CTIX

Details

ID	`CTIX`
Provider	Cyware Labs
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.8160132`
Supported Modules	Agentix XSIAM

README

Deprecated. Use Cyware Intel Exchange instead.

This is Cyware Threat Intelligence eXhange(CTIX) integration which enriches IP/Domain/URL/File Data.
This integration was integrated and tested with version 2.4 and 2.7 of CTIX.
This integration is NOT COMPATIBLE with CTIX version 3.0 and above. Use the CTIX V3 Integration for CTIX version 3 and above.
Supported Cortex XSOAR versions: 5.0.0 and later.

Configure CTIX in Cortex

Parameter	Description	Required
base_url	Endpoint URL	True
access_id	Access Key	True
secret_key	Secret Key	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP Details.

Base Command

ip

Input

Argument Name	Description	Required
ip	List of IPs.	Required
enhanced	Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
IP.Address	String	IP address.
IP.ASN	String	The autonomous system name for the IP address.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
CTIX.IP.tenant_id	string	Tenant ID
CTIX.IP.stix_object_id	string	ID of the Threat Data Object in CTIX application
CTIX.IP.tlp_data	string	TLP Value of the Threat Data Object
CTIX.IP.first_seen	string	Timestamp of when the IP was first seen on the CTIX application
CTIX.IP.last_seen	string	Timestamp of when the IP was latest seen on the CTIX application
CTIX.IP.deprecated	boolean	Shows if the Threat Data Object is deprecated on the CTIX application
CTIX.IP.intel_grading	string	Intel grading
CTIX.IP.criticality	number	Criticality of the Threat Data Object on the scale of 0-5
CTIX.IP.indicator_type	string	Threat Data Object type
CTIX.IP.package_id	unknown	List of IDs of packages on the CTIX application through which these IPs were received
CTIX.IP.source	unknown	List of sources from which the IP address was received in the CTIX application
CTIX.IP.risk_severity	number	Risk Severity of the Threat Data Object on the scale of 0-5
CTIX.IP.labels	unknown	List of Tags applied on the Threat Data Object
CTIX.IP.source_grading	string	Source Grading
CTIX.IP.name2	string	Value of the Threat Data Object
CTIX.IP.published_collections	unknown	Published collections
CTIX.IP.published_package_id	unknown	Package ID
CTIX.IP.blocked	boolean	Shows if the Threat Data Object is blocked on the CTIX application
CTIX.IP.blocked_time	string	Timestamp of when the Threat Data Object was blocked on the CTIX application.
CTIX.IP.deprecated_time	string	Timestamp of when the Threat Data Object was deprecated on the CTIX application
CTIX.IP.notification_preference	unknown	Notification preference
CTIX.IP.followed_on	unknown	Followed On
CTIX.IP.score	number	CTIX Confidence Score of the IP Object out of 100
CTIX.IP.type	string	Type of object
CTIX.IP.subscriber_id	unknown	List of Subscriber IDs
CTIX.IP.subscriber	unknown	List of Subscribers
CTIX.IP.subscriber_collection_id	unknown	List of Subscriber Collection IDs
CTIX.IP.subscriber_collection	unknown	List of Subscriber Collection
CTIX.IP.object_type	string	Type of object
CTIX.IP.blocked_on	unknown	Name of the Application where the Threat Data Object was blocked on.
CTIX.IP.follow_by	unknown	List of Cyware Users who follow the object.
CTIX.IP.is_false_positive	boolean	Shows if the Threat Data Object was marked false positive in the CTIX application
CTIX.IP.domain_tld	string	Top-Level Domain information about the Threat Data Object.
CTIX.IP.asn	string	ASN number of the Threat Data Object
CTIX.IP.registered_domain	string	Registered Domain
CTIX.IP.geo_details	unknown	Geographic details of the Threat Data Object
CTIX.IP.country	string	Geographic details of the Object
CTIX.IP.registrar	string	Registrar
CTIX.IP.file_extension	string	File Extension
CTIX.IP.whitelisted	unknown	List
CTIX.IP.object_description	string	Description of the Threat Data Object.
CTIX.IP.custom_score	number	Custom Score of the Threat Data Object
CTIX.IP.is_following	boolean	Boolean Value
CTIX.IP.under_review	boolean	Shows if Threat Data Object is marked as Under Review on the CTIX application
CTIX.IP.under_reviewed_time	string	Timestamp when the object was marked under review.
CTIX.IP.reviewed	boolean	Shows if the Threat Data Object is Marked as Reviewed on the CTIX application
CTIX.IP.reviewed_time	string	Timestamp when then object was reviewed.
CTIX.IP.object_description_defang	string	Description of the object.
CTIX.IP.source_data	unknown	List of sources from which CTIX received this IP.
CTIX.IP.related_fields	unknown	Relationship Data about the Threat Data Object present on the CTIX application
CTIX.IP.enhancement_data	unknown	Additional enhanced data about the Threat Data Object fetched by the CTIX application

Command Example

!ip ip="8.8.8.8" enhanced=True

Context Example

{
    "CTIX": {
        "IP": {
            "asn": "AS3356",
            "blocked": false,
            "blocked_on": [],
            "blocked_time": 0,
            "country": "United States",
            "criticality": 0,
            "custom_score": 0,
            "deprecated": false,
            "deprecated_time": null,
            "domain_tld": null,
            "enhancement_data": {},
            "file_extension": null,
            "first_seen": 1608281585,
            "follow_by": [],
            "followed_on": null,
            "geo_details": {
                "city": {
                    "city": null,
                    "continent_code": "NA",
                    "continent_name": "North America",
                    "country_code": "US",
                    "country_name": "United States",
                    "dma_code": null,
                    "latitude": 37.751,
                    "longitude": -97.822,
                    "postal_code": null,
                    "region": null,
                    "time_zone": "America/Chicago"
                },
                "country": {
                    "country_code": "US",
                    "country_name": "United States"
                }
            },
            "indicator_type": "ipv4-addr",
            "intel_grading": null,
            "is_false_positive": false,
            "is_following": false,
            "labels": [],
            "last_seen": 1608281585,
            "name2": "8.8.8.8",
            "notification_preference": null,
            "object_description": "",
            "object_description_defang": "",
            "object_type": "indicator",
            "package_id": [
                "package-4a183313-81cb-42bf-b3ed-f163662c2fcd"
            ],
            "published_collections": [],
            "published_package_id": [],
            "registered_domain": null,
            "registrar": null,
            "related_fields": {
                "attack_pattern": [],
                "campaign": [],
                "course_of_action": [],
                "indicator": [],
                "intrusion_set": [],
                "kill_chain_phases": [],
                "malware": [],
                "threat_actor": [],
                "tool": [],
                "ttp": []
            },
            "reviewed": false,
            "reviewed_time": 0,
            "risk_severity": 0,
            "score": 62.5,
            "source": [
                "Import"
            ],
            "source_data": [
                {
                    "id": "d1d3b628-346f-43c3-a369-235661ac6277",
                    "name": "Import"
                }
            ],
            "source_grading": null,
            "stix_object_id": "indicator--b09b6649-56ba-4acd-88fd-f84aadf85b55",
            "subscriber": [],
            "subscriber_collection": [],
            "subscriber_collection_id": [],
            "subscriber_id": [],
            "tenant_id": "0a834138-cc59-4107-aa69-46e6080f06af",
            "tlp_data": "GREEN",
            "type": "Indicator",
            "under_review": false,
            "under_reviewed_time": 0,
            "value": "8.8.8.8",
            "whitelisted": []
        }
    },
    "DBotScore": [
        {
            "Indicator": "8.8.8.8",
            "Score": 2,
            "Type": "ip",
            "Vendor": "HelloWorld"
        },
        {
            "Indicator": "8.8.8.8",
            "Score": 2,
            "Type": "ip",
            "Vendor": "CTIX"
        }
    ],
    "IP": {
        "ASN": "AS3356",
        "Address": "8.8.8.8"
    }
}

Human Readable Output

IP List

asn blocked blocked_time country criticality custom_score deprecated first_seen geo_details indicator_type is_false_positive is_following last_seen name2 object_type package_id related_fields reviewed reviewed_time risk_severity score source source_data stix_object_id tenant_id tlp_data type under_review under_reviewed_time value

AS3356 false 0 United States 0 0.0 false 1608281585 country: {“country_code”: “US”, “country_name”: “United States”}
city: {“city”: null, “continent_code”: “NA”, “continent_name”: “North America”, “country_code”: “US”, “country_name”: “United States”, “dma_code”: null, “latitude”: 37.751, “longitude”: -97.822, “postal_code”: null, “region”: null, “time_zone”: “America/Chicago”} ipv4-addr false false 1608281585 8.8.8.8 indicator package-4a183313-81cb-42bf-b3ed-f163662c2fcd attack_pattern:
campaign:
intrusion_set:
malware:
threat_actor:
tool:
indicator:
ttp:
kill_chain_phases:
course_of_action: false 0 0 62.5 Import {‘name’: ‘Import’, ‘id’: ‘d1d3b628-346f-43c3-a369-235661ac6277’} indicator–b09b6649-56ba-4acd-88fd-f84aadf85b55 0a834138-cc59-4107-aa69-46e6080f06af GREEN Indicator false 0 8.8.8.8

domain

Return Domain Details.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name	Description	Required
domain	List of Domains.	Required
enhanced	Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
Domain.Name	String	The domain name.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
CTIX.Domain.tenant_id	string	Tenant ID
CTIX.Domain.stix_object_id	string	ID of the Threat Data Object in CTIX application
CTIX.Domain.tlp_data	string	TLP Value of the Threat Data Object
CTIX.Domain.first_seen	string	Timestamp of when the IP was first seen on the CTIX application
CTIX.Domain.last_seen	string	Timestamp of when the IP was latest seen on the CTIX application
CTIX.Domain.deprecated	boolean	Shows if the Threat Data Object is deprecated on the CTIX application
CTIX.Domain.intel_grading	string	Intel grading
CTIX.Domain.criticality	number	Criticality of the Threat Data Object on the scale of 0-5
CTIX.Domain.indicator_type	string	Threat Data Object type
CTIX.Domain.package_id	unknown	List of IDs of packages on the CTIX application through which these IPs were received
CTIX.Domain.source	unknown	List of sources from which the IP address was received in the CTIX application
CTIX.Domain.risk_severity	number	Risk Severity of the Threat Data Object on the scale of 0-5
CTIX.Domain.labels	unknown	List of Tags applied on the Threat Data Object
CTIX.Domain.source_grading	string	Source Grading
CTIX.Domain.name2	string	Value of the Threat Data Object
CTIX.Domain.published_collections	unknown	Published collections
CTIX.Domain.published_package_id	unknown	Package ID
CTIX.Domain.blocked	boolean	Shows if the Threat Data Object is blocked on the CTIX application
CTIX.Domain.blocked_time	string	Timestamp of when the Threat Data Object was blocked on the CTIX application.
CTIX.Domain.deprecated_time	string	Timestamp of when the Threat Data Object was deprecated on the CTIX application
CTIX.Domain.notification_preference	unknown	Notification preference
CTIX.Domain.followed_on	unknown	Followed On
CTIX.Domain.score	number	CTIX Confidence Score of the IP Object out of 100
CTIX.Domain.type	string	Type of object
CTIX.Domain.subscriber_id	unknown	List of Subscriber IDs
CTIX.Domain.subscriber	unknown	List of Subscribers
CTIX.Domain.subscriber_collection_id	unknown	List of Subscriber Collection IDs
CTIX.Domain.subscriber_collection	unknown	List of Subscriber Collection
CTIX.Domain.object_type	string	Type of object
CTIX.Domain.blocked_on	unknown	Name of the Application where the Threat Data Object was blocked on.
CTIX.Domain.follow_by	unknown	List of Cyware Users who follow the object.
CTIX.Domain.is_false_positive	boolean	Shows if the Threat Data Object was marked false positive in the CTIX application
CTIX.Domain.domain_tld	string	Top-Level Domain information about the Threat Data Object.
CTIX.Domain.asn	string	ASN number of the Threat Data Object
CTIX.Domain.registered_domain	string	Registered Domain
CTIX.Domain.geo_details	unknown	Geographic details of the Threat Data Object
CTIX.Domain.country	string	Geographic details of the Object
CTIX.Domain.registrar	string	Registrar
CTIX.Domain.file_extension	string	File Extension
CTIX.Domain.whitelisted	unknown	List
CTIX.Domain.object_description	string	Description of the Threat Data Object.
CTIX.Domain.custom_score	number	Custom Score of the Threat Data Object
CTIX.Domain.is_following	boolean	Boolean Value
CTIX.Domain.under_review	boolean	Shows if Threat Data Object is marked as Under Review on the CTIX application
CTIX.Domain.under_reviewed_time	string	Timestamp when the object was marked under review.
CTIX.Domain.reviewed	boolean	Shows if the Threat Data Object is Marked as Reviewed on the CTIX application
CTIX.Domain.reviewed_time	string	Timestamp when then object was reviewed.
CTIX.Domain.object_description_defang	string	Description of the object.
CTIX.Domain.source_data	unknown	List of sources from which CTIX received this IP.
CTIX.Domain.related_fields	unknown	Relationship Data about the Threat Data Object present on the CTIX application
CTIX.Domain.enhancement_data	unknown	Additional enhanced data about the Threat Data Object fetched by the CTIX application

Command Example

!domain domain="google.com" enhanced=True

Context Example

{
    "CTIX": {
        "Domain": {
            "asn": null,
            "blocked": false,
            "blocked_on": [],
            "blocked_time": 0,
            "country": null,
            "criticality": 0,
            "custom_score": 0,
            "deprecated": false,
            "deprecated_time": null,
            "domain_tld": ".com",
            "enhancement_data": {},
            "file_extension": null,
            "first_seen": 1606486346,
            "follow_by": [],
            "followed_on": null,
            "geo_details": {},
            "indicator_type": "domain",
            "intel_grading": null,
            "is_false_positive": false,
            "is_following": false,
            "labels": [],
            "last_seen": 1607004096,
            "name2": "google.com",
            "notification_preference": null,
            "object_description": "",
            "object_description_defang": "",
            "object_type": "indicator",
            "package_id": [
                "package-caffb979-5a33-4787-8813-07319fa365df"
            ],
            "published_collections": [],
            "published_package_id": [],
            "registered_domain": "google.com",
            "registrar": null,
            "related_fields": {
                "attack_pattern": [],
                "campaign": [],
                "course_of_action": [],
                "indicator": [],
                "intrusion_set": [],
                "kill_chain_phases": [],
                "malware": [],
                "threat_actor": [],
                "tool": [],
                "ttp": []
            },
            "reviewed": false,
            "reviewed_time": 0,
            "risk_severity": 0,
            "score": 62.5,
            "source": [
                "pop3",
                "PoP3"
            ],
            "source_data": [
                {
                    "id": "2e29c86a-fb67-4ead-88ff-396ed3cef3e4",
                    "name": "PoP3"
                },
                {
                    "id": "da862993-bf78-4bdd-a715-83dbfb685a6c",
                    "name": "pop3"
                }
            ],
            "source_grading": null,
            "stix_object_id": "indicator--9949458d-0dd0-4f52-8d29-01f741359f58",
            "subscriber": [],
            "subscriber_collection": [],
            "subscriber_collection_id": [],
            "subscriber_id": [],
            "tenant_id": "0a834138-cc59-4107-aa69-46e6080f06af",
            "tlp_data": "GREEN",
            "type": "Indicator",
            "under_review": false,
            "under_reviewed_time": 0,
            "value": "google.com",
            "whitelisted": []
        }
    },
    "DBotScore": {
        "Indicator": "google.com",
        "Score": 2,
        "Type": "domain",
        "Vendor": "CTIX"
    },
    "Domain": {
        "Name": "google.com"
    }
}

Human Readable Output

Domain List

blocked blocked_time criticality custom_score deprecated domain_tld first_seen indicator_type is_false_positive is_following last_seen name2 object_type package_id registered_domain related_fields reviewed reviewed_time risk_severity score source source_data stix_object_id tenant_id tlp_data type under_review under_reviewed_time value

false 0 0 0.0 false .com 1606486346 domain false false 1607004096 google.com indicator package-caffb979-5a33-4787-8813-07319fa365df google.com attack_pattern:
campaign:
intrusion_set:
malware:
threat_actor:
tool:
indicator:
ttp:
kill_chain_phases:
course_of_action: false 0 0 62.5 pop3,
PoP3 {‘name’: ‘PoP3’, ‘id’: ‘2e29c86a-fb67-4ead-88ff-396ed3cef3e4’},
{‘name’: ‘pop3’, ‘id’: ‘da862993-bf78-4bdd-a715-83dbfb685a6c’} indicator–9949458d-0dd0-4f52-8d29-01f741359f58 0a834138-cc59-4107-aa69-46e6080f06af GREEN Indicator false 0 google.com

url

Return URL Details.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name	Description	Required
url	List of URLs.	Required
enhanced	Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
URL.Data	String	The URL.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
CTIX.URL.tenant_id	string	Tenant ID
CTIX.URL.stix_object_id	string	ID of the Threat Data Object in CTIX application
CTIX.URL.tlp_data	string	TLP Value of the Threat Data Object
CTIX.URL.first_seen	string	Timestamp of when the IP was first seen on the CTIX application
CTIX.URL.last_seen	string	Timestamp of when the IP was latest seen on the CTIX application
CTIX.URL.deprecated	boolean	Shows if the Threat Data Object is deprecated on the CTIX application
CTIX.URL.intel_grading	string	Intel grading
CTIX.URL.criticality	number	Criticality of the Threat Data Object on the scale of 0-5
CTIX.URL.indicator_type	string	Threat Data Object type
CTIX.URL.package_id	unknown	List of IDs of packages on the CTIX application through which these IPs were received
CTIX.URL.source	unknown	List of sources from which the IP address was received in the CTIX application
CTIX.URL.risk_severity	number	Risk Severity of the Threat Data Object on the scale of 0-5
CTIX.URL.labels	unknown	List of Tags applied on the Threat Data Object
CTIX.URL.source_grading	string	Source Grading
CTIX.URL.name2	string	Value of the Threat Data Object
CTIX.URL.published_collections	unknown	Published collections
CTIX.URL.published_package_id	unknown	Package ID
CTIX.URL.blocked	boolean	Shows if the Threat Data Object is blocked on the CTIX application
CTIX.URL.blocked_time	string	Timestamp of when the Threat Data Object was blocked on the CTIX application.
CTIX.URL.deprecated_time	string	Timestamp of when the Threat Data Object was deprecated on the CTIX application
CTIX.URL.notification_preference	unknown	Notification preference
CTIX.URL.followed_on	unknown	Followed On
CTIX.URL.score	number	CTIX Confidence Score of the IP Object out of 100
CTIX.URL.type	string	Type of object
CTIX.URL.subscriber_id	unknown	List of Subscriber IDs
CTIX.URL.subscriber	unknown	List of Subscribers
CTIX.URL.subscriber_collection_id	unknown	List of Subscriber Collection IDs
CTIX.URL.subscriber_collection	unknown	List of Subscriber Collection
CTIX.URL.object_type	string	Type of object
CTIX.URL.blocked_on	unknown	Name of the Application where the Threat Data Object was blocked on.
CTIX.URL.follow_by	unknown	List of Cyware Users who follow the object.
CTIX.URL.is_false_positive	boolean	Shows if the Threat Data Object was marked false positive in the CTIX application
CTIX.URL.domain_tld	string	Top-Level Domain information about the Threat Data Object.
CTIX.URL.asn	string	ASN number of the Threat Data Object
CTIX.URL.registered_domain	string	Registered Domain
CTIX.URL.geo_details	unknown	Geographic details of the Threat Data Object
CTIX.URL.country	string	Geographic details of the Object
CTIX.URL.registrar	string	Registrar
CTIX.URL.file_extension	string	File Extension
CTIX.URL.whitelisted	unknown	List
CTIX.URL.object_description	string	Description of the Threat Data Object.
CTIX.URL.custom_score	number	Custom Score of the Threat Data Object
CTIX.URL.is_following	boolean	Boolean Value
CTIX.URL.under_review	boolean	Shows if Threat Data Object is marked as Under Review on the CTIX application
CTIX.URL.under_reviewed_time	string	Timestamp when the object was marked under review.
CTIX.URL.reviewed	boolean	Shows if the Threat Data Object is Marked as Reviewed on the CTIX application
CTIX.URL.reviewed_time	string	Timestamp when then object was reviewed.
CTIX.URL.object_description_defang	string	Description of the object.
CTIX.URL.source_data	unknown	List of sources from which CTIX received this IP.
CTIX.URL.related_fields	unknown	Relationship Data about the Threat Data Object present on the CTIX application
CTIX.URL.enhancement_data	unknown	Additional enhanced data about the Threat Data Object fetched by the CTIX application

Command Example

!url url="https://www.test.com/" enhanced=True

Context Example

{
    "CTIX": {
        "URL": {
            "asn": null,
            "blocked": false,
            "blocked_on": [],
            "blocked_time": 0,
            "country": null,
            "criticality": 3,
            "custom_score": 0,
            "deprecated": false,
            "deprecated_time": null,
            "domain_tld": ".com",
            "enhancement_data": {},
            "file_extension": null,
            "first_seen": 1605768210,
            "follow_by": [],
            "followed_on": null,
            "geo_details": {},
            "indicator_type": "url",
            "intel_grading": null,
            "is_false_positive": false,
            "is_following": false,
            "labels": [
                {
                    "colour_code": null,
                    "created": 1605030281,
                    "created_by": "system@default.tld",
                    "id": "23ccc391-6968-4734-b93e-d4985e23dcfd",
                    "modified": 1605030281,
                    "modified_by": "system@default.tld",
                    "name": "anomalous-activity"
                }
            ],
            "last_seen": 1605894588,
            "name2": "https://www.test.com/",
            "notification_preference": null,
            "object_description": "",
            "object_description_defang": "",
            "object_type": "indicator",
            "package_id": [
                "package-fd79e1a4-db90-4748-b9cb-f72264bf3ffe",
                "package-63f2228a-7037-4e56-a3df-23644ba3be64"
            ],
            "published_collections": [
                "inbox & polling",
                "adsa",
                "newtestcollection1 - edited"
            ],
            "published_package_id": [
                "5df96375-1e0d-494b-870f-3f029d5cc565",
                "bbb62de5-f71f-4ca9-81b7-c4e94e3640cf",
                "96c58eb5-5784-4de5-8aa7-b4292525914c"
            ],
            "registered_domain": "test.com",
            "registrar": null,
            "related_fields": {
                "attack_pattern": [],
                "campaign": [],
                "course_of_action": [],
                "indicator": [],
                "intrusion_set": [],
                "kill_chain_phases": [],
                "malware": [],
                "threat_actor": [],
                "tool": [],
                "ttp": []
            },
            "reviewed": false,
            "reviewed_time": 0,
            "risk_severity": 5,
            "score": 58.18,
            "source": [
                "customsource1.x",
                "Import"
            ],
            "source_data": [
                {
                    "id": "d1d3b628-346f-43c3-a369-235661ac6277",
                    "name": "Import"
                },
                {
                    "id": "012072c9-1421-4960-ab01-2bb541596374",
                    "name": "customsource1.x"
                }
            ],
            "source_grading": null,
            "stix_object_id": "indicator--70414571-660b-4360-b064-f0cf58caf903",
            "subscriber": [],
            "subscriber_collection": [],
            "subscriber_collection_id": [],
            "subscriber_id": [],
            "tenant_id": "0a834138-cc59-4107-aa69-46e6080f06af",
            "tlp_data": "GREEN",
            "type": "Indicator",
            "under_review": false,
            "under_reviewed_time": 0,
            "value": "https://test.com/",
            "whitelisted": []
        }
    },
    "DBotScore": {
        "Indicator": "https://test.com/",
        "Score": 2,
        "Type": "url",
        "Vendor": "CTIX"
    },
    "URL": {
        "Data": "https://test.com/"
    }
}

Human Readable Output

URL List

blocked blocked_time criticality custom_score deprecated domain_tld first_seen indicator_type is_false_positive is_following labels last_seen name2 object_type package_id published_collections published_package_id registered_domain related_fields reviewed reviewed_time risk_severity score source source_data stix_object_id tenant_id tlp_data type under_review under_reviewed_time value

false 0 3 0.0 false .com 1605768210 url false false {‘id’: ‘23ccc391-6968-4734-b93e-d4985e23dcfd’, ‘name’: ‘anomalous-activity’, ‘colour_code’: None, ‘created_by’: ‘system@default.tld’, ‘created’: 1605030281, ‘modified_by’: ‘system@default.tld’, ‘modified’: 1605030281}
1605894588 https://test.com indicator package-fd79e1a4-db90-4748-b9cb-f72264bf3ffe,
package-63f2228a-7037-4e56-a3df-23644ba3be64 inbox & polling,
adsa,
newtestcollection1 - edited 5df96375-1e0d-494b-870f-3f029d5cc565,
bbb62de5-f71f-4ca9-81b7-c4e94e3640cf,
96c58eb5-5784-4de5-8aa7-b4292525914c test.com attack_pattern:
campaign:
intrusion_set:
malware:
threat_actor:
tool:
indicator:
ttp:
kill_chain_phases:
course_of_action: false 0 5 58.18 customsource1.x,
Import {‘name’: ‘Import’, ‘id’: ‘d1d3b628-346f-43c3-a369-235661ac6277’},
{‘name’: ‘customsource1.x’, ‘id’: ‘012072c9-1421-4960-ab01-2bb541596374’} indicator–70414571-660b-4360-b064-f0cf58caf903 0a834138-cc59-4107-aa69-46e6080f06af GREEN Indicator false 0 https://test.com/

file

Return File Details.

Base Command

file

Input

Argument Name	Description	Required
file	List of Files.	Required
enhanced	Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
File.Name	String	The full file name.
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA256 hash of the file.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
CTIX.File.tenant_id	string	Tenant ID
CTIX.File.stix_object_id	string	ID of the Threat Data Object in CTIX application
CTIX.File.tlp_data	string	TLP Value of the Threat Data Object
CTIX.File.first_seen	string	Timestamp of when the IP was first seen on the CTIX application
CTIX.File.last_seen	string	Timestamp of when the IP was latest seen on the CTIX application
CTIX.File.deprecated	boolean	Shows if the Threat Data Object is deprecated on the CTIX application
CTIX.File.intel_grading	string	Intel grading
CTIX.File.criticality	number	Criticality of the Threat Data Object on the scale of 0-5
CTIX.File.indicator_type	string	Threat Data Object type
CTIX.File.package_id	unknown	List of IDs of packages on the CTIX application through which these IPs were received
CTIX.File.source	unknown	List of sources from which the IP address was received in the CTIX application
CTIX.File.risk_severity	number	Risk Severity of the Threat Data Object on the scale of 0-5
CTIX.File.labels	unknown	List of Tags applied on the Threat Data Object
CTIX.File.source_grading	string	Source Grading
CTIX.File.name2	string	Value of the Threat Data Object
CTIX.File.published_collections	unknown	Published collections
CTIX.File.published_package_id	unknown	Package ID
CTIX.File.blocked	boolean	Shows if the Threat Data Object is blocked on the CTIX application
CTIX.File.blocked_time	string	Timestamp of when the Threat Data Object was blocked on the CTIX application.
CTIX.File.deprecated_time	string	Timestamp of when the Threat Data Object was deprecated on the CTIX application
CTIX.File.notification_preference	unknown	Notification preference
CTIX.File.followed_on	unknown	Followed On
CTIX.File.score	number	CTIX Confidence Score of the IP Object out of 100
CTIX.File.type	string	Type of object
CTIX.File.subscriber_id	unknown	List of Subscriber IDs
CTIX.File.subscriber	unknown	List of Subscribers
CTIX.File.subscriber_collection_id	unknown	List of Subscriber Collection IDs
CTIX.File.subscriber_collection	unknown	List of Subscriber Collection
CTIX.File.object_type	string	Type of object
CTIX.File.blocked_on	unknown	Name of the Application where the Threat Data Object was blocked on.
CTIX.File.follow_by	unknown	List of Cyware Users who follow the object.
CTIX.File.is_false_positive	boolean	Shows if the Threat Data Object was marked false positive in the CTIX application
CTIX.File.domain_tld	string	Top-Level Domain information about the Threat Data Object.
CTIX.File.asn	string	ASN number of the Threat Data Object
CTIX.File.registered_domain	string	Registered Domain
CTIX.File.geo_details	unknown	Geographic details of the Threat Data Object
CTIX.File.country	string	Geographic details of the Object
CTIX.File.registrar	string	Registrar
CTIX.File.file_extension	string	File Extension
CTIX.File.whitelisted	unknown	List
CTIX.File.object_description	string	Description of the Threat Data Object.
CTIX.File.custom_score	number	Custom Score of the Threat Data Object
CTIX.File.is_following	boolean	Boolean Value
CTIX.File.under_review	boolean	Shows if Threat Data Object is marked as Under Review on the CTIX application
CTIX.File.under_reviewed_time	string	Timestamp when the object was marked under review.
CTIX.File.reviewed	boolean	Shows if the Threat Data Object is Marked as Reviewed on the CTIX application
CTIX.File.reviewed_time	string	Timestamp when then object was reviewed.
CTIX.File.object_description_defang	string	Description of the object.
CTIX.File.source_data	unknown	List of sources from which CTIX received this IP.
CTIX.File.related_fields	unknown	Relationship Data about the Threat Data Object present on the CTIX application
CTIX.File.enhancement_data	unknown	Additional enhanced data about the Threat Data Object fetched by the CTIX application

Command Example

!file file="4ebb2b00a11f9361cf3757e96f14ad4b" enhanced=True

Context Example

{
    "CTIX": {
        "File": {
            "asn": null,
            "blocked": false,
            "blocked_on": [],
            "blocked_time": 0,
            "country": null,
            "criticality": 3,
            "custom_score": 0,
            "deprecated": true,
            "deprecated_time": 1588854933,
            "domain_tld": null,
            "enhancement_data": {},
            "file_extension": null,
            "first_seen": 1586262933,
            "follow_by": [],
            "followed_on": null,
            "geo_details": {},
            "indicator_type": "MD5",
            "intel_grading": null,
            "is_false_positive": false,
            "is_following": false,
            "labels": [
                {
                    "colour_code": null,
                    "created": 1605030281,
                    "created_by": "system@default.tld",
                    "id": "23ccc391-6968-4734-b93e-d4985e23dcfd",
                    "modified": 1605030281,
                    "modified_by": "system@default.tld",
                    "name": "anomalous-activity"
                }
            ],
            "last_seen": 1605791028,
            "name2": "4ebb2b00a11f9361cf3757e96f14ad4b",
            "notification_preference": null,
            "object_description": "",
            "object_description_defang": "",
            "object_type": "indicator",
            "package_id": [
                "package-d54892d8-b495-4331-b361-17ffbeacdaed",
                "package-09be25b9-5d6b-4320-b512-4dc0e088f434",
                "bundle--87151b50-31a4-4f0a-9f5f-282b0f1d1285"
            ],
            "published_collections": [
                "adsa",
                "newtestcollection1 - edited"
            ],
            "published_package_id": [
                "1557df73-68b4-485b-9821-e3036e5fb7a4",
                "a1eb2b29-fed4-4635-8e5c-a74f4339b8ab"
            ],
            "registered_domain": null,
            "registrar": null,
            "related_fields": {
                "attack_pattern": [],
                "campaign": [],
                "course_of_action": [],
                "indicator": [],
                "intrusion_set": [],
                "kill_chain_phases": [],
                "malware": [],
                "threat_actor": [],
                "tool": [],
                "ttp": []
            },
            "reviewed": false,
            "reviewed_time": 0,
            "risk_severity": 5,
            "score": 50,
            "source": [
                "Import"
            ],
            "source_data": [
                {
                    "id": "d1d3b628-346f-43c3-a369-235661ac6277",
                    "name": "Import"
                }
            ],
            "source_grading": null,
            "stix_object_id": "indicator--2e35588f-cde1-4492-a720-ab0aee7fafaa",
            "subscriber": [],
            "subscriber_collection": [],
            "subscriber_collection_id": [],
            "subscriber_id": [],
            "tenant_id": "0a834138-cc59-4107-aa69-46e6080f06af",
            "tlp_data": null,
            "type": "Indicator",
            "under_review": false,
            "under_reviewed_time": 0,
            "value": "4ebb2b00a11f9361cf3757e96f14ad4b",
            "whitelisted": []
        }
    },
    "DBotScore": {
        "Indicator": "4ebb2b00a11f9361cf3757e96f14ad4b",
        "Score": 2,
        "Type": "file",
        "Vendor": "CTIX"
    },
    "File": [
        {
            "Name": "4ebb2b00a11f9361cf3757e96f14ad4b",
            "MD5": "4ebb2b00a11f9361cf3757e96f14ad4b"
        }
    ]
}

Human Readable Output

File List

blocked blocked_time criticality custom_score deprecated deprecated_time first_seen indicator_type is_false_positive is_following labels last_seen name2 object_type package_id published_collections published_package_id related_fields reviewed reviewed_time risk_severity score source source_data stix_object_id tenant_id type under_review under_reviewed_time value

false 0 3 0.0 true 1588854933 1586262933 MD5 false false {‘id’: ‘23ccc391-6968-4734-b93e-d4985e23dcfd’, ‘name’: ‘anomalous-activity’, ‘colour_code’: None, ‘created_by’: ‘system@default.tld’, ‘created’: 1605030281, ‘modified_by’: ‘system@default.tld’, ‘modified’: 1605030281} 1605791028 4ebb2b00a11f9361cf3757e96f14ad4b indicator package-d54892d8-b495-4331-b361-17ffbeacdaed,
package-09be25b9-5d6b-4320-b512-4dc0e088f434,
bundle–87151b50-31a4-4f0a-9f5f-282b0f1d1285 adsa,
newtestcollection1 - edited 1557df73-68b4-485b-9821-e3036e5fb7a4,
a1eb2b29-fed4-4635-8e5c-a74f4339b8ab attack_pattern:
campaign:
intrusion_set:
malware:
threat_actor:
tool:
indicator:
ttp:
kill_chain_phases:
course_of_action: false 0 5 50.0 Import {‘name’: ‘Import’, ‘id’: ‘d1d3b628-346f-43c3-a369-235661ac6277’} indicator–2e35588f-cde1-4492-a720-ab0aee7fafaa 0a834138-cc59-4107-aa69-46e6080f06af Indicator false 0 4ebb2b00a11f9361cf3757e96f14ad4b

ctix-create-intel

Creates Intel in CTIX platform.

Base Command

ctix-create-intel

Input

Argument Name	Description	Required
title	Title of ioc	Optional
description	Description of ioc	Optional
tlp	Tlp of ioc	Optional
confidence	Confidence of ioc	Optional
ips	comma-separated list of IPs	Optional
urls	comma-separated list of URLs	Optional
domains	comma-separated list of domains	Optional
files	comma-separated list of files	Optional
emails	comma-separated list of emails	Optional
malwares	comma-separated list of malwares	Optional
threat_actors	comma-separated list of threat actors	Optional
attack_patterns	comma-separated list of attack patterns	Optional

Context Output

Path	Type	Description
CTIX.Intel.response	String	The response of the api
CTIX.Intel.status	Number	Status code returned from the api

Command Example

ctix-create-intel ips=1.2.3.4,3.45.56.78 urls=https://ioc_test.com,https://test_ioc.com files=8e7fad44308af9d1d60aac4fafcecdf2f66aa0315eb5f092fafa5bb03a5c2e3e emails=ioc@gmail.com,malicious@gmail.com malwares=dridex,spambot threat_actors=everest,grief attack_patterns=phishing,ddos title=title_xsoar_intel_creation description=xsoar_description tlp=green confidence=70

Context Example

{
    "CTIX": {
        "Intel": {
            "response": "Package is pushed in CTIX for publishing",
            "status": 201
        }
    }
}

Configuration parameters

base_url — Endpoint URL (required)
access_id — Access Key (required)
secret_key — Secret Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (5)

ctix-create-intel
Creates Intel in CTIX platform.
domain
Return Domain Details.
file
Return File Details.
ip
Return IP Details.
url
Return URL Details.

Source

CTIX.py CTIX_test.py CTIX.yml CTIX_description.md command_examples.txt

Download History Raw

commonfields:
  id: CTIX
  version: -1
fromversion: 5.0.0
name: CTIX
display: Cyware Threat Intelligence eXchange
category: Data Enrichment & Threat Intelligence
description: Deprecated. Use Cyware Intel Exchange instead.
provider: Cyware Labs
sectionorder:
- Connect
- Collect
configuration:
- display: Endpoint URL
  name: base_url
  type: 0
  required: true
  section: Connect
  additionalinfo: Enter the endpoint URL of your CTIX Instance.
- display: Access Key
  name: access_id
  type: 4
  required: true
  section: Connect
  additionalinfo: Enter the Access Key from the CTIX application.
- display: Secret Key
  name: secret_key
  type: 4
  required: true
  section: Connect
  additionalinfo: Enter the Secret Key from the CTIX application.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: List of IPs.
      isArray: true
    - name: enhanced
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources.
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: The autonomous system name for the IP address.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: CTIX.IP.tenant_id
      description: Tenant ID.
      type: string
    - contextPath: CTIX.IP.stix_object_id
      description: ID of the Threat Data Object in CTIX application.
      type: string
    - contextPath: CTIX.IP.tlp_data
      description: TLP Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.IP.first_seen
      description: Timestamp of when the IP was first seen on the CTIX application.
      type: string
    - contextPath: CTIX.IP.last_seen
      description: Timestamp of when the IP was latest seen on the CTIX application.
      type: string
    - contextPath: CTIX.IP.deprecated
      description: Shows if the Threat Data Object is deprecated on the CTIX application.
      type: boolean
    - contextPath: CTIX.IP.intel_grading
      description: Intel grading.
      type: string
    - contextPath: CTIX.IP.criticality
      description: Criticality of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.IP.indicator_type
      description: Threat Data Object type.
      type: string
    - contextPath: CTIX.IP.package_id
      description: List of IDs of packages on the CTIX application through which these IPs were received.
    - contextPath: CTIX.IP.source
      description: List of sources from which the IP address was received in the CTIX application.
    - contextPath: CTIX.IP.risk_severity
      description: Risk Severity of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.IP.labels
      description: List of Tags applied on the Threat Data Object.
    - contextPath: CTIX.IP.source_grading
      description: Source Grading.
      type: string
    - contextPath: CTIX.IP.name2
      description: Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.IP.published_collections
      description: Published collections.
    - contextPath: CTIX.IP.published_package_id
      description: Package ID.
    - contextPath: CTIX.IP.blocked
      description: Shows if the Threat Data Object is blocked on the CTIX application.
      type: boolean
    - contextPath: CTIX.IP.blocked_time
      description: Timestamp of when the Threat Data Object was blocked on the CTIX application.
      type: string
    - contextPath: CTIX.IP.deprecated_time
      description: Timestamp of when the Threat Data Object was deprecated on the CTIX application.
      type: string
    - contextPath: CTIX.IP.notification_preference
      description: Notification preference.
    - contextPath: CTIX.IP.followed_on
      description: Followed On.
    - contextPath: CTIX.IP.score
      description: CTIX Confidence Score of the IP Object out of 100.
      type: number
    - contextPath: CTIX.IP.type
      description: Type  of object.
      type: string
    - contextPath: CTIX.IP.subscriber_id
      description: List of Subscriber IDs.
    - contextPath: CTIX.IP.subscriber
      description: List of Subscribers.
    - contextPath: CTIX.IP.subscriber_collection_id
      description: List of Subscriber Collection IDs.
    - contextPath: CTIX.IP.subscriber_collection
      description: List of Subscriber Collection.
    - contextPath: CTIX.IP.object_type
      description: Type of object.
      type: string
    - contextPath: CTIX.IP.blocked_on
      description: Name of the Application where the Threat Data Object was blocked on.
    - contextPath: CTIX.IP.follow_by
      description: List of Cyware Users who follow the object.
    - contextPath: CTIX.IP.is_false_positive
      description: Shows if the Threat Data Object was marked false positive in the CTIX application.
      type: boolean
    - contextPath: CTIX.IP.domain_tld
      description: Top-Level Domain information about the Threat Data Object.
      type: string
    - contextPath: CTIX.IP.asn
      description: ASN number of the Threat Data Object.
      type: string
    - contextPath: CTIX.IP.registered_domain
      description: Registered Domain.
      type: string
    - contextPath: CTIX.IP.geo_details
      description: Geographic details of the Threat Data Object.
      type: unknown
    - contextPath: CTIX.IP.country
      description: Geographic details of the Object.
      type: string
    - contextPath: CTIX.IP.registrar
      description: Registrar.
      type: string
    - contextPath: CTIX.IP.file_extension
      description: File Extension.
      type: string
    - contextPath: CTIX.IP.whitelisted
      description: List.
    - contextPath: CTIX.IP.object_description
      description: Description of the Threat Data Object.
      type: string
    - contextPath: CTIX.IP.custom_score
      description: Custom Score of the Threat Data Object.
      type: number
    - contextPath: CTIX.IP.is_following
      description: Boolean Value.
      type: boolean
    - contextPath: CTIX.IP.under_review
      description: Shows if Threat Data Object is marked as Under Review on the CTIX application.
      type: boolean
    - contextPath: CTIX.IP.under_reviewed_time
      description: Timestamp when the object was marked under review.
      type: string
    - contextPath: CTIX.IP.reviewed
      description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application.
      type: boolean
    - contextPath: CTIX.IP.reviewed_time
      description: Timestamp when then object was reviewed.
      type: string
    - contextPath: CTIX.IP.object_description_defang
      description: Description of the object.
      type: string
    - contextPath: CTIX.IP.source_data
      description: List of sources from which CTIX received this IP.
    - contextPath: CTIX.IP.related_fields
      description: Relationship Data about the Threat Data Object present on the CTIX application.
    - contextPath: CTIX.IP.enhancement_data
      description: Additional enhanced data about the Threat Data Object fetched by the CTIX application.
    description: Return IP Details.
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      description: List of Domains.
      isArray: true
    - name: enhanced
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources.
    outputs:
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: CTIX.Domain.tenant_id
      description: Tenant ID.
      type: string
    - contextPath: CTIX.Domain.stix_object_id
      description: ID of the Threat Data Object in CTIX application.
      type: string
    - contextPath: CTIX.Domain.tlp_data
      description: TLP Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.Domain.first_seen
      description: Timestamp of when the IP was first seen on the CTIX application.
      type: string
    - contextPath: CTIX.Domain.last_seen
      description: Timestamp of when the IP was latest seen on the CTIX application.
      type: string
    - contextPath: CTIX.Domain.deprecated
      description: Shows if the Threat Data Object is deprecated on the CTIX application.
      type: boolean
    - contextPath: CTIX.Domain.intel_grading
      description: Intel grading.
      type: string
    - contextPath: CTIX.Domain.criticality
      description: Criticality of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.Domain.indicator_type
      description: Threat Data Object type.
      type: string
    - contextPath: CTIX.Domain.package_id
      description: List of IDs of packages on the CTIX application through which these IPs were received.
    - contextPath: CTIX.Domain.source
      description: List of sources from which the IP address was received in the CTIX application.
    - contextPath: CTIX.Domain.risk_severity
      description: Risk Severity of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.Domain.labels
      description: List of Tags applied on the Threat Data Object.
    - contextPath: CTIX.Domain.source_grading
      description: Source Grading.
      type: string
    - contextPath: CTIX.Domain.name2
      description: Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.Domain.published_collections
      description: Published collections.
    - contextPath: CTIX.Domain.published_package_id
      description: Package ID.
    - contextPath: CTIX.Domain.blocked
      description: Shows if the Threat Data Object is blocked on the CTIX application.
      type: boolean
    - contextPath: CTIX.Domain.blocked_time
      description: Timestamp of when the Threat Data Object was blocked on the CTIX application.
      type: string
    - contextPath: CTIX.Domain.deprecated_time
      description: Timestamp of when the Threat Data Object was deprecated on the CTIX application.
      type: string
    - contextPath: CTIX.Domain.notification_preference
      description: Notification preference.
    - contextPath: CTIX.Domain.followed_on
      description: Followed On.
    - contextPath: CTIX.Domain.score
      description: CTIX Confidence Score of the IP Object out of 100.
      type: number
    - contextPath: CTIX.Domain.type
      description: Type  of object.
      type: string
    - contextPath: CTIX.Domain.subscriber_id
      description: List of Subscriber IDs.
    - contextPath: CTIX.Domain.subscriber
      description: List of Subscribers.
    - contextPath: CTIX.Domain.subscriber_collection_id
      description: List of Subscriber Collection IDs.
    - contextPath: CTIX.Domain.subscriber_collection
      description: List of Subscriber Collection.
    - contextPath: CTIX.Domain.object_type
      description: Type of object.
      type: string
    - contextPath: CTIX.Domain.blocked_on
      description: Name of the Application where the Threat Data Object was blocked on.
    - contextPath: CTIX.Domain.follow_by
      description: List of Cyware Users who follow the object.
    - contextPath: CTIX.Domain.is_false_positive
      description: Shows if the Threat Data Object was marked false positive in the CTIX application.
      type: boolean
    - contextPath: CTIX.Domain.domain_tld
      description: Top-Level Domain information about the Threat Data Object.
      type: string
    - contextPath: CTIX.Domain.asn
      description: ASN number of the Threat Data Object.
      type: string
    - contextPath: CTIX.Domain.registered_domain
      description: Registered Domain.
      type: string
    - contextPath: CTIX.Domain.geo_details
      description: Geographic details of the Threat Data Object.
      type: unknown
    - contextPath: CTIX.Domain.country
      description: Geographic details of the Object.
      type: string
    - contextPath: CTIX.Domain.registrar
      description: Registrar.
      type: string
    - contextPath: CTIX.Domain.file_extension
      description: File Extension.
      type: string
    - contextPath: CTIX.Domain.whitelisted
      description: List.
    - contextPath: CTIX.Domain.object_description
      description: Description of the Threat Data Object.
      type: string
    - contextPath: CTIX.Domain.custom_score
      description: Custom Score of the Threat Data Object.
      type: number
    - contextPath: CTIX.Domain.is_following
      description: Boolean Value.
      type: boolean
    - contextPath: CTIX.Domain.under_review
      description: Shows if Threat Data Object is marked as Under Review on the CTIX application.
      type: boolean
    - contextPath: CTIX.Domain.under_reviewed_time
      description: Timestamp when the object was marked under review.
      type: string
    - contextPath: CTIX.Domain.reviewed
      description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application.
      type: boolean
    - contextPath: CTIX.Domain.reviewed_time
      description: Timestamp when then object was reviewed.
      type: string
    - contextPath: CTIX.Domain.object_description_defang
      description: Description of the object.
      type: string
    - contextPath: CTIX.Domain.source_data
      description: List of sources from which CTIX received this IP.
    - contextPath: CTIX.Domain.related_fields
      description: Relationship Data about the Threat Data Object present on the CTIX application.
    - contextPath: CTIX.Domain.enhancement_data
      description: Additional enhanced data about the Threat Data Object fetched by the CTIX application.
    description: Return Domain Details.
  - name: url
    arguments:
    - name: url
      required: true
      default: true
      description: List of URLs.
      isArray: true
    - name: enhanced
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources.
    outputs:
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: CTIX.URL.tenant_id
      description: Tenant ID.
      type: string
    - contextPath: CTIX.URL.stix_object_id
      description: ID of the Threat Data Object in CTIX application.
      type: string
    - contextPath: CTIX.URL.tlp_data
      description: TLP Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.URL.first_seen
      description: Timestamp of when the IP was first seen on the CTIX application.
      type: string
    - contextPath: CTIX.URL.last_seen
      description: Timestamp of when the IP was latest seen on the CTIX application.
      type: string
    - contextPath: CTIX.URL.deprecated
      description: Shows if the Threat Data Object is deprecated on the CTIX application.
      type: boolean
    - contextPath: CTIX.URL.intel_grading
      description: Intel grading.
      type: string
    - contextPath: CTIX.URL.criticality
      description: Criticality of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.URL.indicator_type
      description: Threat Data Object type.
      type: string
    - contextPath: CTIX.URL.package_id
      description: List of IDs of packages on the CTIX application through which these IPs were received.
    - contextPath: CTIX.URL.source
      description: List of sources from which the IP address was received in the CTIX application.
    - contextPath: CTIX.URL.risk_severity
      description: Risk Severity of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.URL.labels
      description: List of Tags applied on the Threat Data Object.
    - contextPath: CTIX.URL.source_grading
      description: Source Grading.
      type: string
    - contextPath: CTIX.URL.name2
      description: Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.URL.published_collections
      description: Published collections.
    - contextPath: CTIX.URL.published_package_id
      description: Package ID.
    - contextPath: CTIX.URL.blocked
      description: Shows if the Threat Data Object is blocked on the CTIX application.
      type: boolean
    - contextPath: CTIX.URL.blocked_time
      description: Timestamp of when the Threat Data Object was blocked on the CTIX application.
      type: string
    - contextPath: CTIX.URL.deprecated_time
      description: Timestamp of when the Threat Data Object was deprecated on the CTIX application.
      type: string
    - contextPath: CTIX.URL.notification_preference
      description: Notification preference.
    - contextPath: CTIX.URL.followed_on
      description: Followed On.
    - contextPath: CTIX.URL.score
      description: CTIX Confidence Score of the IP Object out of 100.
      type: number
    - contextPath: CTIX.URL.type
      description: Type  of object.
      type: string
    - contextPath: CTIX.URL.subscriber_id
      description: List of Subscriber IDs.
    - contextPath: CTIX.URL.subscriber
      description: List of Subscribers.
    - contextPath: CTIX.URL.subscriber_collection_id
      description: List of Subscriber Collection IDs.
    - contextPath: CTIX.URL.subscriber_collection
      description: List of Subscriber Collection.
    - contextPath: CTIX.URL.object_type
      description: Type of object.
      type: string
    - contextPath: CTIX.URL.blocked_on
      description: Name of the Application where the Threat Data Object was blocked on.
    - contextPath: CTIX.URL.follow_by
      description: List of Cyware Users who follow the object.
    - contextPath: CTIX.URL.is_false_positive
      description: Shows if the Threat Data Object was marked false positive in the CTIX application.
      type: boolean
    - contextPath: CTIX.URL.domain_tld
      description: Top-Level Domain information about the Threat Data Object.
      type: string
    - contextPath: CTIX.URL.asn
      description: ASN number of the Threat Data Object.
      type: string
    - contextPath: CTIX.URL.registered_domain
      description: Registered Domain.
      type: string
    - contextPath: CTIX.URL.geo_details
      description: Geographic details of the Threat Data Object.
      type: unknown
    - contextPath: CTIX.URL.country
      description: Geographic details of the Object.
      type: string
    - contextPath: CTIX.URL.registrar
      description: Registrar.
      type: string
    - contextPath: CTIX.URL.file_extension
      description: File Extension.
      type: string
    - contextPath: CTIX.URL.whitelisted
      description: List.
    - contextPath: CTIX.URL.object_description
      description: Description of the Threat Data Object.
      type: string
    - contextPath: CTIX.URL.custom_score
      description: Custom Score of the Threat Data Object.
      type: number
    - contextPath: CTIX.URL.is_following
      description: Boolean Value.
      type: boolean
    - contextPath: CTIX.URL.under_review
      description: Shows if Threat Data Object is marked as Under Review on the CTIX application.
      type: boolean
    - contextPath: CTIX.URL.under_reviewed_time
      description: Timestamp when the object was marked under review.
      type: string
    - contextPath: CTIX.URL.reviewed
      description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application.
      type: boolean
    - contextPath: CTIX.URL.reviewed_time
      description: Timestamp when then object was reviewed.
      type: string
    - contextPath: CTIX.URL.object_description_defang
      description: Description of the object.
      type: string
    - contextPath: CTIX.URL.source_data
      description: List of sources from which CTIX received this IP.
    - contextPath: CTIX.URL.related_fields
      description: Relationship Data about the Threat Data Object present on the CTIX application.
    - contextPath: CTIX.URL.enhancement_data
      description: Additional enhanced data about the Threat Data Object fetched by the CTIX application.
    description: Return URL Details.
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: List of Files.
      isArray: true
    - name: enhanced
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources.
    outputs:
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: CTIX.File.tenant_id
      description: Tenant ID.
      type: string
    - contextPath: CTIX.File.stix_object_id
      description: ID of the Threat Data Object in CTIX application.
      type: string
    - contextPath: CTIX.File.tlp_data
      description: TLP Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.File.first_seen
      description: Timestamp of when the IP was first seen on the CTIX application.
      type: string
    - contextPath: CTIX.File.last_seen
      description: Timestamp of when the IP was latest seen on the CTIX application.
      type: string
    - contextPath: CTIX.File.deprecated
      description: Shows if the Threat Data Object is deprecated on the CTIX application.
      type: boolean
    - contextPath: CTIX.File.intel_grading
      description: Intel grading.
      type: string
    - contextPath: CTIX.File.criticality
      description: Criticality of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.File.indicator_type
      description: Threat Data Object type.
      type: string
    - contextPath: CTIX.File.package_id
      description: List of IDs of packages on the CTIX application through which these IPs were received.
    - contextPath: CTIX.File.source
      description: List of sources from which the IP address was received in the CTIX application.
    - contextPath: CTIX.File.risk_severity
      description: Risk Severity of the Threat Data Object on the scale of 0-5.
      type: number
    - contextPath: CTIX.File.labels
      description: List of Tags applied on the Threat Data Object.
    - contextPath: CTIX.File.source_grading
      description: Source Grading.
      type: string
    - contextPath: CTIX.File.name2
      description: Value of the Threat Data Object.
      type: string
    - contextPath: CTIX.File.published_collections
      description: Published collections.
    - contextPath: CTIX.File.published_package_id
      description: Package ID.
    - contextPath: CTIX.File.blocked
      description: Shows if the Threat Data Object is blocked on the CTIX application.
      type: boolean
    - contextPath: CTIX.File.blocked_time
      description: Timestamp of when the Threat Data Object was blocked on the CTIX application.
      type: string
    - contextPath: CTIX.File.deprecated_time
      description: Timestamp of when the Threat Data Object was deprecated on the CTIX application.
      type: string
    - contextPath: CTIX.File.notification_preference
      description: Notification preference.
    - contextPath: CTIX.File.followed_on
      description: Followed On.
    - contextPath: CTIX.File.score
      description: CTIX Confidence Score of the IP Object out of 100.
      type: number
    - contextPath: CTIX.File.type
      description: Type  of object.
      type: string
    - contextPath: CTIX.File.subscriber_id
      description: List of Subscriber IDs.
    - contextPath: CTIX.File.subscriber
      description: List of Subscribers.
    - contextPath: CTIX.File.subscriber_collection_id
      description: List of Subscriber Collection IDs.
    - contextPath: CTIX.File.subscriber_collection
      description: List of Subscriber Collection.
    - contextPath: CTIX.File.object_type
      description: Type of object.
      type: string
    - contextPath: CTIX.File.blocked_on
      description: Name of the Application where the Threat Data Object was blocked on.
    - contextPath: CTIX.File.follow_by
      description: List of Cyware Users who follow the object.
    - contextPath: CTIX.File.is_false_positive
      description: Shows if the Threat Data Object was marked false positive in the CTIX application.
      type: boolean
    - contextPath: CTIX.File.domain_tld
      description: Top-Level Domain information about the Threat Data Object.
      type: string
    - contextPath: CTIX.File.asn
      description: ASN number of the Threat Data Object.
      type: string
    - contextPath: CTIX.File.registered_domain
      description: Registered Domain.
      type: string
    - contextPath: CTIX.File.geo_details
      description: Geographic details of the Threat Data Object.
      type: unknown
    - contextPath: CTIX.File.country
      description: Geographic details of the Object.
      type: string
    - contextPath: CTIX.File.registrar
      description: Registrar.
      type: string
    - contextPath: CTIX.File.file_extension
      description: File Extension.
      type: string
    - contextPath: CTIX.File.whitelisted
      description: List.
    - contextPath: CTIX.File.object_description
      description: Description of the Threat Data Object.
      type: string
    - contextPath: CTIX.File.custom_score
      description: Custom Score of the Threat Data Object.
      type: number
    - contextPath: CTIX.File.is_following
      description: Boolean Value.
      type: boolean
    - contextPath: CTIX.File.under_review
      description: Shows if Threat Data Object is marked as Under Review on the CTIX application.
      type: boolean
    - contextPath: CTIX.File.under_reviewed_time
      description: Timestamp when the object was marked under review.
      type: string
    - contextPath: CTIX.File.reviewed
      description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application.
      type: boolean
    - contextPath: CTIX.File.reviewed_time
      description: Timestamp when then object was reviewed.
      type: string
    - contextPath: CTIX.File.object_description_defang
      description: Description of the object.
      type: string
    - contextPath: CTIX.File.source_data
      description: List of sources from which CTIX received this IP.
    - contextPath: CTIX.File.related_fields
      description: Relationship Data about the Threat Data Object present on the CTIX application.
    - contextPath: CTIX.File.enhancement_data
      description: Additional enhanced data about the Threat Data Object fetched by the CTIX application.
    description: Return File Details.
  - name: ctix-create-intel
    description: Creates Intel in CTIX platform.
    arguments:
    - name: title
      description: Title of ioc.
    - name: description
      description: Description of ioc.
    - name: tlp
      description: tlp of ioc.
    - name: confidence
      description: confidence of ioc.
    - name: ips
      description: comma-separated list of IPs.
      isArray: true
    - name: urls
      description: comma-separated list of URLs.
      isArray: true
    - name: domains
      description: comma-separated list of domains.
      isArray: true
    - name: files
      description: comma-separated list of files.
      isArray: true
    - name: emails
      description: comma-separated list of emails.
      isArray: true
    - name: malwares
      description: comma-separated list of malwares.
      isArray: true
    - name: threat_actors
      description: comma-separated list of threat_actors.
      isArray: true
    - name: attack_patterns
      description: comma-separated list of attack_patterns.
      isArray: true
    outputs:
    - contextPath: CTIX.Intel.response
      description: The response of the api.
      type: String
    - contextPath: CTIX.Intel.status
      description: Status code returned from the api.
      type: String
  dockerimage: demisto/python3:3.12.13.8160132
  subtype: python3
tests:
- No tests
deprecated: true

CTIX Deprecated

Details

README

Configure CTIX in Cortex

Commands

ip

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

IP List

domain

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Domain List

url

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

URL List

file

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

File List

ctix-create-intel

Base Command

Input

Context Output

Command Example

Context Example

Configuration parameters

Commands (5)

Source