Awake Security

Network Traffic Analysis.

Details

ID	`Awake Security`
Provider	Arista Networks
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Use the Awake Security integration to manage and respond to network threats.

Configure Awake Security on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Awake Security.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Credentials
- Awake Security server address
- Trust any certificate (not secure)
- Fetch incidents
- Incident type
- Use system proxy settings
- Comma-separated list of threat behaviors to generate incidents for, e.g., "Exfiltration: SSL upload from non-browser to notable domain, Lateral Movement: Unix-based PSEXEC, C2: Possible ICMP tunnel"
- Period between incident fetch interval (in minutes)
- Minimum threshold to determine an indicator suspicious in Cortex XSOAR
- Minimum threshold to determine an indicator malicious in Cortex XSOAR
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Query devices: awake-query-devices
Query activities: awake-query-activities
Query domains: awake-query-domains
Download a PCAP: awake-pcap-download
Lookup and enrich a domain: domain
Lookup and enrich an IP address: ip
Lookup and enrich an email address: email
Lookup and enrich a device: device

1. Query devices

Query devices in Awake Security.

Base Command

awake-query-devices

Input

Argument Name	Description	Required
queryExpression	A query expression in Awake Query Language	Optional
startTime	Query start time ("2000-01-01T00:00:00Z")	Required
endTime	Query end time ("2000-01-01T00:00:00Z")	Required
ipAddress	IP address to filter by (exact match)	Optional
deviceName	Device name to filter by (regular expression)	Optional
domainName	Domain name to filter by (regular expression)	Optional
protocol	Protocol to filter by (all uppercase, i.e. "TLS")	Optional
tag	Tag to filter by (regular expression)	Optional

Context Output

Path	Type	Description
AwakeSecurity.Devices.deviceId	string	Awake Security unique identifier for the specified device
AwakeSecurity.Devices.deviceName	string	Device name
AwakeSecurity.Devices.firstSeen	string	Date that the specified device was first seen
AwakeSecurity.Devices.lastSeen	string	Date that the specified device was last seen
AwakeSecurity.Devices.os	string	Operating system associated with the specified device
AwakeSecurity.Devices.deviceType	string	Device type
AwakeSecurity.Devices.ips	unknown	List of IP addresses associated with the specified device
AwakeSecurity.Devices.monitoringPointIds	string	List of monitoring point IDs the specified device was seen on
AwakeSecurity.Devices.application	string	List of applications the specified device was seen using
AwakeSecurity.Devices.notabilityPercentile	number	How the notability of this device compares to other devices
AwakeSecurity.Devices.numberSimilarDevices	number	Number of devices that are similar to this device
AwakeSecurity.Devices.numberSessions	number	Number of TCP sessions for this device
AwakeSecurity.Devices.ackTime	number	Date of the last TCP session acknowledgment of the device associated with the specified email address
AwakeSecurity.Devices.whiteListed	bool	Is the device associated with the specified email address in the allow list

Command Example

!awake-query-devices startTime="2018-07-18T07:00:00Z" endTime="2018-07-18T07:30:00Z"

Human Readable Output

2. Query activities

Query activities in Awake Security

Base Command

awake-query-activities

Input

Argument Name	Description	Required
queryExpression	A query expression in the Awake Query Language	Optional
startTime	Query start time ("2000-01-01T00:00:00Z")	Required
endTime	Query end time ("2000-01-01T00:00:00Z")	Required
ipAddress	IP address to filter by (exact match)	Optional
deviceName	Device name to filter by (regular expression)	Optional
domainName	Domain name to filter by (regular expression)	Optional
protocol	Protocol to filter by (all uppercase, e.g., "TLS")	Optional
tag	Tag to filter by (regular expression)	Optional

Context Output

Path	Type	Description
AwakeSecurity.Activities.activityId	string	UUID that uniquely identifies the activity
AwakeSecurity.Activities.sessionId	string	UUID that uniquely identifies the corresponding session
AwakeSecurity.Activities.sourceIP	string	IP address of the source
AwakeSecurity.Activities.sourceHost	string	Hostname of the source
AwakeSecurity.Activities.sourcePort	number	Port of the source
AwakeSecurity.Activities.destinationIP	string	IP address of the destination
AwakeSecurity.Activities.destinationHost	string	Hostname of the destination
AwakeSecurity.Activities.destinationPort	number	Port of the destination
AwakeSecurity.Activities.directionKnown	bool	Do we know for sure which endpoint was the client?
AwakeSecurity.Activities.activityDeviceName	string	Device name for the endpoint within your network
AwakeSecurity.Activities.activityStart	string	Date when the activity began
AwakeSecurity.Activities.activityEnd	string	Date when the activity ended
AwakeSecurity.Activities.protocols	string	Protocols that the activity used

Command Example

!awake-query-activities startTime="2018-07-01T00:00:00Z" endTime="2018-08-01T00:00:00Z" domainName="kck.st"

Human Readable Output

3. Query domains

Query domains in Awake Security

Base Command

awake-query-domains

Input

Argument Name	Description	Required
queryExpression	A query expression in the Awake Query Language	Optional
startTime	Query start time ("2000-01-01T00:00:00Z")	Required
endTime	Query end time ("2000-01-01T00:00:00Z")	Required
ipAddress	IP address to filter by (exact match)	Optional
deviceName	Device name to filter by (regular expression)	Optional
domainName	Domain name to filter by (regular expression)	Optional
protocol	Protocol to filter by (all uppercase, e.g., "TLS")	Optional
tag	Tag to filter by (regular expression)	Optional

Context Output

Path	Type	Description
AwakeSecurity.Domains.name	string	Domain name
AwakeSecurity.Domains.created	string	Date the specified domain was created
AwakeSecurity.Domains.lastUpdated	string	Date the specified domain was last updated
AwakeSecurity.Domains.registrantOrg	string	Organization of the registrant
AwakeSecurity.Domains.registrantCountry	string	Country of the registrant
AwakeSecurity.Domains.registrarName	string	Name of the registrar
AwakeSecurity.Domains.whoisServer	string	Address of the WHOIS server
AwakeSecurity.Domains.whoisFound	bool	Was this domain found via WHOIS
AwakeSecurity.Domains.deviceCount	number	Number of devices currently interacting with the specified domain
AwakeSecurity.Domains.totalDevices	number	Total number of devices that have interacted with the specified domain
AwakeSecurity.Domains.intelCount	number	Number of matches of imported intel against the specified domain
AwakeSecurity.Domains.lastSeen	number	Date of the most recent interaction with the specified domain
AwakeSecurity.Domains.nameservers	string	List of authoritative nameservers for the specified domain
AwakeSecurity.Domains.notability	number	Notability score of the domain
AwakeSecurity.Domains.whiteListed	bool	Is the specified domain in allow list

Command Example

!awake-query-domains startTime="2018-07-18T07:00:00Z" endTime="2018-07-18T07:30:00Z"

Human Readable Output

4. Download a PCAP

Download a PCAP.

Base Command

awake-pcap-download

Input

Argument Name	Description	Required
protocol	Protocol to filter by (all uppercase, e.g., "TLS")	Optional
hostA	First host's address	Optional
portA	First host's port	Optional
hostB	Second host's address	Optional
portB	Second host's port	Optional
startTime	Query start time ("2000-01-01T00:00:00Z")	Optional
endTime	Query end time ("2000-01-01T00:00:00Z")	Optional

Context Output

Path	Type	Description
File.Size	number	File size
File.MD5	string	MD5 of the file
File.SHA1	string	SHA-1 of the file
File.SHA256	string	SHA-256 of the file
File.Name	string	File name
File.SSDeep	string	SSDeep hash of the file
File.EntryID	string	War Room Entry ID of the file
File.Info	string	File common metadata
File.Type	string	File type
File.Extension	string	File Extension e.g., "pcap"

Command Example

!awake-pcap-download hostA="10.200.103.100" hostB="10.200.103.100" portA="67" portB="68"

Human Readable Output

5. Lookup and enrich a domain

Lookup and enrich a domain.

Base Command

domain

Input

Argument Name	Description	Required
domain	The domain name	Required
lookback_minutes	How many minutes of history to query from the current time. Default is 480.	Optional

Context Output

Path	Type	Description
AwakeSecurity.Domains.approxBytesTransferred	number	Approximate bytes the indicator transferred
AwakeSecurity.Domains.DomainWithSameRegistrant	unknown	Domains with the same registrant
AwakeSecurity.Domains.domainsWithSameRegistrant.registrationDate	string	Date that the domain with the same registrant as the specified domain was registered
AwakeSecurity.Domains.IntelSources	string	Indicators of compromise from Awake Security
AwakeSecurity.Domains.ipAddresses	string	IP addresses associated with the domain
AwakeSecurity.Domains.isAlexaTopOneMillion	string	Does the domain appear in Alexa 1 million list
AwakeSecurity.Domains.isDGA	boolean	Is domain generation algorithm
AwakeSecurity.Domains.lastSeen	string	Last time the domain was seen
AwakeSecurity.Domains.notabillity	number	Notability score of the domain
AwakeSecurity.Domains.numAssociatedActivities	number	Number of network activities associated with the domain
AwakeSecurity.Domains.numAssociatedADevices	number	Number of devices associated with the domain
AwakeSecurity.Domains.protocols	string	List of protocols used in the domain activities
AwakeSecurity.Domains.relatedSubdomains	string	Related subdomains of the specified domain
AwakeSecurity.Domains.subdomains	string	Subdomains of the specified domain
AwakeSecurity.Domains.topDevices	string	List of devices that accessed the specified domain (maximum is 10)
AwakeSecurity.Domains.totalNumDevices	number	Total number of devices that accessed the specified domain
AwakeSecurity.Domains.whiteListed	boolean	Is the specified domain in allow list
DBotScore.Indicator	string	The specified domain
DBotScore.Score	number	Severity score of the specified domain in Cortex XSOAR
DBotScore.Type	string	Indicator type in Cortex XSOAR
DBotScore.Vendor	string	Vendor used to assess the specified domain

Command Example

!domain domain="adobesc.com"

Human Readable Output

6. Lookup and enrich an IP address

Lookup and enrich an IP address.

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP address	Required
lookback_minutes	How many minutes of history to query from the current time. Default is 480.	Optional

Context Output

Path	Type	Description
AwakeSecurity.IPs.activityCount	number	Number of activities associated with the specified IP address
AwakeSecurity.IPs.deviceCount	number	Number of devices associated with the specified IP address
AwakeSecurity.IPs.devices	unknown	Device object associated with the specified IP address
AwakeSecurity.IPs.domains	unknown	Domain object associated with the specified IP address
AwakeSecurity.IPs.ipFirstSeen	string	Date that the IP address was first seen in Awake Security
AwakeSecurity.IPs.ipLastSeen	string	Date that the IP address was last seen in Awake Security
DBotScore.Indicator	string	The specified IP address
DBotScore.Score	number	Severity score of the specified IP address in Cortex XSOAR
DBotScore.Vendor	string	Vendor used to assess the specified IP address
DBotScore.Type	string	Indicator type in Cortex XSOAR

Command Example

!ip ip="10.200.104.236"

Human Readable Output

7. Lookup and enrich and enrich an email address

Lookup and enrich an email address.

Base Command

email

Input

Argument Name	Description	Required
email	The email address	Optional
lookback_minutes	How many minutes of history to query from the current time. Default is 480.	Optional

Context Output

Path	Type	Description
AwakeSecurity.Emails.deviceId	string	Device ID associated with the specified email address
AwakeSecurity.Emails.deviceName	string	Device name associated with the specified email address
AwakeSecurity.Emails.firstSeen	string	Date that the email address was first seen in Awake Security
AwakeSecurity.Emails.lastSeen	string	Date that the email address was last seen in Awake Security
AwakeSecurity.Emails.duration	string	Time (in seconds) between the email address first seen date and last seen date in Awake Security
AwakeSecurity.Emails.os	string	Operating system of the device associated with the specified email address
AwakeSecurity.Emails.deviceType	string	Device type associated with the specified email address
AwakeSecurity.Emails.ips	string	IP addresses that the device associated with the specified email address accessed
AwakeSecurity.Emails.monitoringPointIds	string	Monitoring point IDs on which the device associated with the specified email address were seen
AwakeSecurity.Emails.application	string	Email applications associated with this email address
AwakeSecurity.Emails.notabilityPercentile	number	Notability (risk score) of the specified email address
AwakeSecurity.Emails.numberSimilarDevices	number	Number of similar devices associated with the device of the specified email addresses
AwakeSecurity.Emails.numberSessions	number	Number of TCP sessions the device associated with this email address initiated
AwakeSecurity.Emails.ackTime	string	Date of the last TCP session acknowledgment of the device associated with the specified email address
AwakeSecurity.Emails.whiteListed	bool	Is the device associated with the specified email address in the allow list
DBotScore.Score	number	Severity score of the specified email address in Cortex XSOAR
DBotScore.Type	string	Indicator type in Cortex XSOAR
DBotScore.Vendor	string	Vendor used to assess the specified email address
DBotScore.Indicator	string	The specified email address

Command Example

!email email="rajguru2003@yahoo.com"

Human Readable Output

8. Lookup and enrich a device

Lookup and enrich a device.

Base Command

device

Input

Argument Name	Description	Required
device	The device ID	Required
lookback_minutes	How many minutes of history to query from the current time. Default is 480.	Optional

Context Output

Path	Type	Description
AwakeSecurity.Devices.deviceScore	number	Risk score of the specified device
AwakeSecurity.Devices.notableDomainCount.value	number	Number of suspicious domains accessed by the specified device
AwakeSecurity.Devices.notableDomainCount.percentile	number	Percentile of the specified device for notable domains accessed
AwakeSecurity.Devices.notableDomainCount.weight	number	Importance given to the suspicious domains when calculating the specified device risk score
AwakeSecurity.Devices.iocCount.value	number	Number of suspicious IOCs associated with the specified device
AwakeSecurity.Devices.iocCount.percentile	number	Percentile of the specified device for notable IOCs
AwakeSecurity.Devices.iocCount.weight	number	Importance given to the IOCs when calculating the specified device risk score
AwakeSecurity.Devices.watchlistCount.value	number	Total number of current threat behaviors associated with the specified device
AwakeSecurity.Devices.watchlistCount.percentile	number	How this device compares to other devices for number of threat behaviors
AwakeSecurity.Devices.watchlistCount.weight	number	Importance given to the threat behaviors when calculating the specified device risk score
AwakeSecurity.Devices.activityCount.value	number	Number of characteristic artifacts associated with the specified device
AwakeSecurity.Devices.activityCount.percentile	number	How this device compares to other devices for characteristic artifacts
AwakeSecurity.Devices.activityCount.weight	number	Importance given to the characteristic artifacts when calculating the specified device risk score
AwakeSecurity.Devices.deviceName	string	Device name
AwakeSecurity.Devices.deviceType	string	Device type
AwakeSecurity.Devices.os	string	Operating system associated with the specified device
AwakeSecurity.Devices.recentIp	string	Most recent IP address associated with the specified device
AwakeSecurity.Devices.activeIp	string	Most common IP address associated with the specified device
AwakeSecurity.Devices.commonEmail	string	Most common email address associated with the specified device
AwakeSecurity.Devices.commonUsername	string	Most common username associated with the specified device
AwakeSecurity.Devices.commonMpid	string	Most common monitoring point ID the specified device was seen on
AwakeSecurity.Devices.nSimilarDevices	number	Number of devices that are similar to the specified device
AwakeSecurity.Devices.tags	string	Tags applied to the specified device
AwakeSecurity.Devices.ipCount	number	Number of IP addresses associated with the specified device
AwakeSecurity.Devices.emailCount	number	Number of email addresses associated with this device
AwakeSecurity.Devices.usernameCount	number	Number of usernames associated with the specified device
AwakeSecurity.Devices.applicationCount	number	Number of applications associated with the specified device
AwakeSecurity.Devices.mpids	string	List of monitoring point IDs associated with the specified device
AwakeSecurity.Devices.protocols.count	number	Number of time this protocol was used by the specified device
AwakeSecurity.Devices.firstSeen	string	Date that the specified device was first seen
AwakeSecurity.Devices.lastSeen	string	Date that the specified device was last seen
AwakeSecurity.Devices.osVersion	string	Operating system version of the specified device
AwakeSecurity.Devices.deviceGuid	string	Awake Security unique identifier for the specified device
AwakeSecurity.Devices.ips	unknown	List of IP addresses associated with the specified device
AwakeSecurity.Devices.usernames	string	List of usernames that were inferred as accounts on the specified device
AwakeSecurity.Devices.emails	string	List of email addresses associated with the specified device
AwakeSecurity.Devices.ackTs	string	Date of the last TCP session acknowledgment of the specified device
AwakeSecurity.Devices.whiteListed	bool	Is the device associated with the specified email address in the allow list
AwakeSecurity.Devices.protocols.name	string	Type of protocol used by the specified device

Command Example

!device device="dae6720d-0588-d23b-c006-63cf1134537b"

Human Readable Output

Configuration parameters

credentials — Credentials (required)
server — Awake Security server address (required)
unsecure — Trust any certificate (not secure)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
proxy — Use system proxy settings
threat_behaviors — Comma-separated list of threat behaviors to generate incidents for, e.g., "Exfiltration: SSL upload from non-browser to notable domain, Lateral Movement: Unix-based PSEXEC, C2: Possible ICMP tunnel"
fetch_interval — Period between incident fetch interval (in minutes) (required)
suspicious_threshold — Minimum threshold to determine an indicator suspicious in Demisto (required)
malicious_threshold — Minimum threshold to determine an indicator malicious in Demisto (required)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (8)

awake-pcap-download
Download a PCAP.
awake-query-activities
Query activities in Awake Security.
awake-query-devices
Query devices in Awake Security.
awake-query-domains
Query domains in Awake Security.
device
Lookup and enrich a device.
domain
Lookup and enrich a domain.
email
Lookup and enrich an email address.
ip
Lookup and enrich an IP address.

Source

AwakeSecurity.py AwakeSecurity.yml

Download History Raw

commonfields:
  id: Awake Security
  version: -1
sectionorder:
- Connect
- Collect
name: Awake Security
display: Awake Security
category: Network Security
provider: Arista Networks
description: Network Traffic Analysis.
detaileddescription: ""
configuration:
- display: Credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- display: Awake Security server address
  name: server
  defaultvalue: https://example.awake.cloud
  type: 0
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: 'Comma-separated list of threat behaviors to generate incidents for, e.g., "Exfiltration: SSL upload from non-browser to notable domain, Lateral Movement: Unix-based PSEXEC, C2: Possible ICMP tunnel"'
  name: threat_behaviors
  defaultvalue: ""
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Period between incident fetch interval (in minutes)
  name: fetch_interval
  defaultvalue: "1"
  type: 0
  required: true
  section: Collect
  advanced: true
- display: Minimum threshold to determine an indicator suspicious in Demisto
  name: suspicious_threshold
  defaultvalue: "33"
  type: 0
  required: true
  section: Connect
- display: Minimum threshold to determine an indicator malicious in Demisto
  name: malicious_threshold
  defaultvalue: "66"
  type: 0
  required: true
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Connect
  advanced: true
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  section: Connect
  advanced: true
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  section: Connect
  advanced: true
  required: false
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: awake-query-devices
    arguments:
    - name: queryExpression
      description: A query expression in Awake Query Language.
    - name: startTime
      required: true
      description: Query start time ("2000-01-01T00:00:00Z").
    - name: endTime
      required: true
      description: Query end time ("2000-01-01T00:00:00Z").
    - name: ipAddress
      description: IP address to filter by (exact match).
    - name: deviceName
      description: Device name to filter by (regular expression).
    - name: domainName
      description: Domain name to filter by (regular expression).
    - name: protocol
      description: Protocol to filter by (all uppercase, i.e. "TLS").
    - name: tag
      description: Tag to filter by (regular expression).
    outputs:
    - contextPath: AwakeSecurity.Devices.deviceId
      description: Awake Security unique identifier for the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.deviceName
      description: Device name.
      type: string
    - contextPath: AwakeSecurity.Devices.firstSeen
      description: Date that the specified device was first seen.
      type: string
    - contextPath: AwakeSecurity.Devices.lastSeen
      description: Date that the specified device was last seen.
      type: string
    - contextPath: AwakeSecurity.Devices.os
      description: Operating system associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.deviceType
      description: Device type.
      type: string
    - contextPath: AwakeSecurity.Devices.ips
      description: List of IP addresses associated with the specified device.
      type: unknown
    - contextPath: AwakeSecurity.Devices.monitoringPointIds
      description: List of monitoring point IDs the specified device was seen on.
      type: string
    - contextPath: AwakeSecurity.Devices.application
      description: List of applications the specified device was seen using.
      type: string
    - contextPath: AwakeSecurity.Devices.notabilityPercentile
      description: How the notability of this device compares to other devices.
      type: number
    - contextPath: AwakeSecurity.Devices.numberSimilarDevices
      description: Number of devices that are similar to this device.
      type: number
    - contextPath: AwakeSecurity.Devices.numberSessions
      description: Number of TCP sessions for this device.
      type: number
    - contextPath: AwakeSecurity.Devices.ackTime
      description: Date of the last TCP session acknowledgment of the device associated with the specified email address.
      type: number
    - contextPath: AwakeSecurity.Devices.whiteListed
      description: Is the device associated with the specified email address in the allow list.
      type: bool
    description: Query devices in Awake Security.
  - name: awake-query-activities
    arguments:
    - name: queryExpression
      description: A query expression in the Awake Query Language.
    - name: startTime
      required: true
      description: Query start time ("2000-01-01T00:00:00Z").
    - name: endTime
      required: true
      description: Query end time ("2000-01-01T00:00:00Z").
    - name: ipAddress
      description: IP address to filter by (exact match).
    - name: deviceName
      description: Device name to filter by (regular expression).
    - name: domainName
      description: Domain name to filter by (regular expression).
    - name: protocol
      description: Protocol to filter by (all uppercase, i.e. "TLS").
    - name: tag
      description: 'Tag to filter by (regular expression).'
    outputs:
    - contextPath: AwakeSecurity.Activities.activityId
      description: UUID that uniquely identifies the activity.
      type: string
    - contextPath: AwakeSecurity.Activities.sessionId
      description: UUID that uniquely identifies the corresponding session.
      type: string
    - contextPath: AwakeSecurity.Activities.sourceIP
      description: IP address of the source.
      type: string
    - contextPath: AwakeSecurity.Activities.sourceHost
      description: Hostname of the source.
      type: string
    - contextPath: AwakeSecurity.Activities.sourcePort
      description: Port of the source.
      type: number
    - contextPath: AwakeSecurity.Activities.destinationIP
      description: IP address of the destination.
      type: string
    - contextPath: AwakeSecurity.Activities.destinationHost
      description: Hostname of the destination.
      type: string
    - contextPath: AwakeSecurity.Activities.destinationPort
      description: Port of the destination.
      type: number
    - contextPath: AwakeSecurity.Activities.directionKnown
      description: Do we know for sure which endpoint was the client?
      type: bool
    - contextPath: AwakeSecurity.Activities.activityDeviceName
      description: Device name for the endpoint within your network.
      type: string
    - contextPath: AwakeSecurity.Activities.activityStart
      description: Date when the activity began.
      type: string
    - contextPath: AwakeSecurity.Activities.activityEnd
      description: Date when the activity ended.
      type: string
    - contextPath: AwakeSecurity.Activities.protocols
      description: Protocols that the activity used.
      type: string
    description: Query activities in Awake Security.
  - name: awake-query-domains
    arguments:
    - name: queryExpression
      description: A query expression in the Awake Query Language.
    - name: startTime
      required: true
      description: Query start time ("2000-01-01T00:00:00Z").
    - name: endTime
      required: true
      description: Query end time ("2000-01-01T00:00:00Z").
    - name: ipAddress
      description: IP address to filter by (exact match).
    - name: deviceName
      description: Device name to filter by (regular expression).
    - name: domainName
      description: Domain name to filter by (regular expression).
    - name: protocol
      description: Protocol to filter by (all uppercase, i.e. "TLS").
    - name: tag
      description: 'Tag to filter by (regular expression).'
    outputs:
    - contextPath: AwakeSecurity.Domains.name
      description: Domain name.
      type: string
    - contextPath: AwakeSecurity.Domains.created
      description: Date the specified domain was created.
      type: string
    - contextPath: AwakeSecurity.Domains.lastUpdated
      description: Date the specified domain was last updated.
      type: string
    - contextPath: AwakeSecurity.Domains.registrantOrg
      description: Organization of the registrant.
      type: string
    - contextPath: AwakeSecurity.Domains.registrantCountry
      description: Country of the registrant.
      type: string
    - contextPath: AwakeSecurity.Domains.registrarName
      description: Name of the registrar.
      type: string
    - contextPath: AwakeSecurity.Domains.whoisServer
      description: Address of the WHOIS server.
      type: string
    - contextPath: AwakeSecurity.Domains.whoisFound
      description: Was this domain found via WHOIS.
      type: bool
    - contextPath: AwakeSecurity.Domains.deviceCount
      description: Number of devices currently interacting with the specified domain.
      type: number
    - contextPath: AwakeSecurity.Domains.totalDevices
      description: Total number of devices that have interacted with the specified domain.
      type: number
    - contextPath: AwakeSecurity.Domains.intelCount
      description: Number of matches of imported intel against the specified domain.
      type: number
    - contextPath: AwakeSecurity.Domains.lastSeen
      description: Date of the most recent interaction with the specified domain.
      type: number
    - contextPath: AwakeSecurity.Domains.nameservers
      description: List of authoritative nameservers for the specified domain.
      type: string
    - contextPath: AwakeSecurity.Domains.notability
      description: Notability score of the domain.
      type: number
    - contextPath: AwakeSecurity.Domains.whiteListed
      description: Is the specified domain in allow list.
      type: bool
    description: Query domains in Awake Security.
  - name: awake-pcap-download
    arguments:
    - name: protocol
      description: Protocol to filter by (all uppercase, e.g., "TLS").
    - name: hostA
      description: First host's address.
    - name: portA
      description: First host's port.
    - name: hostB
      description: Second host's address.
    - name: portB
      description: Second host's port.
    - name: startTime
      description: Query start time ("2000-01-01T00:00:00Z").
    - name: endTime
      description: Query end time ("2000-01-01T00:00:00Z").
    outputs:
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.MD5
      description: MD5 of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA-256 of the file.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: War room Entry ID of the file.
      type: string
    - contextPath: File.Info
      description: File common metadata.
      type: string
    - contextPath: File.Type
      description: File type.
      type: string
    - contextPath: File.Extension
      description: 'File Extension e.g: "pcap".'
      type: string
    description: Download a PCAP.
  - name: domain
    arguments:
    - name: domain
      required: true
      description: The domain names.
      isArray: true
      default: true
    - name: lookback_minutes
      description: How many minutes of history to query from the current time. Default is 480.
      defaultValue: "480"
    outputs:
    - contextPath: AwakeSecurity.Domains.approxBytesTransferred
      description: Approximate bytes the indicator transferred.
      type: number
    - contextPath: AwakeSecurity.Domains.DomainWithSameRegistrant
      description: Domains with the same registrant.
      type: unknown
    - contextPath: AwakeSecurity.Domains.domainsWithSameRegistrant.registrationDate
      description: Date that the domain with the same registrant as the specified domain was registered.
      type: string
    - contextPath: AwakeSecurity.Domains.IntelSources
      description: Indicators of compromise from Awake Security.
      type: string
    - contextPath: AwakeSecurity.Domains.ipAddresses
      description: IP addressesassociated with the domain.
      type: string
    - contextPath: AwakeSecurity.Domains.isAlexaTopOneMillion
      description: Does the domain appear in Alexa 1 million list.
      type: string
    - contextPath: AwakeSecurity.Domains.isDGA
      description: Is domain generation algorithm.
      type: boolean
    - contextPath: AwakeSecurity.Domains.lastSeen
      description: Last time the domain was seen.
      type: string
    - contextPath: AwakeSecurity.Domains.notabillity
      description: Notability score of the domain.
      type: number
    - contextPath: AwakeSecurity.Domains.numAssociatedActivities
      description: Number of network activities associated with the domain.
      type: number
    - contextPath: AwakeSecurity.Domains.numAssociatedADevices
      description: Number of devices associated with the domain.
      type: number
    - contextPath: AwakeSecurity.Domains.protocols
      description: List of protocols used in the domain activities.
      type: string
    - contextPath: AwakeSecurity.Domains.relatedSubdomains
      description: Related subdomains of the specified domain.
      type: string
    - contextPath: AwakeSecurity.Domains.subdomains
      description: Subdomains of the specified domain.
      type: string
    - contextPath: AwakeSecurity.Domains.topDevices
      description: LIst of devices that accessed the specified domain (maximum is 10).
      type: string
    - contextPath: AwakeSecurity.Domains.totalNumDevices
      description: Total number of devices that accessed the specified domain.
      type: number
    - contextPath: AwakeSecurity.Domains.whiteListed
      description: Is the specified domain in allow list.
      type: boolean
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    description: Lookup and enrich a domain.
  - name: ip
    arguments:
    - name: ip
      required: true
      description: The IP addresses.
      isArray: true
    - name: lookback_minutes
      description: How many minutes of history to query from the current time. Default is 480.
      defaultValue: "480"
    outputs:
    - contextPath: AwakeSecurity.IPs.activityCount
      description: Number of activities associated with the specified IP address.
      type: number
    - contextPath: AwakeSecurity.IPs.deviceCount
      description: Number of devices associated with the specified IP address.
      type: number
    - contextPath: AwakeSecurity.IPs.devices
      description: Device object associated with the specified IP address.
      type: unknown
    - contextPath: AwakeSecurity.IPs.domains
      description: Domain object associated with the specified IP address.
      type: unknown
    - contextPath: AwakeSecurity.IPs.ipFirstSeen
      description: Date that the IP address was first seen in Awake Security.
      type: string
    - contextPath: AwakeSecurity.IPs.ipLastSeen
      description: Date that the IP address was last seen in Awake Security.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: IP.Address
      description: The IP Address.
      type: String
    description: Lookup and enrich an IP address.
  - name: email
    arguments:
    - name: email
      description: The email addresses.
      isArray: true
    - name: lookback_minutes
      description: How many minutes of history to query from the current time. Default is 480.
      defaultValue: "480"
    outputs:
    - contextPath: AwakeSecurity.Emails.deviceId
      description: Device ID associated with the specified email address.
      type: string
    - contextPath: AwakeSecurity.Emails.deviceName
      description: Device name associated with the specified email address.
      type: string
    - contextPath: AwakeSecurity.Emails.firstSeen
      description: Date that the email address was first seen in Awake Security.
      type: string
    - contextPath: AwakeSecurity.Emails.lastSeen
      description: Date that the email address was last seen in Awake Security.
      type: string
    - contextPath: AwakeSecurity.Emails.duration
      description: Time (in seconds) between the email address first seen date and last seen date in Awake Security.
      type: string
    - contextPath: AwakeSecurity.Emails.os
      description: Operating system of the device associated with the specified email address.
      type: string
    - contextPath: AwakeSecurity.Emails.deviceType
      description: Device type associated with the specified email address.
      type: string
    - contextPath: AwakeSecurity.Emails.ips
      description: IP addresses that the device associated with the specified email address accessed.
      type: string
    - contextPath: AwakeSecurity.Emails.monitoringPointIds
      description: Monitoring point IDs on which the device associated with the specified email address were seen.
      type: string
    - contextPath: AwakeSecurity.Emails.application
      description: Email applications associated with this email address.
      type: string
    - contextPath: AwakeSecurity.Emails.notabilityPercentile
      description: Notability (risk score) of the specified email address.
      type: number
    - contextPath: AwakeSecurity.Emails.numberSimilarDevices
      description: Number of similar devices associated with the device of the specified email addresses.
      type: number
    - contextPath: AwakeSecurity.Emails.numberSessions
      description: Number of TCP sessions the device associated with this email address initiated.
      type: number
    - contextPath: AwakeSecurity.Emails.ackTime
      description: Date of the last TCP session acknowledgment of the device associated with the specified email address.
      type: string
    - contextPath: AwakeSecurity.Emails.whiteListed
      description: Is the device associated with the specified email address in the allow list.
      type: bool
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Lookup and enrich an email address.
  - name: device
    arguments:
    - name: device
      required: true
      description: The device ID.
    - name: lookback_minutes
      description: How many minutes of history to query from the current time. Default is 480.
      defaultValue: "480"
    outputs:
    - contextPath: AwakeSecurity.Devices.deviceScore
      description: Risk score of the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.notableDomainCount.value
      description: Number of suspicious domains accessed by the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.notableDomainCount.percentile
      description: Percentile of the specified device for notable domains accessed.
      type: number
    - contextPath: AwakeSecurity.Devices.notableDomainCount.weight
      description: Importance given to the suspicious domains when calculating the specified device risk score.
      type: number
    - contextPath: AwakeSecurity.Devices.iocCount.value
      description: Number of suspicious IOCs associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.iocCount.percentile
      description: Percentile of the specified device for notable IOCs.
      type: number
    - contextPath: AwakeSecurity.Devices.iocCount.weight
      description: Importance given to the IOCs when calculating the specified device risk score.
      type: number
    - contextPath: AwakeSecurity.Devices.watchlistCount.value
      description: Total number of current threat behaviors associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.watchlistCount.percentile
      description: How this device compares to other devices for number of threat behaviors.
      type: number
    - contextPath: AwakeSecurity.Devices.watchlistCount.weight
      description: Importance given to the threat behaviors when calculating the specified device risk score.
      type: number
    - contextPath: AwakeSecurity.Devices.activityCount.value
      description: Number of characteristic artifacts associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.activityCount.percentile
      description: How this device compares to other devices for characteristic artifacts.
      type: number
    - contextPath: AwakeSecurity.Devices.activityCount.weight
      description: Importance given to the characteristic artifacts when calculating the specified device risk score.
      type: number
    - contextPath: AwakeSecurity.Devices.deviceName
      description: Device name.
      type: string
    - contextPath: AwakeSecurity.Devices.deviceType
      description: Device type.
      type: string
    - contextPath: AwakeSecurity.Devices.os
      description: Operating system associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.recentIp
      description: Most recent IP address associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.activeIp
      description: Most common IP address associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.commonEmail
      description: Most common email address associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.commonUsername
      description: Most common username associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.commonMpid
      description: Most common monitoring point ID the specified device was seen on.
      type: string
    - contextPath: AwakeSecurity.Devices.nSimilarDevices
      description: Number of devices that are similar to the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.tags
      description: Tags applied to the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.ipCount
      description: Number of IP addresses associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.emailCount
      description: Number of email addresses associated with this device.
      type: number
    - contextPath: AwakeSecurity.Devices.usernameCount
      description: Number of usernames associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.applicationCount
      description: Number of applications associated with the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.mpids
      description: List of monitoring point IDs associated with th specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.protocols.count
      description: Number of time this protocol was used by the specified device.
      type: number
    - contextPath: AwakeSecurity.Devices.firstSeen
      description: Date that the specified device was first seen.
      type: string
    - contextPath: AwakeSecurity.Devices.lastSeen
      description: Date that the specified device was last seen.
      type: string
    - contextPath: AwakeSecurity.Devices.osVersion
      description: Operating system version of the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.deviceGuid
      description: Awake Security unique identifier for the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.ips
      description: List of IP addresses associated with the specified device.
      type: unknown
    - contextPath: AwakeSecurity.Devices.usernames
      description: List of usernames that were inferred as accounts on the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.emails
      description: List of email addresses associated with the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.ackTs
      description: Date of the last TCP session acknowledgment of the specified device.
      type: string
    - contextPath: AwakeSecurity.Devices.whiteListed
      description: Is the device associated with the specified email address in the allow list.
      type: bool
    - contextPath: AwakeSecurity.Devices.protocols.name
      description: Type of protocol used by the specified device.
      type: string
    description: Lookup and enrich a device.
  isfetch: true
tests:
- awake_security_test_pb
fromversion: 5.0.0