CIRCLEHashlookup

CIRCL hash lookup is a public API to lookup hash values against known database of files. NSRL RDS database is included and many others are also included. The API is accessible via HTTP ReST API and the API is also described as an OpenAPI. The service is free and served as a best-effort basis.

Data Enrichment & Threat Intelligence · CIRCL hashlookup (hashlookup.circl.lu)

Details

IDCIRCLEHashlookup
ProviderLHC
CategoryData Enrichment & Threat Intelligence
From Version6.2.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

CIRCL hash lookup is a public API to lookup hash values against known database of files. NSRL RDS database is included and many others are also included. The API is accessible via HTTP ReST API and the API is also described as an OpenAPI. The service is free and served as a best-effort basis.
This integration was integrated and tested with online version of CIRCLEHashlookup

Configure CIRCLEHashlookup in Cortex

Parameter Description Required
Server URL (e.g. https://hashlookup.circl.lu)   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Source Reliability Reliability of the source providing the intelligence data. True
Create relationships Create relationships between indicators as part of Enrichment. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

circl-info

Get information about the hash lookup database

Base Command

circl-info

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Circl.Info string Info about the hashlookup database

Command Example


#### Human Readable Output

### circl-bulk-md5

***
Bulk search of MD5 hashes

#### Base Command

`circl-bulk-md5`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| md5_list | List of MD5s to query. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Circl.MD5 | string | Results of bulk MD5 query |

#### Command Example

Human Readable Output

circl-bulk-sha1

Bulk search of SHA1 hashes

Base Command

circl-bulk-sha1

Input

Argument Name Description Required
sha1_list List of SHA1 to search. Required

Context Output

Path Type Description
Circl.SHA1 string Results of bulk SHA1 query

Command Example


#### Human Readable Output

### file

***
Checks the file reputation of the specified hash.

#### Base Command

`file`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| file | Hash to query. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| File.Name | string | Name of the file |
| File.Size | number | Size of the file |
| File.MD5 | string | MD5 hash of the file |
| File.SHA1 | string | SHA1 hash of the file |
| File.SHA256 | string | SHA256 hash of the file |
| File.SHA512 | string | SHA512 hash of the file |
| File.SSDeep | string | SSDeep of the file |
| DbotScore.Indicator | string | The indicator value. |
| DbotScore.Reliability | string | The reliability of the source providing the intelligence data |
| DbotScore.Score | number | An integer regarding the status of the indicator |
| DbotScore.Type | string | The indicator type |
| DbotScore.Vendor | string | The vendor used to calculate the score |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | Type of indicator. |
| DBotScore.Vendor | String | Vendor used to calculate the score. |

#### Command Example

Human Readable Output

circl-top

Return the top 100 of most queried values.

Base Command

circl-top

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Circl.Top string The top 100 of most queried values

Command Example

``````

Human Readable Output

Configuration parameters

  • url — Server URL (e.g. https://hashlookup.circl.lu) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability (required)
  • create_relationships — Create relationships

Commands (5)

  • circl-bulk-md5

    Bulk search of MD5 hashes.

  • circl-bulk-sha1

    Bulk search of SHA1 hashes.

  • circl-info

    Get information about the hash lookup database.

  • circl-top

    Return the top 100 of most queried values.

  • file

    Checks the file reputation of the specified hash.

Source

CIRCLEHashlookup.py CIRCLEHashlookup.yml CIRCLEHashlookup_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: LHC
commonfields:
  id: CIRCLEHashlookup
  version: -1
configuration:
- defaultvalue: https://hashlookup.circl.lu
  display: Server URL (e.g. https://hashlookup.circl.lu)
  name: url
  required: true
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- additionalinfo: Create relationships between indicators as part of Enrichment.
  defaultvalue: 'true'
  display: Create relationships
  name: create_relationships
  type: 8
  required: false
description: CIRCL hash lookup is a public API to lookup hash values against known database of files. NSRL RDS database is included and many others are also included. The API is accessible via HTTP ReST API and the API is also described as an OpenAPI. The service is free and served as a best-effort basis.
display: CIRCLEHashlookup
name: CIRCLEHashlookup
script:
  commands:
  - arguments: []
    description: Get information about the hash lookup database.
    name: circl-info
    outputs:
    - contextPath: Circl.Info
      description: Info about the hashlookup database.
      type: string
  - arguments:
    - description: List of MD5s to query.
      isArray: true
      name: md5_list
      required: true
      type: textArea
    description: Bulk search of MD5 hashes.
    name: circl-bulk-md5
    outputs:
    - contextPath: Circl.MD5
      description: Results of bulk MD5 query.
      type: string
  - arguments:
    - description: List of SHA1 to search.
      isArray: true
      name: sha1_list
      required: true
      type: textArea
    description: Bulk search of SHA1 hashes.
    name: circl-bulk-sha1
    outputs:
    - contextPath: Circl.SHA1
      description: Results of bulk SHA1 query.
      type: string
  - arguments:
    - description: Hash to query.
      isArray: true
      name: file
      required: true
      type: textArea
      default: true
    description: Checks the file reputation of the specified hash.
    name: file
    outputs:
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: number
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA512 hash of the file.
      type: string
    - contextPath: File.SSDeep
      description: SSDeep of the file.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DbotScore.Indicator
      description: The indicator value.
      type: string
    - contextPath: DbotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: string
    - contextPath: DbotScore.Score
      description: An integer regarding the status of the indicator.
      type: number
    - contextPath: DbotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DbotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
  - arguments: []
    description: Return the top 100 of most queried values.
    name: circl-top
    outputs:
    - contextPath: Circl.Top
      description: The top 100 of most queried values.
      type: string
  dockerimage: demisto/python3:3.12.8.3296088
  script: ''
  subtype: python3
  type: python
fromversion: 6.2.0
tests:
- No tests (auto formatted)