BotDefender

Gathers PerimeterX related data.

Data Enrichment & Threat Intelligence · PerimeterX

Details

IDBotDefender
ProviderHUMAN
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Gathers PerimeterX related data

Configure BotDefender in Cortex

Parameter Description Required
url Server URL (e.g. https://example.net) True
apikey API Key True
incidentType Incident type False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Gets the PerimeterX DBotScore decision for a particular IP

Base Command

ip

Input

Argument Name Description Required
ip The custom parameter value or IP address for which the report is requested Optional

Context Output

Path Type Description
IP.Address String Bad IP address
IP.Malicious.Vendor String For malicious IPs, the vendor that made the decision
IP.Malicious.Description String For malicious IPs, the reason that the vendor made the decision
DBotScore.Indicator String The indicator that was tested
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score

Command Example

!ip ip="5.79.76.181"

Context Example

{
    "DBotScore": {
        "Indicator": "5.79.76.181",
        "Score": 3,
        "Type": "ip",
        "Vendor": "PerimeterX"
    },
    "IP": {
        "Address": "5.79.76.181",
        "Malicious": {
            "Description": "Something random from PerimeterX for now enjoy!",
            "Vendor": "PerimeterX"
        }
    },
    "PerimeterX": {
        "catpchaSolves": 200,
        "ipClassifications": [
            {
                "class": "Bad Reputation",
                "name": "Bad Reputation"
            },
            {
                "class": "SharedIPs",
                "name": "Shared IPs"
            },
            {
                "class": "DataCenter",
                "name": "TAG DCIP"
            }
        ],
        "max_risk_score": 100,
        "pageTypeDistributions": [
            {
                "count": 1228,
                "pageType": "Login"
            },
            {
                "count": 739,
                "pageType": "Scraping"
            },
            {
                "count": 139,
                "pageType": "Checkout"
            }
        ],
        "topBlockedURLPaths": [
            {
                "blockedURLPath": "/",
                "count": 1404
            },
            {
                "blockedURLPath": "/cgi-bin/way-board.cgi",
                "count": 702
            },
            {
                "blockedURLPath": "/loginok/light.cgi",
                "count": 702
            }
        ],
        "topIncidentTypes": [
            {
                "count": 2106,
                "incidentType": "Spoof"
            },
            {
                "count": 702,
                "incidentType": "Bot Behavior"
            }
        ],
        "topURLPaths": [
            {
                "count": 3315,
                "urlPath": "/favicon.ico"
            },
            {
                "count": 3253,
                "urlPath": "/favicon.png"
            },
            {
                "count": 3212,
                "urlPath": "/"
            },
            {
                "count": 1228,
                "urlPath": "/loginok/light.cgi"
            },
            {
                "count": 1222,
                "urlPath": "/cgi-bin/way-board.cgi"
            },
            {
                "count": 205,
                "urlPath": "/phpmyadmin/"
            },
            {
                "count": 139,
                "urlPath": "-"
            },
            {
                "count": 82,
                "urlPath": "/images/icons/favicon.ico"
            },
            {
                "count": 48,
                "urlPath": "/test.php"
            }
        ],
        "topUserAgents": [
            {
                "count": 84,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36"
            },
            {
                "count": 80,
                "userAgentName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36"
            },
            {
                "count": 78,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36 OPR/53.0.2907.99"
            },
            {
                "count": 76,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.51"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36 Kinza/4.7.2"
            },
            {
                "count": 72,
                "userAgentName": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36"
            }
        ],
        "trafficOverTime": []
    }
}

Human Readable Output

[<IP object at 0x7f31335e0e80>]

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • dbotBadThreshold — DBot Scoring - Bad Score Threshold (required)
  • dbotSuspiciousThreshold — DBot Scoring - Suspicious Score Threshold (required)
  • dbotGoodThreshold — DBot Scoring - Good Score Threshold (required)
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (1)

  • ip

    Gets the PerimeterX DBotScore decision for a particular IP.

Source

BotDefender.py BotDefender_test.py BotDefender.yml BotDefender_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: HUMAN
fromversion: 5.0.0
commonfields:
  id: BotDefender
  version: -1
configuration:
- defaultvalue: ""
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
- display: API Key
  name: apikey
  required: true
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: DBot Scoring - Bad Score Threshold
  name: dbotBadThreshold
  required: true
  defaultvalue: 90
  type: 0
- display: DBot Scoring - Suspicious Score Threshold
  name: dbotSuspiciousThreshold
  required: true
  defaultvalue: 50
  type: 0
- display: DBot Scoring - Good Score Threshold
  name: dbotGoodThreshold
  required: true
  defaultvalue: 5
  type: 0
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: Gathers PerimeterX related data.
detaileddescription: This integration will query the PerimeterX API for useful information regarding the supplied item (IP, User Agent, path, etc...)
display: PerimeterX BotDefender
name: BotDefender
script:
  commands:
  - arguments:
    - description: The custom parameter value or IP address for which the report is requested.
      isArray: true
      name: ip
      required: true
      default: true
    description: Gets the PerimeterX DBotScore decision for a particular IP.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: Bad IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)