url

Input

Argument Name Description Required
url The URL to check. Required
threshold If severity is greater than or equal to the threshold, then the URL will be considered malicious. This argument will override the default threshold defined as a parameter. Optional
include_inactive Whether to include results with the status “Inactive”. Default is “False”. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
URL.Data String The URL of the indicator.
URL.Tags Unknown (List) Tags of the URL.
URL.Malicious.Vendor String Vendor that reported the indicator as malicious.
ThreatStream.URL.Modified String Date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where “T” denotes the start of the value for time, in UTC time.
ThreatStream.URL.Confidence String Level of certainty that an observable is of the reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
ThreatStream.URL.Status String The status of the indicator.
ThreatStream.URL.Organization String Name of the business that owns the IP address associated with the indicator.
ThreatStream.URL.Address String URL of the indicator.
ThreatStream.URL.Country String Country associated with the indicator.
ThreatStream.URL.Type String The indicator type.
ThreatStream.URL.Source String The source of the indicator.
ThreatStream.URL.Severity String The indicator severity (“very-high”, “high”, “medium”, or “low”).
ThreatStream.URL.Tags Unknown Tags assigned to the URL.

Command Example

url url=http://194.147.35.172/mikey.mpsl using-brand="Anomali ThreatStream v2"

Context Example

{
    "URL": {
        "Malicious": {
            "Vendor": "ThreatStream"
        }, 
        "Data": "http://194.147.35.172/mikey.mpsl",
        "Tags": ["phish-target", "victim-hi-tech"]
    }, 
    "ThreatStream.URL": {
        "Status": "active", 
        "Confidence": 90, 
        "Severity": "very-high", 
        "Country": "RU", 
        "Modified": "2019-06-24T10:10:05.890Z", 
        "Source": "H3X Tracker", 
        "Address": "http://194.147.35.172/mikey.mpsl", 
        "Organization": "LLC Baxet", 
        "Type": "url",
        "Tags": [{"id": "4wq", "name": "phish-target", "org_id": "88"}, {"id": "ezn", "name": "victim-hi-tech", "org_id": "88"}]
    }, 
    "DBotScore": {
        "Vendor": "H3X Tracker", 
        "Indicator": "http://194.147.35.172/mikey.mpsl", 
        "Score": 3, 
        "Type": "url"
    }
}

Human Readable Output

URL reputation for: http://194.147.35.172/mikey.mpsl
Address Confidence Source Type Status Modified Organization Country Severity
http://194.147.35.172/mikey.mpsl 90 H3X Tracker url active 2019-06-24T10:10:05.890Z LLC Baxet RU very-high

Configuration parameters

  • url — Server URL (e.g., https://www.test.com) (required)
  • credentials — Username
  • username — Username
  • apikey — API Key
  • default_threshold — Threshold of the indicator. (required)
  • integrationReliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (19)

  • domain

    Checks the reputation of the given domain name.

  • file

    Checks the reputation of the given hash of the file.

  • ip

    Checks the reputation of the given IP address.

  • threatstream-add-tag-to-model

    Adds tags to intelligence for purposes of filtering for related entities.

  • threatstream-analysis-report

    Returns the report of a file or URL that was submitted to the sandbox.

  • threatstream-create-model

    Creates a threat model with the specified parameters.

  • threatstream-email-reputation

    Checks the reputation of the given email address.

  • threatstream-get-analysis-status

    Returns the current status of the report that was submitted to the sandbox. The report ID is returned from the threatstream-submit-to-sandbox command.

  • threatstream-get-indicators

    Return filtered indicators from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.

  • threatstream-get-indicators-by-model

    Returns a list of indicators associated with the specified model and ID of the model.

  • threatstream-get-model-description

    Returns an HTML file with a description of the threat model.

  • threatstream-get-model-list

    Returns a list of threat models.

  • threatstream-get-passive-dns

    Returns enrichment data for Domain or IP for available observables.

  • threatstream-import-indicator-with-approval

    Imports indicators (observables) into ThreatStream. Approval of the imported data is required, using the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL. Only one argument can be used.

  • threatstream-import-indicator-without-approval

    Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API.

  • threatstream-submit-to-sandbox

    Submits a file or URL to the ThreatStream-hosted Sandbox for detonation.

  • threatstream-supported-platforms

    Returns a list of supported platforms for default or premium sandbox.

  • threatstream-update-model

    Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overrides previous data stored in ThreatStream.

  • url

    Checks the reputation of the given URL.

Source

Anomali_ThreatStream_v2.py Anomali_ThreatStream_v2_test.py Anomali_ThreatStream_v2.yml Anomali_ThreatStream_v2_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Anomali
commonfields:
  id: Anomali ThreatStream v2
  version: -1
deprecated: true
configuration:
- defaultvalue: https://api.threatstream.com
  display: Server URL (e.g., https://www.test.com)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  type: 9
  displaypassword: API Key
  required: false
- display: Username
  name: username
  type: 0
  hidden: true
  required: false
- display: API Key
  name: apikey
  type: 4
  hidden: true
  required: false
- defaultvalue: high
  display: Threshold of the indicator.
  name: default_threshold
  options:
  - low
  - medium
  - high
  - very-high
  required: true
  type: 15
- defaultvalue: 'B - Usually reliable'
  display: Source Reliability
  name: integrationReliability
  required: true
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: 'false'
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
defaultclassifier: 'null'
description: Deprecated. Use Anomali ThreatStream v3 integration instead.
display: Anomali ThreatStream v2 (Deprecated)
name: Anomali ThreatStream v2
script:
  commands:
  - arguments:
    - default: true
      description: The IP to check.
      isArray: true
      name: ip
      required: true
    - auto: PREDEFINED
      description: If severity is greater than or equal to the threshold, then the IP address will be considered malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high".
      name: threshold
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to include results with an inactive status. Default is "False".
      name: include_inactive
      predefined:
      - 'True'
      - 'False'
    description: Checks the reputation of the given IP address.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: IP.ASN
      description: The Autonomous System (AS) number associated with the indicator.
      type: String
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: String
    - contextPath: IP.Geo.Country
      description: The country associated with the indicator.
      type: String
    - contextPath: IP.Geo.Location
      description: The longitude and latitude of the IP address.
      type: String
    - contextPath: ThreatStream.IP.ASN
      description: The Autonomous System (AS) number associated with the indicator.
      type: String
    - contextPath: ThreatStream.IP.Address
      description: The IP address of the indicator.
      type: String
    - contextPath: ThreatStream.IP.Country
      description: The country associated with the indicator.
      type: String
    - contextPath: ThreatStream.IP.Type
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.IP.Modified
      description: 'The time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.'
      type: String
    - contextPath: ThreatStream.IP.Severity
      description: The indicator severity ("very-high", "high", "medium", or "low").
      type: String
    - contextPath: ThreatStream.IP.Confidence
      description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
      type: String
    - contextPath: ThreatStream.IP.Status
      description: The status assigned to the indicator.
      type: String
    - contextPath: ThreatStream.IP.Organization
      description: The name of the business that owns the IP address associated with the indicator.
      type: String
    - contextPath: ThreatStream.IP.Source
      description: The source of the indicator.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: IP.Malicious.Vendor
      description: The vendor that reported the indicator as malicious.
      type: String
    - contextPath: ThreatStream.IP.Tags
      description: Tags assigned to the IP.
      type: Unknown
    - contextPath: IP.Tags
      description: (List) Tags of the IP.
      type: Unknown
  - arguments:
    - default: true
      description: The domain name to check.
      isArray: true
      name: domain
      required: true
    - auto: PREDEFINED
      description: If the severity is greater than or equal to the threshold, the IP address is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high".
      name: threshold
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to include results with an inactive status. Default is "False".
      name: include_inactive
      predefined:
      - 'True'
      - 'False'
    description: Checks the reputation of the given domain name.
    name: domain
    outputs:
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.DNS
      description: 'The IP addresses resolved by DNS. '
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: |-
        The date when the domain was created. The date format is: YYYYMMDDThhmmss.
        Where T denotes the start of the value
        for time, in UTC time.
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: |-
        The date when the domain was last updated. The date format is: YYYYMMDDThhmmss.
        Where T denotes the start of the value
        for time, in UTC time.
      type: Date
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: The phone number of the registrant.
      type: String
    - contextPath: ThreatStream.Domain.ASN
      description: The Autonomous System (AS) number associated with the indicator.
      type: String
    - contextPath: ThreatStream.Domain.Address
      description: The domain name of the indicator.
      type: String
    - contextPath: ThreatStream.Domain.Country
      description: The country associated with the indicator.
      type: String
    - contextPath: ThreatStream.Domain.Type
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.Domain.Modified
      description: |-
        The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.Domain.Severity
      description: The indicator severity ("very-high", "high", "medium", "low").
      type: String
    - contextPath: ThreatStream.Domain.Confidence
      description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
      type: String
    - contextPath: ThreatStream.Domain.Status
      description: The status assigned to the indicator.
      type: String
    - contextPath: ThreatStream.Domain.Organization
      description: The name of the business that owns the IP address associated with the indicator.
      type: String
    - contextPath: ThreatStream.Domain.Source
      description: The source of the indicator.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: Vendor that reported the indicator as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: ThreatStream.Domain.Tags
      description: Tags assigned to the domain.
      type: Unknown
    - contextPath: Domain.Tags
      description: (List) Tags of the domain.
      type: Unknown
  - arguments:
    - default: true
      description: The hash of file to check.
      isArray: true
      name: file
      required: true
    - auto: PREDEFINED
      description: If the severity is greater than or equal to the threshold, the hash of file is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high".
      name: threshold
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to include results with an inactive status. Default is "False".
      name: include_inactive
      predefined:
      - 'True'
      - 'False'
    description: Checks the reputation of the given hash of the file.
    name: file
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the indicator as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: ThreatStream.File.Severity
      description: The indicator severity ("very-high", "high", "medium", "low").
      type: String
    - contextPath: ThreatStream.File.Confidence
      description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
      type: String
    - contextPath: ThreatStream.File.Status
      description: The status assigned to the indicator.
      type: String
    - contextPath: ThreatStream.File.Type
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.File.MD5
      description: The MD5 hash of the indicator.
      type: String
    - contextPath: ThreatStream.File.SHA1
      description: The SHA1 hash of the indicator.
      type: String
    - contextPath: ThreatStream.File.SHA256
      description: The SHA256 hash of the indicator.
      type: String
    - contextPath: ThreatStream.File.SHA512
      description: The SHA512 hash of the indicator.
      type: String
    - contextPath: ThreatStream.File.Modified
      description: |-
        The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.File.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.File.Tags
      description: Tags assigned to the file.
      type: Unknown
    - contextPath: File.Tags
      description: (List) Tags of the file.
      type: Unknown
  - arguments:
    - description: The email address to check.
      name: email
      required: true
    - auto: PREDEFINED
      description: If the severity is greater or equal than the threshold, the IP address is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", "very-high".
      name: threshold
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to include results with an inactive status. Default is "False".
      name: include_inactive
      predefined:
      - 'True'
      - 'False'
    description: Checks the reputation of the given email address.
    name: threatstream-email-reputation
    outputs:
    - contextPath: DBotScore.Indicator
      description: The tested indicator.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: ThreatStream.EmailReputation.Severity
      description: The indicator severity ("very-high", "high", "medium", "low").
      type: String
    - contextPath: ThreatStream.EmailReputation.Confidence
      description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
      type: String
    - contextPath: ThreatStream.EmailReputation.Status
      description: The status assigned to the indicator.
      type: String
    - contextPath: ThreatStream.EmailReputation.Type
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.EmailReputation.Email
      description: The email address of the indicator.
      type: String
    - contextPath: ThreatStream.EmailReputation.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.EmailReputation.Modified
      description: |-
        The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.EmailReputation.Tags
      description: Tags assigned to the email.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      defaultValue: ip
      description: The type of passive DNS search ("ip", "domain").
      name: type
      predefined:
      - ip
      - domain
      required: true
    - description: Possible values are "IP" or "Domain".
      name: value
      required: true
    - defaultValue: '50'
      description: The maximum number of results to return. Default is 50.
      name: limit
    description: Returns enrichment data for Domain or IP for available observables.
    name: threatstream-get-passive-dns
    outputs:
    - contextPath: ThreatStream.PassiveDNS.Domain
      description: The domain value.
      type: String
    - contextPath: ThreatStream.PassiveDNS.Ip
      description: The IP value.
      type: String
    - contextPath: ThreatStream.PassiveDNS.Rrtype
      description: The Rrtype value.
      type: String
    - contextPath: ThreatStream.PassiveDNS.Source
      description: The source value.
      type: String
    - contextPath: ThreatStream.PassiveDNS.FirstSeen
      description: |-
        The first seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.PassiveDNS.LastSeen
      description: |-
        The last seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The observable certainty level of a reported indicator type. Default is 50.
      name: confidence
    - auto: PREDEFINED
      defaultValue: private
      description: Whether the indicator data is public or private to the organization. Default is "private".
      name: classification
      predefined:
      - private
      - public
    - auto: PREDEFINED
      defaultValue: exploit
      description: Type of threat associated with the imported observables. Pre-defined values, such as "adware", "bot", "malware", etc. Default is "exploit".
      name: threat_type
      predefined:
      - adware
      - anomalous
      - anonymization
      - apt
      - bot
      - brute
      - c2
      - compromised
      - crypto
      - data_leakage
      - ddos
      - dyn_dns
      - exfil
      - exploit
      - hack_tool
      - i2p
      - informational
      - malware
      - p2p
      - parked
      - phish
      - scan
      - sinkhole
      - spam
      - suppress
      - suspicious
      - tor
      - vps
    - auto: PREDEFINED
      defaultValue: low
      description: The potential impact of the indicator type with which the observable is believed to be associated. Can be "high", "medium", or "high", or "very-high". Default is "low".
      name: severity
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      description: The import type of the indicator. Can be "datatext", "file-id", or "url".
      name: import_type
      predefined:
      - datatext
      - file-id
      - url
      required: true
    - description: 'The source of imported data. Can be one of the following: url, datatext of file-id of uploaded file to the War Room. Supported file types for file-id are: CSV, HTML, IOC, JSON, PDF, TXT.'
      name: import_value
      required: true
    - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported IP-type observable when an explicit itype is not specified for it.
      name: ip_mapping
    - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported domain-type observable when an explicit itype is not specified for it.
      name: domain_mapping
    - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported URL-type observable when an explicit itype is not specified for it.
      name: url_mapping
    - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported email-type observable when an explicit itype is not specified for it.
      name: email_mapping
    - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported MD5-type observable when an explicit itype is not specified for it.
      name: md5_mapping
    description: 'Imports indicators (observables) into ThreatStream. Approval of the imported data is required, using the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL. Only one argument can be used.'
    name: threatstream-import-indicator-with-approval
  - arguments:
    - defaultValue: '50'
      description: The observable certainty level of a reported indicator type. Default is 50.
      name: confidence
    - description: To use your specified confidence entirely and not re-assess the value using machine learning algorithms, set source_confidence_ weight to 100.
      name: source_confidence_weight
    - description: The time stamp of when intelligence will expire on ThreatStream, in ISO format. For example, 2020-12-24T00:00:00.
      name: expiration_ts
    - description: The severity you want to assign to the observable when it is imported. Can be "low", "medium", "high" , or "very-high".
      name: severity
      predefined:
      - low
      - medium
      - high
      - very-high
    - description: A comma-separated list of tags. For example, tag1,tag2.
      name: tags
    - description: The ID of the trusted circle with which this threat data should be shared. If you want to import the threat data to multiple trusted circles, enter a list of comma-separated IDs.
      name: trustedcircles
    - auto: PREDEFINED
      description: Denotes whether the indicator data is public or private to the organization.
      name: classification
      predefined:
      - private
      - public
      required: true
    - auto: PREDEFINED
      description: Whether domain observables that are included in the file and do not resolve will be accepted as valid in ThreatStream and imported.
      name: allow_unresolved
      predefined:
      - 'yes'
      - 'no'
    - description: The entry ID of an uploaded file to the War Room containing a json with "objects" array and "meta" maps.
      name: file_id
      required: true
    description: Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API.
    name: threatstream-import-indicator-without-approval
  - arguments:
    - auto: PREDEFINED
      description: The threat model of the returned list. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport".
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - signature
      - ttp
      - vulnerability
      - tipreport
      required: true
    - defaultValue: '50'
      description: Limits the list of models size. Specifying limit=0 returns up to a maximum of 1000 models. In case of limit=0 the output won't be set in the context.
      name: limit
    description: Returns a list of threat models.
    name: threatstream-get-model-list
    outputs:
    - contextPath: ThreatStream.List.Type
      description: The type of threat model.
      type: String
    - contextPath: ThreatStream.List.Name
      description: The name of the threat model.
      type: String
    - contextPath: ThreatStream.List.ID
      description: The ID of the threat model.
      type: String
    - contextPath: ThreatStream.List.CreatedTime
      description: 'The date and time of threat model creation. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.'
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport".
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - signature
      - ttp
      - vulnerability
      - tipreport
      required: true
    - description: The ID of the threat model.
      name: id
      required: true
    description: Returns an HTML file with a description of the threat model.
    name: threatstream-get-model-description
    outputs:
    - contextPath: File.Name
      description: The file name of the model description.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the model description.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport".
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - signature
      - ttp
      - vulnerability
      - tipreport
      required: true
    - description: The ID of the model.
      name: id
      required: true
    - defaultValue: '20'
      description: The maximum number of results to return. Default is 20.
      name: limit
    description: Returns a list of indicators associated with the specified model and ID of the model.
    name: threatstream-get-indicators-by-model
    outputs:
    - contextPath: ThreatStream.Model.ModelType
      description: The type of the threat model.
      type: String
    - contextPath: ThreatStream.Model.ModelID
      description: The ID of the threat model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Value
      description: The value of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ID
      description: The ID of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.IType
      description: The iType of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Severity
      description: The severity of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Confidence
      description: The confidence of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Country
      description: The country of the indicator associated with the specified model
      type: String
    - contextPath: ThreatStream.Model.Indicators.Organization
      description: The organization of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ASN
      description: The ASN of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Status
      description: The status of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Tags
      description: The tags of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Modified
      description: The date and time the indicator was last modified.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Type
      description: The type of the indicator.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: private
      description: Classification of the Sandbox submission. Can be "private" or "public". Default is "private".
      name: submission_classification
      predefined:
      - private
      - public
    - auto: PREDEFINED
      defaultValue: WINDOWS7
      description: The platform on which the submitted URL or file will be run. To obtain a list supported platforms run the threatstream-supported-platforms command. Can be "WINDOWS7", or "WINDOWSXP". Default is "WINDOWS7".
      name: report_platform
      predefined:
      - WINDOWS7
      - WINDOWSXP
    - auto: PREDEFINED
      defaultValue: file
      description: The detonation type. Can be "file" or "url". Default is "file".
      name: submission_type
      predefined:
      - file
      - url
      required: true
    - description: The submission value. Possible values are a valid URL or a file ID that was uploaded to the War Room to detonate.
      name: submission_value
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether the premium sandbox should be used for detonation. Default is "false".
      name: premium_sandbox
      predefined:
      - 'false'
      - 'true'
    - description: A comma separated list of additional details for the indicator. This information is displayed in the Tag column of the ThreatStream UI.
      name: detail
    description: Submits a file or URL to the ThreatStream-hosted Sandbox for detonation.
    name: threatstream-submit-to-sandbox
    outputs:
    - contextPath: ThreatStream.Analysis.ReportID
      description: The report ID that was submitted to the sandbox.
      type: String
    - contextPath: ThreatStream.Analysis.Status
      description: The analysis status.
      type: String
    - contextPath: ThreatStream.Analysis.Platform
      description: The platform of the submission submitted to the sandbox.
      type: String
  - arguments:
    - description: The report ID for which to check the status.
      name: report_id
      required: true
    description: Returns the current status of the report that was submitted to the sandbox. The report ID is returned from the threatstream-submit-to-sandbox command.
    name: threatstream-get-analysis-status
    outputs:
    - contextPath: ThreatStream.Analysis.ReportID
      description: The report ID of the file or URL that was detonated to sandbox.
      type: String
    - contextPath: ThreatStream.Analysis.Status
      description: The report status of the file or URL that was detonated in the sandbox.
      type: String
    - contextPath: ThreatStream.Analysis.Platform
      description: The platform that was used for detonation.
      type: String
    - contextPath: ThreatStream.Analysis.Verdict
      description: The report verdict of the file or URL that was detonated in the sandbox. The verdict will remain "benign" until detonation is complete.
      type: String
  - arguments:
    - description: The report ID to return.
      name: report_id
      required: true
    description: Returns the report of a file or URL that was submitted to the sandbox.
    name: threatstream-analysis-report
    outputs:
    - contextPath: ThreatStream.Analysis.ReportID
      description: The ID of the report submitted to the sandbox.
      type: String
    - contextPath: ThreatStream.Analysis.Category
      description: The report category.
      type: String
    - contextPath: ThreatStream.Analysis.Started
      description: The detonation start time.
      type: String
    - contextPath: ThreatStream.Analysis.Completed
      description: The detonation completion time.
      type: String
    - contextPath: ThreatStream.Analysis.Duration
      description: The duration of the detonation (in seconds).
      type: Number
    - contextPath: ThreatStream.Analysis.VmName
      description: The name of the VM.
      type: String
    - contextPath: ThreatStream.Analysis.VmID
      description: The ID of the VM.
      type: String
    - contextPath: ThreatStream.Analysis.Network.UdpSource
      description: The source of UDP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.UdpDestination
      description: The destination of UDP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.UdpPort
      description: The port of the UDP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.IcmpSource
      description: The ICMP source.
      type: String
    - contextPath: ThreatStream.Analysis.Network.IcmpDestination
      description: The destination of ICMP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.IcmpPort
      description: The port of the ICMP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.TcpSource
      description: The source of TCP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.TcpDestination
      description: The destination of TCP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.TcpPort
      description: The port of TCP.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpSource
      description: The source of HTTP address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpDestinaton
      description: The destination of the HTTP address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpPort
      description: The port of the HTTP address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpsSource
      description: The source of the HTTPS address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpsDestinaton
      description: The destination of the HTTPS address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.HttpsPort
      description: The port of the HTTPS address.
      type: String
    - contextPath: ThreatStream.Analysis.Network.Hosts
      description: The hosts of network analysis.
      type: String
    - contextPath: ThreatStream.Analysis.Verdict
      description: The verdict of the sandbox detonation.
      type: String
  - arguments:
    - description: The Anomali Observable Search Filter Language query to filter indicator results. If a query is passed as an argument, it overrides all other arguments.
      name: query
    - description: The Autonomous System (AS) number associated with the indicator.
      name: asn
    - description: |-
        The observable certainty level
        of a reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
      name: confidence
    - description: The country associated with the indicator.
      name: country
    - description: |-
        When the indicator was first seen on
        the ThreatStream cloud platform. The date must be specified in this format:
        YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.
        For example, 2014-10-02T20:44:35.
      name: created_ts
    - description: The unique ID for the indicator.
      name: id
    - auto: PREDEFINED
      description: Whether the classification of the indicator is public. Default is "false".
      name: is_public
      predefined:
      - 'false'
      - 'true'
    - description: The severity assigned to the indicator by ThreatStream.
      name: indicator_severity
    - description: The registered owner (organization) of the IP address associated with the indicator.
      name: org
    - auto: PREDEFINED
      description: The status assigned to the indicator. Can be "active", "inactive", or "falsepos".
      name: status
      predefined:
      - active
      - inactive
      - falsepos
    - description: The tag assigned to the indicator.
      name: tags_name
    - auto: PREDEFINED
      description: The type of indicator. Can be "domain", "email", "ip", "MD5", "string", or "url".
      name: type
      predefined:
      - domain
      - email
      - ip
      - md5
      - string
      - url
    - description: 'The value of the indicator. '
      name: indicator_value
    - defaultValue: '20'
      description: The maximum number of results to return from ThreatStream. Default is 20.
      name: limit
    description: Return filtered indicators from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command.
    name: threatstream-get-indicators
    outputs:
    - contextPath: ThreatStream.Indicators.IType
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.Indicators.Modified
      description: |-
        The date and time when the indicator was last updated on the ThreatStream. Format: YYYYMMDDThhmmss, where T denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.Indicators.Confidence
      description: The observable certainty level of a reported indicator type.
      type: String
    - contextPath: ThreatStream.Indicators.Value
      description: The indicator value.
      type: String
    - contextPath: ThreatStream.Indicators.Status
      description: The indicator status.
      type: String
    - contextPath: ThreatStream.Indicators.Organization
      description: The registered owner (organization) of the IP address associated with the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.Country
      description: The country associated with the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.Tags
      description: The tag assigned to the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.ID
      description: The ID of the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.ASN
      description: The Autonomous System (AS) number associated with the indicator.
      type: String
    - contextPath: ThreatStream.Indicators.Severity
      description: The severity assigned to the indicator.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: intelligence
      description: The type of threat model entity on which to add the tag. Can be "actor", "campaign", "incident", "intelligence", "signature", "tipreport", "ttp", or "vulnerability". Default is "intelligence" (indicator).
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - intelligence
      - signature
      - tipreport
      - ttp
      - vulnerability
    - description: 'A comma separated list of tags applied to the specified threat model entities or observable. '
      isArray: true
      name: tags
      required: true
    - description: The ID of the model on which to add the tag.
      name: model_id
      required: true
    description: Adds tags to intelligence for purposes of filtering for related entities.
    name: threatstream-add-tag-to-model
  - arguments:
    - auto: PREDEFINED
      description: The type of threat model to create. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport".
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - ttp
      - vulnerability
      - tipreport
      required: true
    - description: The name of the threat model to create.
      name: name
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether the scope of threat model is visible. Default is false.
      name: is_public
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: red
      description: The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white".
      name: tlp
      predefined:
      - red
      - amber
      - green
      - white
    - description: A comma separated list of tags.
      name: tags
    - description: A comma separated list of indicators IDs associated with the threat model on the ThreatStream platform.
      name: intelligence
    - description: The description of the threat model.
      name: description
    description: Creates a threat model with the specified parameters.
    name: threatstream-create-model
    outputs:
    - contextPath: ThreatStream.Model.ModelType
      description: The type of the threat model.
      type: String
    - contextPath: ThreatStream.Model.ModelID
      description: The ID of the threat model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Value
      description: The value of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ID
      description: The ID of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.IType
      description: The iType of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Severity
      description: The severity of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Confidence
      description: The confidence of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Country
      description: The country of the indicator associated with the specified model
      type: String
    - contextPath: ThreatStream.Model.Indicators.Organization
      description: The organization of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ASN
      description: The ASN of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Status
      description: The status of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Tags
      description: The tags of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Modified
      description: The date and time the indicator was last modified.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Type
      description: The type of the indicator.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The type of threat model to update. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport".
      name: model
      predefined:
      - actor
      - campaign
      - incident
      - ttp
      - vulnerability
      - tipreport
      required: true
    - description: The ID of the threat model to update.
      name: model_id
      required: true
    - description: The name of the threat model to update.
      name: name
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether the scope of threat model is visible. Default is false.
      name: is_public
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: red
      description: The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white".
      name: tlp
      predefined:
      - red
      - amber
      - green
      - white
    - description: A comma separated list of tags.
      name: tags
    - description: A comma separated list of indicators IDs associated with the threat model on the ThreatStream platform.
      name: intelligence
    - description: The description of the threat model.
      name: description
    description: Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overrides previous data stored in ThreatStream.
    name: threatstream-update-model
    outputs:
    - contextPath: ThreatStream.Model.ModelType
      description: The type of the threat model.
      type: String
    - contextPath: ThreatStream.Model.ModelID
      description: The ID of the threat model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Value
      description: The value of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ID
      description: The ID of indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.IType
      description: The iType of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Severity
      description: The severity of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Confidence
      description: The confidence of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Country
      description: The country of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Organization
      description: The organization of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.ASN
      description: The ASN of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Status
      description: The status of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Tags
      description: The tags of the indicator associated with the specified model.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Modified
      description: The date and time the indicator was last modified.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.Model.Indicators.Type
      description: The type of the indicator.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: default
      description: The type of sandbox ("default" or "premium"). Default type is "default".
      name: sandbox_type
      predefined:
      - default
      - premium
    description: Returns a list of supported platforms for default or premium sandbox.
    name: threatstream-supported-platforms
    outputs:
    - contextPath: ThreatStream.PremiumPlatforms.Name
      description: The name of the supported platform for premium sandbox.
      type: String
    - contextPath: ThreatStream.PremiumPlatforms.Types
      description: The type of supported submissions for premium sandbox.
      type: String
    - contextPath: ThreatStream.PremiumPlatforms.Label
      description: The display name of the supported platform of premium sandbox.
      type: String
    - contextPath: ThreatStream.DefaultPlatforms.Name
      description: The name of the supported platform for standard sandbox.
      type: String
    - contextPath: ThreatStream.DefaultPlatforms.Types
      description: The type of the supported submissions for standard sandbox.
      type: String
    - contextPath: ThreatStream.DefaultPlatforms.Label
      description: The display name of the supported platform of standard sandbox.
      type: String
  - arguments:
    - default: true
      description: The URL to check.
      isArray: true
      name: url
      required: true
    - auto: PREDEFINED
      description: If the severity is greater than or equal to the threshold, the URL is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high".
      name: threshold
      predefined:
      - low
      - medium
      - high
      - very-high
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to include results with an inactive status. Default is "False".
      name: include_inactive
      predefined:
      - 'True'
      - 'False'
    description: Checks the reputation of the given URL.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: URL.Data
      description: The URL of the indicator.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: Vendor that reported the indicator as malicious.
      type: String
    - contextPath: ThreatStream.URL.Modified
      description: |-
        The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value
        for time, in UTC time.
      type: String
    - contextPath: ThreatStream.URL.Confidence
      description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence.
      type: String
    - contextPath: ThreatStream.URL.Status
      description: The status of the indicator.
      type: String
    - contextPath: ThreatStream.URL.Organization
      description: The name of the business that owns the IP address associated with the indicator.
      type: String
    - contextPath: ThreatStream.URL.Address
      description: The URL of the indicator.
      type: String
    - contextPath: ThreatStream.URL.Country
      description: The country associated with the indicator.
      type: String
    - contextPath: ThreatStream.URL.Type
      description: The indicator type.
      type: String
    - contextPath: ThreatStream.URL.Source
      description: The source of the indicator.
      type: String
    - contextPath: ThreatStream.URL.Severity
      description: The indicator severity ("very-high", "high", "medium", or "low").
      type: String
    - contextPath: ThreatStream.URL.Tags
      description: Tags assigned to the URL.
      type: Unknown
    - contextPath: URL.Tags
      description: (List) Tags of the URL.
      type: Unknown
  dockerimage: demisto/py3-tools:1.0.0.43697
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- ThreatStream-Test
fromversion: 5.0.0