Blueliv ThreatCompass

Blueliv ThreatCompass systematically looks for information about companies,products, people, brands, logos, assets, technology and other information, depending on your needs. Blueliv ThreatCompass allows you to monitor and track all this information to keep your data, your organization and its employees safe.

Data Enrichment & Threat Intelligence · Blueliv ThreatCompass

Details

IDBlueliv ThreatCompass
ProviderOutpost24
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Blueliv ThreatCompass systematically looks for information about companies,products, people, brands, logos, assets, technology and other information, depending on your needs. Blueliv ThreatCompass allows you to monitor and track all this information to keep your data, your
organization and its employees safe

Configure Blueliv ThreatCompass in Cortex

Parameter Description Required
url Server URL (e.g. https://demisto.blueliv.com/api/v2 ) False
credentials Username False
organization Organization ID True
type Module Type True
module Module ID True
unsecure Trust any certificate (not secure) False
proxy Use system proxy settings False
isFetch Fetch incidents False
incidentType Incident type False
fetch_limit Fetch Limit (Max.- 200, Recommended less than 50) False
fetch_status Fetch resource status (POSITIVE, NEGATIVE…) False
first_fetch_time First fetch time False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

blueliv-resource-all

Recovers all resources from the module.

Base Command

blueliv-resource-all

Input

Argument Name Description Required
startDate Minimum date to recover resources. Formats: yyyy-mm-dd or yyyy-mm-ddThh:mm:ss Optional
finalDate Maximum date to recover resources. Formats: yyyy-mm-dd or yyyy-mm-ddThh:mm:ss Optional
page Results page to get. For each page, there are {limit} resources. Optional
limit Maximum number of resources to recover Optional

Context Output

Path Type Description
BluelivThreatCompass Unknown List object of recovered resources

Command Example

!blueliv-resource-all limit=10

Context Example

{
    "BluelivThreatCompass": {
        "DataLeakage": [
            {
                "analysis_calc_result": "POSITIVE",
                "analysis_result": "POSITIVE",
                "analysis_user_result": "POSITIVE",
                "changed_at": 1589634898000,
                "checked_at": 1589634898000,
                "content_type": "text/html;charset=utf-8",
                "countries_id": "US",
                "created_at": 1589634898000,
                "domain_type": "SOCIAL_NETWORK",
                "fav": "USER_STARRED",
                "file": "2020/5/16/10712044.html",
                "followedUp": false,
                "history": [],
                "id": 10712044,
                "issued": false,
                "labels": [
                    {
                        "id": 1306,
                        "name": "Confidential",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 205,
                        "name": "TopScribdDocsSearch",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "en",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "falabella.com.pe",
                "search_words": [
                    "falabella.com.pe"
                ],
                "title": "TOTUS SEDE SJM FINAL.doc | Internet Protocols | Transmission Control Protocol",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://www.scribd.com/document/461608373",
                "user_rating": 3
            },
            {
                "analysis_calc_result": "POSITIVE",
                "analysis_result": "POSITIVE",
                "changed_at": 1589634865000,
                "checked_at": 1589634865000,
                "content_type": "text/html;charset=utf-8",
                "countries_id": "US",
                "created_at": 1589634865000,
                "domain_type": "SOCIAL_NETWORK",
                "fav": "NOT_STARRED",
                "file": "2020/5/16/10712019.html",
                "followedUp": false,
                "history": [],
                "id": 10712019,
                "issued": false,
                "labels": [
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 205,
                        "name": "TopScribdDocsSearch",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "en",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "falabella.com",
                "search_words": [
                    "falabella.com"
                ],
                "title": "CASO FALABELLA | America latina | Marketing",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://www.scribd.com/document/461631347",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "POSITIVE",
                "analysis_result": "POSITIVE",
                "changed_at": 1589634865000,
                "checked_at": 1589634865000,
                "content_type": "text/html;charset=utf-8",
                "countries_id": "US",
                "created_at": 1589634865000,
                "domain_type": "SOCIAL_NETWORK",
                "fav": "NOT_STARRED",
                "file": "2020/5/16/10712020.html",
                "followedUp": false,
                "history": [],
                "id": 10712020,
                "issued": false,
                "labels": [
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 205,
                        "name": "TopScribdDocsSearch",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "en",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "falabella.com",
                "search_words": [
                    "falabella.com"
                ],
                "title": "tipos de Ventas ejemplos.docx",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://www.scribd.com/document/461606657",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "INFORMATIVE",
                "analysis_result": "INFORMATIVE",
                "changed_at": 1589633157000,
                "checked_at": 1589633157000,
                "content_type": "text/html",
                "countries_id": "GB",
                "created_at": 1589633157000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711255,
                "issued": false,
                "labels": [
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1864,
                        "name": "VDocumentsSite",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "pt",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "linio",
                "search_words": [
                    "linio"
                ],
                "title": "T\u0623\u2030RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_T\u0622\u00a0 asociados (ejemplo: seguro,",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://vdocuments.site/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "INFORMATIVE",
                "analysis_result": "INFORMATIVE",
                "changed_at": 1589633149000,
                "checked_at": 1589633149000,
                "content_type": "text/html",
                "countries_id": "IN",
                "created_at": 1589633149000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711254,
                "issued": false,
                "labels": [
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1863,
                        "name": "VDocumentsMX",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "pt",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "linio",
                "search_words": [
                    "linio"
                ],
                "title": "T\u0623\u2030RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_T\u0622\u00a0 asociados (ejemplo: seguro,",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://vdocuments.mx/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "INFORMATIVE",
                "analysis_result": "INFORMATIVE",
                "changed_at": 1589633137000,
                "checked_at": 1589633137000,
                "content_type": "text/html",
                "countries_id": "DE",
                "created_at": 1589633137000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711253,
                "issued": false,
                "labels": [
                    {
                        "id": 1862,
                        "name": "FDocumentsWorld",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "pt",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "linio",
                "search_words": [
                    "linio"
                ],
                "title": "T\u0623\u2030RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_T\u0622\u00a0 asociados (ejemplo: seguro,",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://fdocuments.net/document/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "POSITIVE",
                "analysis_result": "POSITIVE",
                "changed_at": 1589633026000,
                "checked_at": 1589633026000,
                "content_type": "text/html",
                "countries_id": "DE",
                "created_at": 1589633026000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711233,
                "issued": false,
                "labels": [
                    {
                        "id": 1861,
                        "name": "FDocumentsSpain",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "es",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "sodimac",
                "search_words": [
                    "sodimac"
                ],
                "title": "Sodimac Chile 18.151 trabajadores 617.398 horas destinadas a capacitaci\u0623\u00b3n en 2017. ... productividad",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://fdocuments.es/document/sodimac-chile-18151-trabajadores-617398-horas-destinadas-a-capacitacin-en-2017.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "INFORMATIVE",
                "analysis_result": "INFORMATIVE",
                "changed_at": 1589633026000,
                "checked_at": 1589633026000,
                "content_type": "text/html",
                "countries_id": "DE",
                "created_at": 1589633026000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711234,
                "issued": false,
                "labels": [
                    {
                        "id": 1861,
                        "name": "FDocumentsSpain",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "es",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "sodimac",
                "search_words": [
                    "sodimac"
                ],
                "title": "Emisi\u0623\u00b3n de Bonos Ordinarios Fuente: Organizaci\u0623\u00b3n Corona y Sodimac Corporativo, 1Capital IQ Agosto",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://fdocuments.es/document/emisin-de-bonos-ordinarios-fuente-organizacin-corona-y-sodimac-corporativo.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "POSITIVE",
                "analysis_result": "POSITIVE",
                "changed_at": 1589633026000,
                "checked_at": 1589633026000,
                "content_type": "text/html",
                "countries_id": "DE",
                "created_at": 1589633026000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711235,
                "issued": false,
                "labels": [
                    {
                        "id": 1861,
                        "name": "FDocumentsSpain",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "es",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "sodimac",
                "search_words": [
                    "sodimac"
                ],
                "title": "SODIMAC COLOMBIA S.A. - ?\u00b7 empresas emisoras de valores, lo que nos conlleva a presentar a consideraci\u00f3n\u2026",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://fdocuments.es/document/sodimac-colombia-sa-empresas-emisoras-de-valores-lo-que-nos-conlleva-a.html",
                "user_rating": 0
            },
            {
                "analysis_calc_result": "INFORMATIVE",
                "analysis_result": "INFORMATIVE",
                "changed_at": 1589633026000,
                "checked_at": 1589633026000,
                "content_type": "text/html",
                "countries_id": "DE",
                "created_at": 1589633026000,
                "domain_type": "UNKNOWN",
                "fav": "NOT_STARRED",
                "followedUp": false,
                "history": [],
                "id": 10711236,
                "issued": false,
                "labels": [
                    {
                        "id": 1861,
                        "name": "FDocumentsSpain",
                        "type": "MODULE_LABEL"
                    },
                    {
                        "id": 1305,
                        "name": "Public",
                        "type": "MODULE_LABEL"
                    }
                ],
                "language_id": "es",
                "read": false,
                "retweet_info": [],
                "searchPhrase": "sodimac",
                "search_words": [
                    "sodimac"
                ],
                "title": "Programa SCM Update ?\u00b7 en Sodimac. Mauri Mu\u00f1oz log\u00edstica en Cl\u00ednica Alemana. L\u00eda Vera\u2026",
                "tlpStatus": "AMBER",
                "total_retweets": 0,
                "url": "https://fdocuments.es/document/programa-scm-update-en-sodimac-mauricio-munoz-jefe-de-logistica-en-clinica.html",
                "user_rating": 0
            }
        ]
    }
}

Human Readable Output

Blueliv DataLeakage info

analysis_calc_result analysis_result analysis_user_result changed_at checked_at content_type countries_id created_at domain_type fav file followedUp history id issued labels language_id read retweet_info searchPhrase search_words title tlpStatus total_retweets url user_rating
POSITIVE POSITIVE POSITIVE 1589634898000 1589634898000 text/html;charset=utf-8 US 1589634898000 SOCIAL_NETWORK USER_STARRED 2020/5/16/10712044.html false   10712044 false {‘id’: 1306, ‘name’: ‘Confidential’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 205, ‘name’: ‘TopScribdDocsSearch’, ‘type’: ‘MODULE_LABEL’}		 en false   falabella.com.pe falabella.com.pe TOTUS SEDE SJM FINAL.doc | Internet Protocols | Transmission Control Protocol AMBER 0 https://www.scribd.com/document/461608373 3
POSITIVE POSITIVE   1589634865000 1589634865000 text/html;charset=utf-8 US 1589634865000 SOCIAL_NETWORK NOT_STARRED 2020/5/16/10712019.html false   10712019 false {‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 205, ‘name’: ‘TopScribdDocsSearch’, ‘type’: ‘MODULE_LABEL’}		 en false   falabella.com falabella.com CASO FALABELLA | America latina | Marketing AMBER 0 https://www.scribd.com/document/461631347 0
POSITIVE POSITIVE   1589634865000 1589634865000 text/html;charset=utf-8 US 1589634865000 SOCIAL_NETWORK NOT_STARRED 2020/5/16/10712020.html false   10712020 false {‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 205, ‘name’: ‘TopScribdDocsSearch’, ‘type’: ‘MODULE_LABEL’}		 en false   falabella.com falabella.com tipos de Ventas ejemplos.docx AMBER 0 https://www.scribd.com/document/461606657 0
INFORMATIVE INFORMATIVE   1589633157000 1589633157000 text/html GB 1589633157000 UNKNOWN NOT_STARRED   false   10711255 false {‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1864, ‘name’: ‘VDocumentsSite’, ‘type’: ‘MODULE_LABEL’}		 pt false   linio linio Tأ‰RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_Tآ  asociados (ejemplo: seguro, AMBER 0 https://vdocuments.site/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html 0
INFORMATIVE INFORMATIVE   1589633149000 1589633149000 text/html IN 1589633149000 UNKNOWN NOT_STARRED   false   10711254 false {‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1863, ‘name’: ‘VDocumentsMX’, ‘type’: ‘MODULE_LABEL’}		 pt false   linio linio Tأ‰RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_Tآ  asociados (ejemplo: seguro, AMBER 0 https://vdocuments.mx/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html 0
INFORMATIVE INFORMATIVE   1589633137000 1589633137000 text/html DE 1589633137000 UNKNOWN NOT_STARRED   false   10711253 false {‘id’: 1862, ‘name’: ‘FDocumentsWorld’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’}		 pt false   linio linio Tأ‰RMINOS Y CONDICIONES - LINIO MARKETPLACE PREMIUM amp;Cs/20190501_Tآ  asociados (ejemplo: seguro, AMBER 0 https://fdocuments.net/document/trminos-y-condiciones-linio-marketplace-premium-ampcs20190501t-asociados.html 0
POSITIVE POSITIVE   1589633026000 1589633026000 text/html DE 1589633026000 UNKNOWN NOT_STARRED   false   10711233 false {‘id’: 1861, ‘name’: ‘FDocumentsSpain’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’}		 es false   sodimac sodimac Sodimac Chile 18.151 trabajadores 617.398 horas destinadas a capacitaciأ³n en 2017. … productividad AMBER 0 https://fdocuments.es/document/sodimac-chile-18151-trabajadores-617398-horas-destinadas-a-capacitacin-en-2017.html 0
INFORMATIVE INFORMATIVE   1589633026000 1589633026000 text/html DE 1589633026000 UNKNOWN NOT_STARRED   false   10711234 false {‘id’: 1861, ‘name’: ‘FDocumentsSpain’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’}		 es false   sodimac sodimac Emisiأ³n de Bonos Ordinarios Fuente: Organizaciأ³n Corona y Sodimac Corporativo, 1Capital IQ Agosto AMBER 0 https://fdocuments.es/document/emisin-de-bonos-ordinarios-fuente-organizacin-corona-y-sodimac-corporativo.html 0
POSITIVE POSITIVE   1589633026000 1589633026000 text/html DE 1589633026000 UNKNOWN NOT_STARRED   false   10711235 false {‘id’: 1861, ‘name’: ‘FDocumentsSpain’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’}		 es false   sodimac sodimac SODIMAC COLOMBIA S.A. - ?· empresas emisoras de valores, lo que nos conlleva a presentar a consideración… AMBER 0 https://fdocuments.es/document/sodimac-colombia-sa-empresas-emisoras-de-valores-lo-que-nos-conlleva-a.html 0
INFORMATIVE INFORMATIVE   1589633026000 1589633026000 text/html DE 1589633026000 UNKNOWN NOT_STARRED   false   10711236 false {‘id’: 1861, ‘name’: ‘FDocumentsSpain’, ‘type’: ‘MODULE_LABEL’},
{‘id’: 1305, ‘name’: ‘Public’, ‘type’: ‘MODULE_LABEL’}		 es false   sodimac sodimac Programa SCM Update ?· en Sodimac. Maur Muñoz logística en Clínica Alemana. Lía Vera… AMBER 0 https://fdocuments.es/document/programa-scm-update-en-sodimac-mauricio-munoz-jefe-de-logistica-en-clinica.html 0

blueliv-resource-search

Search for a specific resource.

Base Command

blueliv-resource-search

Input

Argument Name Description Required
search Keywords to search in resources text Optional
status Comma-separated list of any combination of status: NOT_AVAILABLE, NOT_IMPORTANT, NOT_PROCESSABLE, POSITIVE, NEGATIVE, INFORMATIVE, IMPORTANT Optional
startDate Minimum date to recover resources. Formats: yyyy-mm-dd or yyyy-mm-ddThh:mm:ss Optional
finalDate Maximum date to recover resources. Formats: yyyy-mm-dd or yyyy-mm-ddThh:mm:ss Optional
read What results read status to get. Optional
limit Maximum number of resources to recover Optional
page Results page to get. For each page, there are {limit} resources. Optional

Context Output

Path Type Description
BluelivThreatCompass Unknown List object of recovered resources

Command Example


#### Human Readable Output

### blueliv-resource-search-by-id

***
Recovers all the information of a given resource

#### Base Command

`blueliv-resource-search-by-id`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Resource ID | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| BluelivThreatCompass | Unknown | Object with the information of the recovered resource |

#### Command Example

```!blueliv-resource-search-by-id id=10712044```

#### Context Example

```
{
    "BluelivThreatCompass": {
        "DataLeakage": {
            "analysis_calc_result": "POSITIVE",
            "analysis_result": "POSITIVE",
            "analysis_user_result": "POSITIVE",
            "changed_at": 1589634898000,
            "checked_at": 1589634898000,
            "content_type": "text/html;charset=utf-8",
            "countries_id": "US",
            "created_at": 1589634898000,
            "domain_type": "SOCIAL_NETWORK",
            "fav": "USER_STARRED",
            "file": "2020/5/16/10712044.html",
            "followedUp": false,
            "history": [],
            "id": 10712044,
            "issued": false,
            "labels": [
                {
                    "id": 1306,
                    "name": "Confidential",
                    "type": "GLOBAL"
                },
                {
                    "id": 1305,
                    "name": "Public",
                    "type": "GLOBAL"
                },
                {
                    "id": 205,
                    "name": "TopScribdDocsSearch",
                    "type": "GLOBAL"
                }
            ],
            "language_id": "en",
            "read": false,
            "retweet_info": [],
            "searchPhrase": "falabella.com.pe",
            "search_words": [
                "falabella.com.pe"
            ],
            "title": "TOTUS SEDE SJM FINAL.doc | Internet Protocols | Transmission Control Protocol",
            "tlpStatus": "AMBER",
            "total_retweets": 0,
            "transform": "TopScribdDocsSearch",
            "url": "https://www.scribd.com/document/461608373",
            "user_rating": 3
        }
    }
}
```

#### Human Readable Output

>### Blueliv DataLeakageinfo
>
>|analysis_calc_result|analysis_result|analysis_user_result|changed_at|checked_at|content_type|countries_id|created_at|domain_type|fav|file|followedUp|history|id|issued|labels|language_id|read|retweet_info|searchPhrase|search_words|title|tlpStatus|total_retweets|transform|url|user_rating|
>|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
>| POSITIVE | POSITIVE | POSITIVE | 1589634898000 | 1589634898000 | text/html;charset=utf-8 | US | 1589634898000 | SOCIAL_NETWORK | USER_STARRED | 2020/5/16/10712044.html | false |  | 10712044 | false | {'id': 1306, 'name': 'Confidential', 'type': 'GLOBAL'},<br/>{'id': 1305, 'name': 'Public', 'type': 'GLOBAL'},<br/>{'id': 205, 'name': 'TopScribdDocsSearch', 'type': 'GLOBAL'} | en | false |  | falabella.com.pe | falabella.com.pe | TOTUS SEDE SJM FINAL.doc \| Internet Protocols \| Transmission Control Protocol | AMBER | 0 | TopScribdDocsSearch | https://www.scribd.com/document/461608373 | 3 |

### blueliv-resource-set-status

***
Changes a resource status.

#### Base Command

`blueliv-resource-set-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Resource ID | Required |
| status | New status to assign to the resource | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!blueliv-resource-set-status id=10712044 status=positive```

#### Context Example

```
{}
```

#### Human Readable Output

>Status changed to **positive**

### blueliv-resource-set-label

***
Adds a label to the given resource

#### Base Command

`blueliv-resource-set-label`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Resource ID | Required |
| labelId | Label ID | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

blueliv-resource-set-read-status

Mark the result as read or not.

Base Command

blueliv-resource-set-read-status

Input

Argument Name Description Required
id Resource ID Required
read The read status to set. Optional

Context Output

There is no context output for this command.

Command Example

!blueliv-resource-set-read-status id=10712044 read=false

Context Example

{}

Human Readable Output

Read status changed to false.

blueliv-resource-assign-rating

Assign tating to a given result.

Base Command

blueliv-resource-assign-rating

Input

Argument Name Description Required
id Resource ID Required
rating Rating to assign to the result. Optional

Context Output

There is no context output for this command.

Command Example

!blueliv-resource-assign-rating id=10712044 rating=3

Context Example

{}

Human Readable Output

Rating changed to 3.

blueliv-resource-fav

Changes the favourite status of a resource.

Base Command

blueliv-resource-fav

Input

Argument Name Description Required
id Resource ID Required
fav The new fav status of the resource. Can be applied to the user, group or general. Optional

Context Output

There is no context output for this command.

Command Example

!blueliv-resource-fav id=10712044 fav=User

Context Example

{}

Human Readable Output

Resource fav masked as User correctly.

blueliv-resource-set-tlp

Sets a new TLP status to a given resource.

Base Command

blueliv-resource-set-tlp

Input

Argument Name Description Required
id Resource ID Required
tlp The new TLP to assign. Optional

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

blueliv-resource-favourite

Changes the favorite status of a resource.

Base Command

blueliv-resource-favourite

Input

Argument Name Description Required
id Resource ID. Required
favourite The new favorite status of the resource. Can be “Not”, “User”, “Group”, or “All”. Possible values are: Not, User, Group, All. Default is group. Optional

Context Output

There is no context output for this command.

blueliv-module-get-labels

Gets the label list of the module.

Base Command

blueliv-module-get-labels

Input

There are no input arguments for this command.

Context Output

Path Type Description
BluelivThreatCompass.Label.BackgroundColor String Hexadecimal color of the label background in the GUI.
BluelivThreatCompass.Label.Id String Label ID.
BluelivThreatCompass.Label.Name String Label name.
BluelivThreatCompass.Label.Protected Boolean Whether the label is protected.
BluelivThreatCompass.Label.TypeId Number Label type ID.
BluelivThreatCompass.Label.TypeName String Label type name
BluelivThreatCompass.Label.Prioritized Boolean Whether the label is prioritized.
BluelivThreatCompass.Label.TextColor String Hexadecimal color of the label text in the GUI.

Configuration parameters

  • url — Server URL (e.g. https://demisto.blueliv.com/api/v2)
  • credentials — Username
  • organization — Organization ID (required)
  • type — Module Type (required)
  • module — Module ID (required)
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • fetch_limit — Fetch Limit (Max.- 200, Recommended less than 50)
  • fetch_status — Fetch resource status (POSITIVE, NEGATIVE...)
  • first_fetch_time — First fetch time

Commands (10)

  • blueliv-module-get-labels

    Gets the label list of the module.

  • blueliv-resource-all

    Recovers all resources from the module.

  • blueliv-resource-assign-rating

    Assigns a rating to the given result.

  • blueliv-resource-favourite

    Changes the favorite status of a resource.

  • blueliv-resource-search

    Search for a specific resource.

  • blueliv-resource-search-by-id

    Recovers all the information of a given resource.

  • blueliv-resource-set-label

    Adds a label to the given resource.

  • blueliv-resource-set-read-status

    Marks the result as read or not read.

  • blueliv-resource-set-status

    Changes the status of a resource.

  • blueliv-resource-set-tlp

    Sets a new TLP (Traffic Light Protocol) status to a given resource.

Source

BluelivThreatCompass.py BluelivThreatCompass_test.py BluelivThreatCompass.yml BluelivThreatCompass_description.md
Download History Raw 
import re

import demistomock as demisto
from BluelivThreatCompass import (
    Client,
    module_get_labels,
    resource_add_label,
    resource_fav,
    resource_set_tlp,
    search_resource,
    search_resource_by_id,
    set_resource_rating,
    set_resource_read_status,
    set_resource_status,
)


def test_blueliv_search_resource(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("Credentials", "credentials")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {
        "list": [
            {
                "changed_at": 1589581524000,
                "checked_at": 1589581524000,
                "created_at": 1589581524000,
                "customer": 0,
                "email": 0,
                "employee": 0,
                "external": 0,
                "fav": "NOT_STARRED",
                "followedUp": False,
                "history": [],
                "id": 10696519,
                "issued": False,
                "labels": [
                    {
                        "background_color": 37810,
                        "id": 1303,
                        "name": "Botnet Credentials",
                        "text_color": 16777215,
                        "type": "MODULE_LABEL",
                    },
                    {"background_color": 16777215, "id": 2259, "name": "Clear Password", "text_color": 0, "type": "MODULE_LABEL"},
                ],
                "module_id": 1,
                "module_name": "Credentials",
                "module_short_name": "CRED-C0",
                "module_type": "CREDENTIALS",
                "num_cred": 3,
                "read": True,
                "resource_type": "GENERIC",
                "searchPhrase": "example.com",
                "title": "example.com",
                "tlpStatus": "RED",
                "user_rating": 0,
            }
        ],
        "total_resources": 10,
    }
    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("GET", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"limit": 1}
    search_resource(client, args)

    results = demisto.results.call_args[0][0]
    entry_context = results.get("EntryContext", {})
    ind = entry_context.get("BluelivThreatCompass." + module_type[0] + "(val.id && val.id == obj.id)", {})

    assert demisto.get(ind[0], "title") == "example.com"
    assert demisto.get(ind[0], "num_cred") == 3


def test_blueliv_search_resource_by_id(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("Credentials", "credentials")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {
        "changed_at": 1589581524000,
        "checked_at": 1589581524000,
        "created_at": 1589581524000,
        "credentials": [
            {
                "classification": "UNCLASSIFIED",
                "id": "5ebf04c5dfe30b2200c09c5e",
                "isEmail": False,
                "password": "somepassword",
                "portalUrl": "https://example.com/login/sso",
                "reportedAt": 1589576900000,
                "stolenData": [{"stolenAt": 1589548528000}],
                "type": "OSKI",
                "userPassword": "somepassword",
                "username": "someuser",
            },
            {
                "classification": "UNCLASSIFIED",
                "id": "5ebf049edfe30b2200c0985b",
                "isEmail": False,
                "password": "somepassword",
                "portalUrl": "https://example.com/register",
                "reportedAt": 1589576862000,
                "stolenData": [{"stolenAt": 1589548528000}],
                "type": "OSKI",
                "userPassword": "somepassword",
                "username": "someuser",
            },
        ],
        "customer": 0,
        "email": 0,
        "employee": 0,
        "external": 0,
        "fav": "NOT_STARRED",
        "followedUp": False,
        "history": [],
        "id": 10696519,
        "issued": True,
        "labels": [
            {"background_color": 37810, "id": 1303, "name": "Botnet Credentials", "text_color": 16777215, "type": "GLOBAL"},
            {"background_color": 16777215, "id": 2259, "name": "Clear Password", "text_color": 0, "type": "MODULE_LABEL"},
        ],
        "module_id": 1,
        "module_type": "null",
        "num_cred": 2,
        "read": True,
        "resource_type": "GENERIC",
        "searchPhrase": "example.com",
        "title": "example.com",
        "tlpStatus": "RED",
        "user_rating": 0,
    }
    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("GET", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10696519}
    search_resource_by_id(client, args)

    results = demisto.results.call_args[0][0]
    entry_context = results.get("EntryContext", {})
    ind = entry_context.get("BluelivThreatCompass." + module_type[0] + "(val.id && val.id == obj.id)", {})

    assert ind.get("credentials", [{}])[0].get("type", "") == "OSKI"
    assert demisto.get(ind, "tlpStatus") == "RED"


def test_blueliv_set_resource_status(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {"code": 0, "error": False, "field": "", "httpCode": 200, "message": "ok.user_result", "token": None}
    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "status": "positive"}
    set_resource_status(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "Status changed to positive."


def test_blueliv_resource_set_read_status(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {
        "field": "[10712044]",
        "message": "ok.successful_markas",
        "error": False,
        "token": None,
        "code": 0,
        "httpCode": 200,
    }

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "read": "false"}
    set_resource_read_status(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "Read status changed to false."


def test_blueliv_resource_assign_rating(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {"field": "", "message": "ok.successful_rate", "error": False, "token": None, "code": 0, "httpCode": 200}

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "rating": 3}
    set_resource_rating(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "Rating changed to 3."


def test_blueliv_resource_fav(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {"field": "", "message": "ok.successful_fav", "error": False, "token": None, "code": 0, "httpCode": 200}

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "favourite": "User"}
    resource_fav(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "Resource favourite masked as User correctly."


def test_blueliv_resource_set_tlp(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {"field": "", "message": "ok.tlp_updated", "error": False, "token": None, "code": 0, "httpCode": 200}

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "tlp": "Amber"}
    resource_set_tlp(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "TLP changed to Amber."


def test_blueliv_resource_set_label(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = {"field": "", "message": "ok.successful_save", "error": False, "token": None, "code": 0, "httpCode": 200}

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("PUT", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    args = {"id": 10712044, "labelId": "1306"}
    resource_add_label(client, args)

    results = demisto.results.call_args[0][0]

    assert results.get("Contents", "") == "Label 1306 correctly added."


def test_blueliv_module_get_labels(mocker, requests_mock):
    server_url = "https://demisto.blueliv.com/api/v2"
    organization = 1
    module = 1
    module_type = ("DataLeakage", "data_leakage")

    url = f"{server_url}/organization/{organization}/module/{module}/{module_type[1]}"
    matcher = re.compile(f"{url}.*")

    blueliv_response = [
        {
            "bgColorHex": "#0093B2",
            "id": 1303,
            "label": "Botnet Credentials",
            "labelProtected": True,
            "labelTypeId": 9,
            "labelTypeName": "Credentials Type",
            "moduleId": None,
            "moduleName": None,
            "moduleTypeId": None,
            "organizationId": None,
            "organizationName": None,
            "prioritized": True,
            "textColorHex": "#FFFFFF",
        },
        {
            "bgColorHex": "#00B388",
            "id": 1310,
            "label": "Brand Abuse Profile",
            "labelProtected": True,
            "labelTypeId": 12,
            "labelTypeName": "ThreatOrigin",
            "moduleId": None,
            "moduleName": None,
            "moduleTypeId": None,
            "organizationId": None,
            "organizationName": None,
            "prioritized": True,
            "textColorHex": "#FFFFFF",
        },
    ]

    mocker.patch.object(demisto, "results")
    requests_mock.register_uri("GET", matcher, json=blueliv_response)

    client = Client(
        server_url,
        False,
        False,
        headers={"Accept": "application/json"},
        organization=organization,
        module=module,
        module_type=module_type[0],
    )

    module_get_labels(client)

    results = demisto.results.call_args[0][0]

    assert len(results.get("Contents", [])) == 2
    assert results.get("Contents", [])[0].get("id", 0) == 1303
    assert results.get("Contents", [])[1].get("bgColorHex", "") == "#00B388"