Barracuda Reputation Block List

Details

ID	`Barracuda Reputation Block List - BRBL`
Provider	KKR
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

This integration enables reputation checks against IPs from Barracuda Reputation Block List (BRBL)
This integration was integrated and tested with Barracuda Reputation Block List (BRBL)

Configure Barracuda Reputation Block List (BRBL) in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Get IP Reputation

Base Command

ip

Input

Argument Name	Description	Required
ip	IP to look up	Required

Context Output

Path	Type	Description
ip	String	Get IP details from Barracuda(BRBL) service
Barracuda.IP	String	IP details
DBotScore.Indicator	String	The indicator itself
DBotScore.Score	Number	Score
DBotScore.Type	String	Type of the indicator
DBotScore.Vendor	String	Vendor information
IP.Address	String	IP address
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.

Command Example

!ip ip=1.1.1.1

Context Example

{
    "Barracuda": {
        "IP": {
            "indicator": "1.1.1.1"
        }
    },
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 0,
        "Type": "ip",
        "Vendor": "Barracuda"
    },
    "IP": {
        "Address": "1.1.1.1"
    }
}

Human Readable Output

Results

indicator

1.1.1.1

indicator
1.1.1.1

Configuration parameters

integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

ip
Get IP Reputation.

Source

BarracudaReputationBlockListBRBL.py BarracudaReputationBlockListBRBL.yml BarracudaReputationBlockListBRBL_description.md command_examples.txt

Download History Raw

commonfields:
  id: Barracuda Reputation Block List - BRBL
  version: -1
name: Barracuda Reputation Block List - BRBL
display: Barracuda Reputation Block List (BRBL)
category: Data Enrichment & Threat Intelligence
provider: KKR
description: This integration enables reputation checks against IPs from Barracuda Reputation Block List (BRBL).
configuration:
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: python
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP to look up.
      default: true
      isArray: true
    outputs:
    - contextPath: ip
      description: Get IP details from Barracuda(BRBL) service.
      type: String
    - contextPath: Barracuda.IP
      description: IP details.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    description: Get IP Reputation.
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  subtype: python3
fromversion: 6.0.0
tests:
- No tests (auto formatted)