ANY.RUN TI Lookup

TI Lookup is a searchable database of IOCs, IOAs, IOBs, and events for threat hunting and a service for browsing malicious files by their content.

Data Enrichment & Threat Intelligence · ANY.RUN

Details

IDANY.RUN TI Lookup
ProviderAnyRun
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/anyrun-sdk:1.0.0.10440656
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

TI Lookup is a searchable database of IOCs, IOAs, IOBs, and events for threat hunting and a service for browsing malicious files by their content.

Use Cases

Perform deep searches, look up threats online, and enrich your security solutions.

Generate API token

  • Follow ANY.RUN TI Lookup
  • [1] Profile > [2] API and Limits > [3] Generate > [4] Copy

ANY.RUN Generate API KEY

Configure ANY.RUN Lookup in Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for ANY.RUN.
  3. Click Add instance to create and configure a new integration instance.
  4. Insert ANY.RUN API-KEY into the Password parameter.
  5. Please use “ANY.RUN” as username.
  6. Click Test to validate the URLs, token, and connection.
Parameter Description Required
Password ANY.RUN API-KEY without prefix True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anyrun-get-intelligence

Perform threat intelligence using specified IOC

Base Command

anyrun-get-intelligence

Input

Argument Name Description Required
lookup_depth Specify the number of days from the current date for which you want to lookup. Optional
query Raw query with necessary filters. Supports condition concatenation with AND, OR, NOT and Parentheses (). Optional
threat_name The name of a particular threat: malware family, threat type, etc., as identified by the sandbox. Example: “Phishing”. Optional
threat_level A verdict on the threat level of the sample. Possible values are: suspicious, malicious, info. Optional
task_type The type of the sample submitted to the sandbox. Possible values are: File, URL. Optional
submission_country The country from which the threat sample was submitted. Example: “es”. Optional
os The specific version of Windows used in the environment. Possible values are: Windows 7, Windows 8, Windows 11. Optional
os_software_set The software package of applications installed on the OS. Possible values are: clean, office, complete. Optional
os_bit_version The bitness of the operating system. Possible values are: 32, 64. Optional
registry_key The specific key within the registry hive where the modification occurred. Please note: when entering registry keys, use a double backslash () to escape the single backslash. Example: “Windows\CurrentVersion\RunOnce. Optional
registry_name The name of the Windows Registry key field. Example: “browseinplace”. Optional
registry_value The value of the Windows Registry key. Example: “Internet Explorer\iexplore.exe. Optional
module_image_path The full path to the module’s image file, the location on the disk where the module’s executable is stored. Example: “SysWOW64\cryptbase.dll. Optional
rule_threat_level The threat level assigned to a particular event. Possible values are: suspicious, malicious, info. Optional
rule_name The name of the detection rule. Example: “Executable content was dropped or overwritten”. Optional
mitre Techniques used by the malware according to the MITRE ATT&CK classification. Example: “T1071”. Optional
image_path Full path to process image. Example: “System32\conhost.exe”. Optional
command_line Full command line that initiated the process. Example: “PDQConnectAgent\pdq-connect-agent.exe –service”. Optional
injected_flag Indication of whether a process has been injected. Possible values are: true, false. Optional
destination_ip The IP address of the network connection that was established or attempted. Optional
destination_port The network port through which the connection was established. Example: “49760”. Optional
destination_ip_asn Detected ASN. Example: “akamai-as”. Optional
destination_ip_geo Two-letter country or region code of the detected IP geolocation. Example: “ae”. Optional
domain_name The domain name that was recorded during the threat execution in a sandbox. Example: “tventyvd20sb.top”. Optional
ja3 Types of TLS fingerprints that can indicate certain threats. Optional
ja3s Types of TLS fingerprints that can indicate certain threats. Optional
jarm Types of TLS fingerprints that can indicate certain threats. Optional
file_path The full path to the file on the system. Optional
file_event_path The path of a file associated with a file event. Optional
file_extension The extension that indicates the file type. Optional
sha256 Hash values relating to a file. Optional
sha1 Hash values relating to a file. Optional
md5 Hash values relating to a file. Optional
suricata_class The category assigned to the threat by Suricata based on its characteristics. Example: “a network trojan was detected”. Optional
suricata_message The description of the threat according to Suricata. Example: “ET INFO 404/Snake/Matiex Keylogger Style External IP Check”. Optional
suricata_threat_level The verdict on the threat according to Suricata based on its potential impact. Possible values are: suspicious, malicious, info. Optional
suricata_id The unique identifier of the Suricata rule: Example: “2044767”. Optional
sync_object_name The name or identifier of the synchronization object used. Example: “rmc”. Optional
sync_object_type The type of synchronization object used. Example: “mutex”. Optional
sync_object_operation The operation performed on the synchronization object. Example: “create”. Optional
url The URL called by the process. Optional
http_request_content_type The content type of the HTTP request sent to the server. Example: “application/json”. Optional
http_response_content_type The content type of the HTTP response received from the server. Example: “text/html”. Optional
http_request_file_type The file type of the file being uploaded in the HTTP request. Example: “binary”. Optional
http_response_file_type The file type of the file being downloaded in the HTTP response. Example: “binary”. Optional

Context Output

Path Type Description
ANYRUN.Lookup.destinationPort Unknown Destination ports numbers.
ANYRUN.Lookup.destinationIPgeo Unknown Destination IP Geo (countries).
ANYRUN.Lookup.destinationIpAsn.asn String Destination IP ASN (autonomous system number).
ANYRUN.Lookup.destinationIpAsn.date Date Destination IP ASN Date.
ANYRUN.Lookup.relatedTasks String Links to related tasks in ANY.RUN sandbox.
ANYRUN.Lookup.threatName String Threat names.
ANYRUN.Lookup.relatedIncidents.task String Link to the task in ANY.RUN sandbox.
ANYRUN.Lookup.relatedIncidents.time Date Creation time.
ANYRUN.Lookup.relatedIncidents.MITRE Unknown Array of MITRE matrix techniques IDs ans sub-techniques IDs.
ANYRUN.Lookup.relatedIncidents.event.destinationPort String Destination ports numbers.
ANYRUN.Lookup.relatedIncidents.event.destinationIP String Destination IP address.
ANYRUN.Lookup.relatedIncidents.process.commandLine String Command line string.
ANYRUN.Lookup.relatedIncidents.process.imagePath String Image path string.
ANYRUN.Lookup.relatedIncidents.process.threatName String Threat names.
ANYRUN.Lookup.relatedIncidents.process.MITRE Unknown Array of MITRE matrix techniques IDs ans sub-techniques IDs.
ANYRUN.Lookup.relatedIncidents.process.pid Number Process ID.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.known_threat Boolean Indicates if it is a known threat.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.network_loader Boolean Indicates if network download was detected.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.network Boolean Indicates if network activity was enabled.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.uac_request Boolean Indicates if User Access Control (UAC) request was detected.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.injects Boolean Indicates if threat uses injections.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.service_luncher Boolean Indicates if new service registration was detected.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.executable_dropped Boolean Indicates if threat uses dropped executables.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.multiprocessing Boolean Indicates if threat uses multiprocessing.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.crashed_apps Boolean Indicates if application crashed.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.debug_output Boolean Indicates if application has debug output message.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.stealing Boolean Indicates if process steals info from infected machine.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.exploitable Boolean Indicates if any known exploit was detected.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.static_detections Boolean Indicates if any malicious pattern was detected by static analysis engine.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.susp_struct Boolean Is susp struct
ANYRUN.Lookup.relatedIncidents.process.scores.specs.autostart Boolean Indicates if application was added to autostart.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.low_access Boolean Indicates if threat uses low level access.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.tor Boolean Indicates if TOR was used.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.spam Boolean Indicates if spam was detected.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.malware_config Boolean Indicates if malware config was extracted from submitted file.
ANYRUN.Lookup.relatedIncidents.process.scores.specs.process_dump Boolean Indicates if the process memory dump can be extracted.
ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.registry Number Number or registry events.
ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.files Number Number or files.
ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.modules Number Number or modules.
ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.objects Number Number or objects.
ANYRUN.Lookup.relatedIncidents.process.threatLevel Number Threat level.
ANYRUN.Lookup.relatedIncidents.event.destinationIpAsn String Destination IP ASN (autonomous system number).
ANYRUN.Lookup.relatedIncidents.event.title String Title of event type.
ANYRUN.Lookup.relatedIncidents.event.url String URL.
ANYRUN.Lookup.relatedIncidents.event.domainName String Domain name
ANYRUN.Lookup.relatedIncidents.event.ruleThreatLevel String Rule threat level.
ANYRUN.Lookup.destinationIP.destinationIP String Destination IP address.
ANYRUN.Lookup.destinationIP.date Date Creation date.
ANYRUN.Lookup.destinationIP.threatLevel Number Threat level.
ANYRUN.Lookup.destinationIP.threatName Unknown Threat names.
ANYRUN.Lookup.destinationIP.isMalconf Boolean Indicates if the IOC was extracted from malware configuration.
ANYRUN.Lookup.relatedFiles.task String Link to the task in ANY.RUN sandbox.
ANYRUN.Lookup.relatedFiles.fileLink String Link to the HTTP response files.
ANYRUN.Lookup.relatedFiles.time Date Creation date.
ANYRUN.Lookup.relatedFiles.process.commandLine String Command line string.
ANYRUN.Lookup.relatedFiles.process.imagePath String Image path string.
ANYRUN.Lookup.relatedFiles.process.MITRE String Array of MITRE matrix techniques IDs ans sub-techniques IDs.
ANYRUN.Lookup.relatedFiles.process.pid Number Process ID.
ANYRUN.Lookup.relatedFiles.process.scores.specs.known_threat Boolean Indicates if it is a known threat.
ANYRUN.Lookup.relatedFiles.process.scores.specs.network_loader Boolean Indicates if network download was detected.
ANYRUN.Lookup.relatedFiles.process.scores.specs.network Boolean Indicates if network activity was enabled.
ANYRUN.Lookup.relatedFiles.process.scores.specs.uac_request Boolean Indicates if User Access Control (UAC) request was detected.
ANYRUN.Lookup.relatedFiles.process.scores.specs.injects Boolean Indicates if threat uses injections.
ANYRUN.Lookup.relatedFiles.process.scores.specs.service_luncher Boolean Indicates if new service registration was detected.
ANYRUN.Lookup.relatedFiles.process.scores.specs.executable_dropped Boolean Indicates if threat uses dropped executables.
ANYRUN.Lookup.relatedFiles.process.scores.specs.multiprocessing Boolean Indicates if threat uses multiprocessing.
ANYRUN.Lookup.relatedFiles.process.scores.specs.crashed_apps Boolean Indicates if application crashed.
ANYRUN.Lookup.relatedFiles.process.scores.specs.debug_output Boolean Indicates if application has debug output message.
ANYRUN.Lookup.relatedFiles.process.scores.specs.stealing Boolean Indicates if process steals info from infected machine.
ANYRUN.Lookup.relatedFiles.process.scores.specs.exploitable Boolean Indicates if any known exploit was detected.
ANYRUN.Lookup.relatedFiles.process.scores.specs.static_detections Boolean Indicates if any malicious pattern was detected by static analysis engine.
ANYRUN.Lookup.relatedFiles.process.scores.specs.susp_struct Boolean Is susp struct.
ANYRUN.Lookup.relatedFiles.process.scores.specs.autostart Boolean Indicates if application was added to autostart.
ANYRUN.Lookup.relatedFiles.process.scores.specs.low_access Boolean Indicates if threat uses low level access.
ANYRUN.Lookup.relatedFiles.process.scores.specs.tor Boolean Indicates if TOR was used.
ANYRUN.Lookup.relatedFiles.process.scores.specs.spam Boolean Indicates if spam was detected.
ANYRUN.Lookup.relatedFiles.process.scores.specs.malware_config Boolean Indicates if malware config was extracted from submitted file.
ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.registry Number Number or registry events.
ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.files Number Number or files.
ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.modules Number Number or modules.
ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.objects Number Number or objects.
ANYRUN.Lookup.relatedFiles.process.threatLevel Number Threat level.
ANYRUN.Lookup.relatedFiles.hashes.md5 String MD5 hash string.
ANYRUN.Lookup.relatedFiles.hashes.sha1 String SHA1 hash string.
ANYRUN.Lookup.relatedFiles.hashes.sha256 String SHA256 hash string.
ANYRUN.Lookup.relatedFiles.hashes.ssdeep String Ssdeep hash string.
ANYRUN.Lookup.relatedFiles.process.threatName String Threat name.
ANYRUN.Lookup.relatedFiles.process.scores.specs.process_dump Boolean Indicates if the process memory dump can be extracted.
ANYRUN.Lookup.relatedDNS.domainName String Domain name.
ANYRUN.Lookup.relatedDNS.threatName Unknown Threat name.
ANYRUN.Lookup.relatedDNS.threatLevel Number Threat level.
ANYRUN.Lookup.relatedDNS.date Date Creation date.
ANYRUN.Lookup.relatedDNS.isMalconf Boolean Indicates if the IOC was extracted from malware configuration.
ANYRUN.Lookup.relatedURLs.url String URL.
ANYRUN.Lookup.relatedURLs.date Date Creation date.
ANYRUN.Lookup.relatedURLs.threatLevel Number Threat level.
ANYRUN.Lookup.relatedURLs.threatName Unknown Threat names.
ANYRUN.Lookup.relatedURLs.isMalconf Boolean Indicates if the IOC was extracted from malware configuration.
ANYRUN.Lookup.sourceTasks.uuid String Task UUID.
ANYRUN.Lookup.sourceTasks.related String Link to the task in ANY.RUN sandbox.
ANYRUN.Lookup.sourceTasks.date Date Task creation time.
ANYRUN.Lookup.sourceTasks.threatLevel Number Threat level.
ANYRUN.Lookup.sourceTasks.tags Unknown Tags.
ANYRUN.Lookup.sourceTasks.mainObject.type String Type.
ANYRUN.Lookup.sourceTasks.mainObject.name String Name.
ANYRUN.Lookup.sourceTasks.mainObject.hashes.md5 String MD5 hash string.
ANYRUN.Lookup.sourceTasks.mainObject.hashes.sha1 String SHA1 hash string.
ANYRUN.Lookup.sourceTasks.mainObject.hashes.sha256 String SHA256 hash string.
ANYRUN.Lookup.sourceTasks.mainObject.hashes.ssdeep String Ssdeep hash string.
ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectTime Date Time.
ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectType String Type.
ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectOperation String Operation.
ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectName String Name.
ANYRUN.Lookup.relatedSynchronizationObjects.task String Task link.
ANYRUN.Lookup.relatedSynchronizationObjects.process.commandLine String Command line string.
ANYRUN.Lookup.relatedSynchronizationObjects.process.imagePath String Image path string.
ANYRUN.Lookup.relatedSynchronizationObjects.process.MITRE Unknown Array of MITRE matrix techniques IDs ans sub-techniques IDs.
ANYRUN.Lookup.relatedSynchronizationObjects.process.pid Number Process ID.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.known_threat Boolean Indicates if it is a known threat.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.network_loader Boolean Indicates if network download was detected.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.network Boolean Indicates if network activity was enabled.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.uac_request Boolean Indicates if User Access Control (UAC) request was detected.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.injects Boolean Indicates if threat uses injections.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.service_luncher Boolean Indicates if new service registration was detected.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.executable_dropped Boolean Indicates if threat uses dropped executables.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.multiprocessing Boolean Indicates if threat uses multiprocessing.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.crashed_apps Boolean Indicates if application crashed.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.debug_output Boolean Indicates if application has debug output message.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.stealing Boolean Indicates if process steals info from infected machine.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.exploitable Boolean Indicates if any known exploit was detected.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.static_detections Boolean Indicates if any malicious pattern was detected by static analysis engine
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.susp_struct Boolean Is susp struct.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.autostart Boolean Indicates if application was added to autostart
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.low_access Boolean Indicates if threat uses low level access.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.tor Boolean Indicates if TOR was used.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.spam Boolean Indicates if spam was detected.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.malware_config Boolean Indicates if malware config was extracted from submitted file.
ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.registry Number Number or registry events.
ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.files Number Number or files.
ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.modules Number Number or modules.
ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.objects Number Number or objects.
ANYRUN.Lookup.relatedSynchronizationObjects.process.threatLevel Number Threat level.
ANYRUN.Lookup.relatedSynchronizationObjects.process.threatName String Threat name.
ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.process_dump Boolean Indicates if the process memory dump can be extracted.
ANYRUN.Lookup.relatedNetworkThreats.suricataClass String Suricata class.
ANYRUN.Lookup.relatedNetworkThreats.imagePath String Image path.
ANYRUN.Lookup.relatedNetworkThreats.suricataID String SID.
ANYRUN.Lookup.relatedNetworkThreats.suricataMessage String Suricata message.
ANYRUN.Lookup.relatedNetworkThreats.tags Unknown Tags.
ANYRUN.Lookup.relatedNetworkThreats.MITRE Unknown Array of MITRE matrix techniques IDs ans sub-techniques IDs.
ANYRUN.Lookup.relatedNetworkThreats.suricataThreatLevel String Suricata threat level.
ANYRUN.Lookup.relatedNetworkThreats.task String Task link.
ANYRUN.Lookup.summary.threatLevel Number Threat level.
ANYRUN.Lookup.summary.lastSeen Date Last Seen Date
ANYRUN.Lookup.summary.detectedType String Detected type.
ANYRUN.Lookup.summary.isTrial Boolean Is trial request.
ANYRUN.Lookup.summary.tags String Tags.
ANYRUN.Lookup.summary.details.type String IOC type.
ANYRUN.Lookup.summary.details.threatLevel Number Threat level.
ANYRUN.Lookup.summary.details.lastSeen Date Last Seen Date
ANYRUN.Lookup.summary.details.count Number Count of iocs/objects by threat level

ip

Check the IP address reputation.

Base Command

ip

Input

Argument Name Description Required
ip IP address to check. Required

Context Output

Path Type Description
IP.Address String The IP address.
IP.Country String The IP country.
IP.Port String The IP destination port.
IP.ASOwner String The IP autonomous system owner.
IP.LastModified String The IP last modified date.
IP.Tags String The IP related tags.
IP.FeedRelatedIndicators.value String The IP related indicator type.
IP.FeedRelatedIndicators.type String The IP related indicator value.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

domain

Check the Domain name reputation.

Base Command

domain

Input

Argument Name Description Required
domain Domain name to check. Required

Context Output

Path Type Description
Domain.Name String The Domain name.
Domain.Country String The Domain country.
Domain.Port String The Domain destination port.
Domain.ASOwner String The Domain autonomous system owner.
Domain.LastModified String The Domain last modified date.
Domain.Tags String The Domain related tags.
Domain.FeedRelatedIndicators.value String The Domain related indicator type.
Domain.FeedRelatedIndicators.type String The Domain related indicator value.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

url

Check the URL reputation.

Base Command

url

Input

Argument Name Description Required
url URL to check. Required

Context Output

Path Type Description
URL.Data String The URL name.
URL.Country String The URL country.
URL.Port String The URL destination port.
URL.ASOwner String The URL autonomous system owner.
URL.LastModified String The URL last modified date.
URL.Tags String The URL related tags.
URL.FeedRelatedIndicators.value String The URL related indicator type.
URL.FeedRelatedIndicators.type String The URL related indicator value.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

file

Check the SHA256 hash reputation.

Base Command

file

Input

Argument Name Description Required
file SHA256 hash to check. Required

Context Output

Path Type Description
File.Name String The File name.
File.Extension String The File extension.
File.Path String The File path.
File.SHA256 String The File SHA256 hash value.
File.SHA1 String The File SHA1 hash value.
File.MD5 String The File MD5 hash value.
File.SSDeep String The ssdeep hash of the File (same as displayed in file entries).
File.Tags String The File related tags.
File.FeedRelatedIndicators.value String The File related indicator type.
File.FeedRelatedIndicators.type String The File related indicator value.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Configuration parameters

  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability

Commands (5)

  • anyrun-get-intelligence

    Perform threat intelligence using specified IOC. Attaches a JSON summary to WarRoom.

  • domain

    Check Domain reputation (when information is available, returns a JSON with details).

  • file

    Check File reputation (when information is available, returns a JSON with details).

  • ip

    Check IP reputation (when information is available, returns a JSON with details).

  • url

    Check URL reputation (when information is available, returns a JSON with details).

Source

AnyRunLookup.py AnyRunLookup_test.py AnyRunLookup.yml AnyRunLookup_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: AnyRun
sectionorder:
- Connect
- Collect
commonfields:
  id: ANY.RUN TI Lookup
  version: -1
configuration:
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- name: integrationReliability
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
description: TI Lookup is a searchable database of IOCs, IOAs, IOBs, and events for threat hunting and a service for browsing malicious files by their content.
display: ANY.RUN TI Lookup
name: ANY.RUN TI Lookup
script:
  commands:
  - arguments:
    - description: 'Specify the number of days from the current date for which you want to lookup.'
      name: lookup_depth
      required: false
      type: Number
    - description: 'Raw query with necessary filters. Supports condition concatenation with AND, OR, NOT and Parentheses ().'
      name: query
      required: false
      type: String
    - description: 'The name of a particular threat: malware family, threat type, etc., as identified by the sandbox. Example: "Phishing".'
      name: threat_name
      required: false
      type: String
    - auto: PREDEFINED
      description: 'A verdict on the threat level of the sample.'
      name: threat_level
      required: false
      type: String
      predefined:
      - 'suspicious'
      - 'malicious'
      - 'info'
    - auto: PREDEFINED
      description: 'The type of the sample submitted to the sandbox.'
      name: task_type
      required: false
      type: String
      predefined:
      - 'File'
      - 'URL'
    - description: 'The country from which the threat sample was submitted. Example: "es".'
      name: submission_country
      required: false
      type: String
    - auto: PREDEFINED
      description: 'The specific version of Windows used in the environment.'
      name: os
      required: false
      type: String
      predefined:
      - 'Windows 7'
      - 'Windows 8'
      - 'Windows 11'
    - auto: PREDEFINED
      description: 'The software package of applications installed on the OS.'
      name: os_software_set
      required: false
      type: String
      predefined:
      - 'clean'
      - 'office'
      - 'complete'
    - auto: PREDEFINED
      description: 'The bitness of the operating system.'
      name: os_bit_version
      required: false
      type: String
      predefined:
      - '32'
      - '64'
    - description: 'The specific key within the registry hive where the modification occurred. Please note: when entering registry keys, use a double backslash (\) to escape the single backslash. Example: "Windows\\CurrentVersion\\RunOnce.'
      name: registry_key
      required: false
      type: String
    - description: 'The name of the Windows Registry key field. Example: "browseinplace".'
      name: registry_name
      required: false
      type: String
    - description: 'The value of the Windows Registry key. Example: "Internet Explorer\iexplore.exe.'
      name: registry_value
      required: false
      type: String
    - description: 'The full path to the module’s image file, the location on the disk where the module’s executable is stored. Example: "SysWOW64\\cryptbase.dll.'
      name: module_image_path
      required: false
      type: String
    - auto: PREDEFINED
      description: 'The threat level assigned to a particular event.'
      name: rule_threat_level
      required: false
      type: String
      predefined:
      - 'suspicious'
      - 'malicious'
      - 'info'
    - description: 'The name of the detection rule. Example: "Executable content was dropped or overwritten".'
      name: rule_name
      required: false
      type: String
    - description: 'Techniques used by the malware according to the MITRE ATT&CK classification. Example: "T1071".'
      name: mitre
      required: false
      type: String
    - description: 'Full path to process image. Example: "System32\\conhost.exe".'
      name: image_path
      required: false
      type: String
    - description: 'Full command line that initiated the process. Example: "PDQConnectAgent\\pdq-connect-agent.exe –service".'
      name: command_line
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Indication of whether a process has been injected.'
      name: injected_flag
      required: false
      type: String
      predefined:
      - 'true'
      - 'false'
    - description: 'The IP address of the network connection that was established or attempted. Example: "147.185.221.22".'
      name: destination_ip
      required: false
      type: String
    - description: 'The network port through which the connection was established. Example: "49760".'
      name: destination_port
      required: false
      type: String
    - description: 'Detected ASN. Example: "akamai-as".'
      name: destination_ip_asn
      required: false
      type: String
    - description: 'Two-letter country or region code of the detected IP geolocation. Example: "ae".'
      name: destination_ip_geo
      required: false
      type: String
    - description: 'The domain name that was recorded during the threat execution in a sandbox. Example: "tventyvd20sb.top".'
      name: domain_name
      required: false
      type: String
    - description: 'Types of TLS fingerprints that can indicate certain threats.'
      name: ja3
      required: false
      type: String
    - description: 'Types of TLS fingerprints that can indicate certain threats.'
      name: ja3s
      required: false
      type: String
    - description: 'Types of TLS fingerprints that can indicate certain threats.'
      name: jarm
      required: false
      type: String
    - description: 'The full path to the file on the system.'
      name: file_path
      required: false
      type: String
    - description: 'The path of a file associated with a file event.'
      name: file_event_path
      required: false
      type: String
    - description: 'The extension that indicates the file type.'
      name: file_extension
      required: false
      type: String
    - description: 'Hash values relating to a file.'
      name: sha256
      required: false
      type: String
    - description: 'Hash values relating to a file.'
      name: sha1
      required: false
      type: String
    - description: 'Hash values relating to a file.'
      name: md5
      required: false
      type: String
    - description: 'The category assigned to the threat by Suricata based on its characteristics. Example: "a network trojan was detected".'
      name: suricata_class
      required: false
      type: String
    - description: 'The description of the threat according to Suricata. Example: "ET INFO 404/Snake/Matiex Keylogger Style External IP Check".'
      name: suricata_message
      required: false
      type: String
    - auto: PREDEFINED
      description: 'The verdict on the threat according to Suricata based on its potential impact.'
      name: suricata_threat_level
      required: false
      type: String
      predefined:
      - 'suspicious'
      - 'malicious'
      - 'info'
    - description: 'The unique identifier of the Suricata rule: Example: "2044767".'
      name: suricata_id
      required: false
      type: String
    - description: 'The name or identifier of the synchronization object used. Example: "rmc".'
      name: sync_object_name
      required: false
      type: String
    - description: 'The type of synchronization object used. Example: "mutex".'
      name: sync_object_type
      required: false
      type: String
    - description: 'The operation performed on the synchronization object. Example: "create".'
      name: sync_object_operation
      required: false
      type: String
    - description: 'The URL called by the process. Example: "http://192.168.37.128:8880/zv8u".'
      name: url
      required: false
      type: String
    - description: 'The content type of the HTTP request sent to the server. Example: "application/json".'
      name: http_request_content_type
      required: false
      type: String
    - description: 'The content type of the HTTP response received from the server. Example: "text/html".'
      name: http_response_content_type
      required: false
      type: String
    - description: 'The file type of the file being uploaded in the HTTP request. Example: "binary".'
      name: http_request_file_type
      required: false
      type: String
    - description: 'The file type of the file being downloaded in the HTTP response. Example: "binary".'
      name: http_response_file_type
      required: false
      type: String
    description: 'Perform threat intelligence using specified IOC. Attaches a JSON summary to WarRoom.'
    name: anyrun-get-intelligence
    outputs:
      - contextPath: ANYRUN.Lookup.destinationPort
        description: 'Destination ports numbers.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.destinationIPgeo
        description: 'Destination IP Geo (countries).'
        type: Unknown
      - contextPath: ANYRUN.Lookup.destinationIpAsn.asn
        description: 'Destination IP ASN (autonomous system number).'
        type: String
      - contextPath: ANYRUN.Lookup.destinationIpAsn.date
        description: 'Destination IP ASN Date.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedTasks
        description: 'Links to related tasks in ANY.RUN sandbox.'
        type: String
      - contextPath: ANYRUN.Lookup.threatName
        description: 'Threat names.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.task
        description: 'Link to the task in ANY.RUN sandbox.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.time
        description: 'Creation time.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedIncidents.MITRE
        description: 'Array of MITRE matrix techniques IDs ans sub-techniques IDs.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.destinationPort
        description: 'Destination ports numbers.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.destinationIP
        description: 'Destination IP address.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.commandLine
        description: 'Command line string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.imagePath
        description: 'Image path string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.threatName
        description: 'Threat names.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.MITRE
        description: 'Array of MITRE matrix techniques IDs ans sub-techniques IDs.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.pid
        description: 'Process ID.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.known_threat
        description: 'Indicates if it is a known threat.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.network_loader
        description: 'Indicates if network download was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.network
        description: 'Indicates if network activity was enabled.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.uac_request
        description: 'Indicates if User Access Control (UAC) request was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.injects
        description: 'Indicates if threat uses injections.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.service_luncher
        description: 'Indicates if new service registration was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.executable_dropped
        description: 'Indicates if threat uses dropped executables.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.multiprocessing
        description: 'Indicates if threat uses multiprocessing.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.crashed_apps
        description: 'Indicates if application crashed.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.debug_output
        description: 'Indicates if application has debug output message.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.stealing
        description: 'Indicates if process steals info from infected machine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.exploitable
        description: 'Indicates if any known exploit was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.static_detections
        description: 'Indicates if any malicious pattern was detected by static analysis engine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.susp_struct
        description: 'Is susp struct.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.autostart
        description: 'Indicates if application was added to autostart.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.low_access
        description: 'Indicates if threat uses low level access.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.tor
        description: 'Indicates if TOR was used.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.spam
        description: 'Indicates if spam was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.malware_config
        description: 'Indicates if malware config was extracted from submitted file.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.scores.specs.process_dump
        description: 'Indicates if the process memory dump can be extracted.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.registry
        description: 'Number of registry events.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.files
        description: 'Number of files.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.modules
        description: 'Number of modules.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.eventsCounters.raw.objects
        description: 'Number of objects.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.process.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.destinationIpAsn
        description: 'Destination IP ASN (autonomous system number).'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.title
        description: 'Title of event type.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.url
        description: 'URL.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.domainName
        description: 'Domain name.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedIncidents.event.ruleThreatLevel
        description: 'Rule threat level.'
        type: String
      - contextPath: ANYRUN.Lookup.destinationIP.destinationIP
        description: 'Destination IP address.'
        type: String
      - contextPath: ANYRUN.Lookup.destinationIP.date
        description: 'Creation date.'
        type: Date
      - contextPath: ANYRUN.Lookup.destinationIP.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.destinationIP.threatName
        description: 'Threat names.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.destinationIP.isMalconf
        description: 'Indicates if the IOC was extracted from malware configuration.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.task
        description: 'Link to the task in ANY.RUN sandbox.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.fileLink
        description: 'Link to the HTTP response files.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.time
        description: 'Creation date.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedFiles.process.commandLine
        description: 'Command line string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.process.imagePath
        description: 'Image path string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.process.MITRE
        description: 'Array of MITRE matrix techniques IDs ans sub-techniques IDs.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.process.pid
        description: 'Process ID.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.known_threat
        description: 'Indicates if it is a known threat.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.network_loader
        description: 'Indicates if network download was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.network
        description: 'Indicates if network activity was enabled.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.uac_request
        description: 'Indicates if User Access Control (UAC) request was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.injects
        description: 'Indicates if threat uses injections.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.service_luncher
        description: 'Indicates if new service registration was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.executable_dropped
        description: 'Indicates if threat uses dropped executables.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.multiprocessing
        description: 'Indicates if threat uses multiprocessing.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.crashed_apps
        description: 'Indicates if application crashed.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.debug_output
        description: 'Indicates if application has debug output message.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.stealing
        description: 'Indicates if process steals info from infected machine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.exploitable
        description: 'Indicates if any known exploit was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.static_detections
        description: 'Indicates if any malicious pattern was detected by static analysis engine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.susp_struct
        description: 'Is susp struct.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.autostart
        description: 'Indicates if application was added to autostart.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.low_access
        description: 'Indicates if threat uses low level access.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.tor
        description: 'Indicates if TOR was used.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.spam
        description: 'Indicates if spam was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.malware_config
        description: 'Indicates if malware config was extracted from submitted file.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.registry
        description: 'Number of registry events.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.files
        description: 'Number of files.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.modules
        description: 'Number of modules.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.process.eventsCounters.raw.objects
        description: 'Number of objects.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.process.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedFiles.hashes.md5
        description: 'MD5 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.hashes.sha1
        description: 'SHA1 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.hashes.sha256
        description: 'SHA256 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.hashes.ssdeep
        description: 'Ssdeep hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.process.threatName
        description: 'Threat name.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedFiles.process.scores.specs.process_dump
        description: 'Indicates if the process memory dump can be extracted.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedDNS.domainName
        description: 'Domain name.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedDNS.threatName
        description: 'Threat name.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedDNS.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedDNS.date
        description: 'Creation date.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedDNS.isMalconf
        description: 'Indicates if the IOC was extracted from malware configuration.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedURLs.url
        description: 'URL.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedURLs.date
        description: 'Creation date.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedURLs.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedURLs.threatName
        description: 'Threat names.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedURLs.isMalconf
        description: 'Indicates if the IOC was extracted from malware configuration.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.sourceTasks.uuid
        description: 'Task UUID.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.related
        description: 'Link to the task in ANY.RUN sandbox.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.date
        description: 'Task creation time.'
        type: Date
      - contextPath: ANYRUN.Lookup.sourceTasks.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.sourceTasks.tags
        description: 'Tags.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.type
        description: 'Type.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.name
        description: 'Name.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.hashes.md5
        description: 'MD5 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.hashes.sha1
        description: 'SHA1 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.hashes.sha256
        description: 'SHA256 hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.sourceTasks.mainObject.hashes.ssdeep
        description: 'Ssdeep hash string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectTime
        description: 'Time.'
        type: Date
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectType
        description: 'Type.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectOperation
        description: 'Operation.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.syncObjectName
        description: 'Name.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.task
        description: 'Task link.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.commandLine
        description: 'Command line string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.imagePath
        description: 'Image path string.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.MITRE
        description: 'Array of MITRE matrix techniques IDs ans sub-techniques IDs.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.pid
        description: 'Process ID.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.known_threat
        description: 'Indicates if it is a known threat.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.network_loader
        description: 'Indicates if network download was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.network
        description: 'Indicates if network activity was enabled.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.uac_request
        description: 'Indicates if User Access Control (UAC) request was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.injects
        description: 'Indicates if threat uses injections.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.service_luncher
        description: 'Indicates if new service registration was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.executable_dropped
        description: 'Indicates if threat uses dropped executables.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.multiprocessing
        description: 'Indicates if threat uses multiprocessing.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.crashed_apps
        description: 'Indicates if application crashed.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.debug_output
        description: 'Indicates if application has debug output message.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.stealing
        description: 'Indicates if process steals info from infected machine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.exploitable
        description: 'Indicates if any known exploit was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.static_detections
        description: 'Indicates if any malicious pattern was detected by static analysis engine.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.susp_struct
        description: 'Is susp struct.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.autostart
        description: 'Indicates if application was added to autostart.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.low_access
        description: 'Indicates if threat uses low level access.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.tor
        description: 'Indicates if TOR was used.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.spam
        description: 'Indicates if spam was detected.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.malware_config
        description: 'Indicates if malware config was extracted from submitted file.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.registry
        description: 'Number of registry events.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.files
        description: 'Number of files.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.modules
        description: 'Number of modules.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.eventsCounters.raw.objects
        description: 'Number of objects.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.threatName
        description: 'Threat name.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedSynchronizationObjects.process.scores.specs.process_dump
        description: 'Indicates if the process memory dump can be extracted.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.suricataClass
        description: 'Suricata class.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.imagePath
        description: 'Image path.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.suricataID
        description: 'SID.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.suricataMessage
        description: 'Suricata message.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.tags
        description: 'Tags.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.MITRE
        description: 'Array of MITRE matrix techniques IDs ans sub-techniques IDs.'
        type: Unknown
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.suricataThreatLevel
        description: 'Suricata threat level.'
        type: String
      - contextPath: ANYRUN.Lookup.relatedNetworkThreats.task
        description: 'Task link.'
        type: String
      - contextPath: ANYRUN.Lookup.summary.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.summary.lastSeen
        description: 'Last Seen Date.'
        type: Date
      - contextPath: ANYRUN.Lookup.summary.detectedType
        description: 'Detected type.'
        type: String
      - contextPath: ANYRUN.Lookup.summary.isTrial
        description: 'Is trial request.'
        type: Boolean
      - contextPath: ANYRUN.Lookup.summary.tags
        description: 'Tags.'
        type: String
      - contextPath: ANYRUN.Lookup.summary.details.type
        description: 'IOC type.'
        type: String
      - contextPath: ANYRUN.Lookup.summary.details.threatLevel
        description: 'Threat level.'
        type: Number
      - contextPath: ANYRUN.Lookup.summary.details.lastSeen
        description: 'Last Seen Date.'
        type: Date
      - contextPath: ANYRUN.Lookup.summary.details.count
        description: 'Count of iocs/objects by threat level.'
        type: Number
  - arguments:
      - default: true
        description: IP address to query.
        isArray: true
        name: ip
        required: true
    description: Check IP reputation (when information is available, returns a JSON with details).
    name: ip
    outputs:
      - contextPath: IP.Address
        description: The IP address.
        type: String
      - contextPath: IP.Port
        description: Ports that are associated with the IP.
        type: String
      - contextPath: IP.Tags
        description: Tags related the IP use (hosting, proxy, tor, vpn).
        type: String
      - contextPath: IP.FeedRelatedIndicators.value
        description: Names of indicators associated with the IP.
        type: String
      - contextPath: IP.FeedRelatedIndicators.type
        description: Types of indicators associated with the IP.
        type: String
      - contextPath: IP.Country
        description: The IP country.
        type: String
      - contextPath: IP.ASOwner
        description: The autonomous system owner of the IP.
        type: String
      - contextPath: IP.LastModified
        description: The date that the IP was last updated.
        type: Date
      - contextPath: DBotScore.Indicator
        description: The indicator that was tested.
        type: String
      - contextPath: DBotScore.Score
        description: The actual score.
        type: Number
      - contextPath: DBotScore.Reliability
        description: How reliable the score is (for example, "C - fairly reliable").
        type: String
      - contextPath: DBotScore.Type
        description: The indicator type.
        type: String
      - contextPath: DBotScore.Vendor
        description: The vendor used to calculate the score.
        type: String
  - arguments:
      - default: true
        description: Domain name to query.
        isArray: true
        name: domain
        required: true
    description: Check Domain reputation (when information is available, returns a JSON with details).
    name: domain
    outputs:
      - contextPath: Domain.Name
        description: The Domain name.
        type: String
      - contextPath: Domain.Port
        description: Ports that are associated with the Domain.
        type: String
      - contextPath: Domain.Tags
        description: Tags related the Domain use (hosting, proxy, tor, vpn).
        type: String
      - contextPath: Domain.FeedRelatedIndicators.value
        description: Names of indicators associated with the Domain.
        type: String
      - contextPath: Domain.FeedRelatedIndicators.type
        description: Types of indicators associated with the Domain.
        type: String
      - contextPath: Domain.Country
        description: The Domain country.
        type: String
      - contextPath: Domain.ASOwner
        description: The autonomous system owner of the Domain.
        type: String
      - contextPath: Domain.LastModified
        description: The date that the Domain was last updated.
        type: Date
      - contextPath: DBotScore.Indicator
        description: The indicator that was tested.
        type: String
      - contextPath: DBotScore.Score
        description: The actual score.
        type: Number
      - contextPath: DBotScore.Reliability
        description: How reliable the score is (for example, "C - fairly reliable").
        type: String
      - contextPath: DBotScore.Type
        description: The indicator type.
        type: String
      - contextPath: DBotScore.Vendor
        description: The vendor used to calculate the score.
        type: String
  - arguments:
      - default: true
        description: URL to query.
        isArray: true
        name: url
        required: true
    description: Check URL reputation (when information is available, returns a JSON with details).
    name: url
    outputs:
      - contextPath: URL.Data
        description: The URL name.
        type: String
      - contextPath: URL.Port
        description: Ports that are associated with the URL.
        type: String
      - contextPath: URL.Tags
        description: Tags related the URL use (hosting, proxy, tor, vpn).
        type: String
      - contextPath: URL.ASOwner
        description: The autonomous system owner of the IP.
        type: String
      - contextPath: URL.LastModified
        description: The date that the IP was last updated.
        type: Date
      - contextPath: URL.FeedRelatedIndicators.value
        description: Names of indicators associated with the URL.
        type: String
      - contextPath: URL.FeedRelatedIndicators.type
        description: Types of indicators associated with the URL.
        type: String
      - contextPath: URL.Country
        description: The URL country.
        type: String
      - contextPath: DBotScore.Indicator
        description: The indicator that was tested.
        type: String
      - contextPath: DBotScore.Score
        description: The actual score.
        type: Number
      - contextPath: DBotScore.Reliability
        description: How reliable the score is (for example, "C - fairly reliable").
        type: String
      - contextPath: DBotScore.Type
        description: The indicator type.
        type: String
      - contextPath: DBotScore.Vendor
        description: The vendor used to calculate the score.
        type: String
  - arguments:
      - default: true
        description: File to query.
        isArray: true
        name: file
        required: true
    description: Check File reputation (when information is available, returns a JSON with details).
    name: file
    outputs:
      - contextPath: File.Name
        description: The File name.
        type: String
      - contextPath: File.Extension
        description: The File name.
        type: String
      - contextPath: File.Path
        description: The File path.
        type: String
      - contextPath: File.SHA256
        description: The SHA256 hash of the file.
      - contextPath: File.SHA1
        description: The SHA1 hash of the file.
      - contextPath: File.MD5
        description: The MD5 hash of the file.
        type: String
      - contextPath: File.SSDeep
        description: The ssdeep hash of the file (same as displayed in file entries).
        type: String
      - contextPath: File.Tags
        description: Tags related the File use (hosting, proxy, tor, vpn).
        type: String
      - contextPath: File.FeedRelatedIndicators.value
        description: Names of indicators associated with the File.
        type: String
      - contextPath: File.FeedRelatedIndicators.type
        description: Types of indicators associated with the File.
        type: String
      - contextPath: DBotScore.Indicator
        description: The indicator that was tested.
        type: String
      - contextPath: DBotScore.Score
        description: The actual score.
        type: Number
      - contextPath: DBotScore.Reliability
        description: How reliable the score is (for example, "C - fairly reliable").
        type: String
      - contextPath: DBotScore.Type
        description: The indicator type.
        type: String
      - contextPath: DBotScore.Vendor
        description: The vendor used to calculate the score.
        type: String
  dockerimage: demisto/anyrun-sdk:1.0.0.10440656
  subtype: python3
  runonce: false
  script: '-'
  type: python
tests:
- No tests
fromversion: 6.0.0