Cofense Intelligence Deprecated

Deprecated. Use Cofense Intelligence v2 instead. Use the Cofense Intelligence integration to check the reputation of URLs, IP addresses, file hashes, and email addresses.

Data Enrichment & Threat Intelligence · Cofense Intelligence (Deprecated)

Details

ID	`Cofense Intelligence`
Provider	Cofense
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Supported Modules	Agentix

README

Use the Cofense Intelligence integration to check the reputation of URLs, IP addresses, file hashes, and email addresses.

Configure Cofense Intelligence in Cortex

Parameter	Description	Required
Server URL (e.g., https://www.threathq.com/apiv1)		True
API username		True
Source Reliability	Reliability of the source providing the intelligence data.	True
Use system proxy settings		False
Trust any certificate (not secure)		False
URL Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the URL malicious		False
File Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the file malicious		False
IP Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the IP malicious		False
Email Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the email malicious		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Checks the reputation of a URL.

Base Command

url

Input

Argument Name	Description	Required
url	URL to check.	Required

Context Output

Path	Type	Description
URL.Data	unknown	Bad URLs.
URL.Malicious.Vendor	unknown	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	unknown	For malicious URLs, the reason that the vendor made the decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Cofense.URL.Data	unknown	Bad URLs.
Cofense.URL.Malicious.Vendor	unknown	For malicious URLs, the vendor that made the decision.
Cofense.URL.Malicious.Description	unknown	For malicious URLs, the reason that the vendor made the decision.
Cofense.URL.Cofense.ThreatIDs	unknown	The thread IDs retrieved by the vendor.

Command Example

!url url=example.com using="Cofense Intelligence_instance_1"

Context Example

{
    "DBotScore": {
        "Indicator": "example.com",
        "Reliability": "B - Usually reliable",
        "Score": 0,
        "Type": "url",
        "Vendor": "Cofense"
    }
}

Human Readable Output

Cofense URL Reputation for: example.com

No information found for this url

file

Checks the reputation of a file hash.

Base Command

file

Input

Argument Name	Description	Required
file	A CSV list of file hashes to check (MD5, SHA1, or SHA256).	Required

Context Output

Path	Type	Description
File.MD5	unknown	File MD5
File.Malicious.Vendor	unknown	For malicious files, the vendor that made the decision.
File.Malicious.Description	unknown	For malicious files, the reason that the vendor made the decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Cofense.File.MD5	unknown	MD5 hash of the file.
Cofense.File.Malicious.Vendor	unknown	For malicious files, the vendor that made the decision.
Cofense.File.Malicious.Description	unknown	For malicious files, the reason that the vendor made the decision.
Cofense.File.ThreatIDs	unknown	The thread IDs retrieved by the vendor.

Command Example


#### Human Readable Output

### ip

***
Checks the reputation of an IP address.

#### Base Command

`ip`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| ip | IP address to check. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IP.Data | unknown | Bad IP Address found |
| IP.Malicious.Vendor | unknown | For malicious IPs, the vendor that made the decision |
| IP.Malicious.Description | unknown | For malicious IPs, the reason that the vendor made the decision |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| Cofense.IP.Data | unknown | Bad IP Address found |
| Cofense.IP.Malicious.Vendor | unknown | For malicious IPs, the vendor that made the decision |
| Cofense.IP.Malicious.Description | unknown | For malicious IPs, the reason that the vendor made the decision |
| Cofense.IP.Cofense.ThreatIDs | unknown | The thread ids retrieved by the vendor. |
| IP.ASN | unknown | Autonomous System name for the IP. |
| IP.GEO.Location | unknown | Location in format latitude, longitude. |
| IP.GEO.Country | unknown | Country of the IP. |
| IP.Address | string | IP address. |

#### Command Example

```!ip ip=1.2.3.4 using="Cofense Intelligence_instance_1"```

#### Context Example

```json
{
    "DBotScore": {
        "Indicator": "1.2.3.4",
        "Reliability": "B - Usually reliable",
        "Score": 0,
        "Type": "ip",
        "Vendor": "Cofense"
    }
}
```

#### Human Readable Output

>## Cofense IP Reputation for: x.x.x.x
>
>No information found for this ip

### email

***
Checks the reputation of an email address.

#### Base Command

`email`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| email | Sender email address to check. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Email.Data | unknown | Sender address to check. |
| Account.Email.Address | unknown | Sender email address to check. |
| Account.Email.Malicious.Vendor | unknown | For malicious emails, the vendor that made the decision. |
| Account.Email.Malicious.Description | unknown | For malicious emails, the reason that the vendor made the decision. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| Cofense.Email.Data | unknown | Sender address to check. |
| Cofense.Email.Malicious.Vendor | unknown | For malicious emails, the vendor that made the decision. |
| Cofense.Email.Malicious.Description | unknown | For malicious URLs, the reason that the vendor made the decision. |
| Cofense.Email.Cofense.ThreatIDs | unknown | The thread ids retrieved by the vendor. |

#### Command Example

```!email email=example@example.com using="Cofense Intelligence_instance_1"```

#### Context Example

```json
{
    "DBotScore": {
        "Indicator": "example@example.com",
        "Reliability": "B - Usually reliable",
        "Score": 0,
        "Type": "email",
        "Vendor": "Cofense"
    }
}
```

#### Human Readable Output

>## Cofense email Reputation for: example@example.com
>
>No infomation found for this email

### cofense-search

***
Searches for extracted strings identified within malware campaigns.

#### Base Command

`cofense-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| str | String to search. | Required |
| limit | Maximum number of strings to search. Default is 10. Default is 10. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Cofense.NumOfThreats | unknown | Number of threats. |
| Cofense.String | unknown | String that was searched. |

#### Command Example

Human Readable Output

Configuration parameters

url — Server URL (e.g., https://www.threathq.com/apiv1) (required)
credentials — API username (required)
integrationReliability — Source Reliability (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
urlThreshold — URL Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the URL malicious
fileThreshold — File Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the file malicious
ipThreshold — IP Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the IP malicious
emailThreshold — Email Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the email malicious

Commands (5)

cofense-search
Searches for extracted strings identified within malware campaigns.
email
Checks the reputation of an email address.
file
Checks the reputation of a file hash.
ip
Checks the reputation of an IP address.
url
Checks the reputation of a URL.

Source

CofenseIntelligence.js CofenseIntelligence.yml CofenseIntelligence_description.md command_examples.txt

Download History Raw

commonfields:
  id: Cofense Intelligence
  version: -1
name: Cofense Intelligence
display: Cofense Intelligence (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: Cofense
description: Deprecated. Use Cofense Intelligence v2 instead. Use the Cofense Intelligence integration to check the reputation of URLs, IP addresses, file hashes, and email addresses.
configuration:
- display: Server URL (e.g., https://www.threathq.com/apiv1)
  name: url
  defaultvalue: https://www.threathq.com/apiv1
  type: 0
  required: true
- display: API username
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Use system proxy settings
  name: proxy
  defaultvalue: ""
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: URL Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the URL malicious
  name: urlThreshold
  defaultvalue: Major
  type: 0
  required: false
- display: File Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the file malicious
  name: fileThreshold
  defaultvalue: Major
  type: 0
  required: false
- display: IP Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the IP malicious
  name: ipThreshold
  defaultvalue: Major
  type: 0
  required: false
- display: Email Threshold (None, Minor, Moderate, or Major). Minimum severity to consider the email malicious
  name: emailThreshold
  defaultvalue: Major
  type: 0
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: url
    arguments:
    - name: url
      required: true
      default: true
      description: URL to check.
    outputs:
    - contextPath: URL.Data
      description: Bad URLs.
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Cofense.URL.Data
      description: Bad URLs.
    - contextPath: Cofense.URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
    - contextPath: Cofense.URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
    - contextPath: Cofense.URL.Cofense.ThreatIDs
      description: The thread IDs retrieved by the vendor.
    description: Checks the reputation of a URL.
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: A CSV list of file hashes to check (MD5, SHA1, or SHA256).
    outputs:
    - contextPath: File.MD5
      description: File MD5
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Cofense.File.MD5
      description: MD5 hash of the file.
    - contextPath: Cofense.File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    - contextPath: Cofense.File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
    - contextPath: Cofense.File.ThreatIDs
      description: The thread IDs retrieved by the vendor.
    description: Checks the reputation of a file hash.
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to check.
    outputs:
    - contextPath: IP.Data
      description: Bad IP Address found
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason that the vendor made the decision
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Cofense.IP.Data
      description: Bad IP Address found
    - contextPath: Cofense.IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision
    - contextPath: Cofense.IP.Malicious.Description
      description: For malicious IPs, the reason that the vendor made the decision
    - contextPath: Cofense.IP.Cofense.ThreatIDs
      description: The thread ids retrieved by the vendor.
    - contextPath: IP.ASN
      description: Autonomous System name for the IP.
    - contextPath: IP.GEO.Location
      description: Location in format latitude, longitude.
    - contextPath: IP.GEO.Country
      description: Country of the IP.
    - contextPath: IP.Address
      description: IP address.
      type: string
    description: Checks the reputation of an IP address.
  - name: email
    arguments:
    - name: email
      required: true
      default: true
      description: Sender email address to check.
    outputs:
    - contextPath: Email.Data
      description: Sender address to check.
    - contextPath: Account.Email.Address
      description: Sender email address to check.
    - contextPath: Account.Email.Malicious.Vendor
      description: For malicious emails, the vendor that made the decision.
    - contextPath: Account.Email.Malicious.Description
      description: For malicious emails, the reason that the vendor made the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Cofense.Email.Data
      description: Sender address to check.
    - contextPath: Cofense.Email.Malicious.Vendor
      description: For malicious emails, the vendor that made the decision.
    - contextPath: Cofense.Email.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
    - contextPath: Cofense.Email.Cofense.ThreatIDs
      description: The thread ids retrieved by the vendor.
    description: Checks the reputation of an email address.
  - name: cofense-search
    arguments:
    - name: str
      required: true
      default: true
      description: String to search.
    - name: limit
      description: Maximum number of strings to search. Default is 10.
      defaultValue: "10"
    outputs:
    - contextPath: Cofense.NumOfThreats
      description: Number of threats.
    - contextPath: Cofense.String
      description: String that was searched.
    description: Searches for extracted strings identified within malware campaigns.
deprecated: true
fromversion: 5.0.0