CrowdSec

Details

ID	`CrowdSec`
Provider	CrowdSec
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Identify Malicious IP addresses with the CrowdSec CTI API.

Configure CrowdSec in Cortex

Parameter	Description	Required
Source Reliability	Reliability of the source providing the intelligence data.	True
API Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Check the specified IP Address against the CrowdSec CTI.

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP Address to check.	Required

Context Output

Path	Type	Description
CrowdSec.Info.ip_range_score	Number	The score of the IP Range
CrowdSec.Info.ip	String	The IP address
CrowdSec.Info.ip_range	String	The IP range
CrowdSec.Info.as_name	String	The AS name
CrowdSec.Info.as_num	Number	The AS number
CrowdSec.Info.location.country	String	The country of the IP
CrowdSec.Info.location.city	String	The city of the IP
CrowdSec.Info.location.latitude	Number	The latitude of the IP
CrowdSec.Info.location.longitude	Number	The longitude of the IP
CrowdSec.Info.reverse_dns	String	The reverse DNS of the IP
CrowdSec.Info.behaviors	Array	List of IP behaviors
CrowdSec.Info.history.first_seen	Date	Date of the first time this IP was reported
CrowdSec.Info.history.last_seen	Date	Date of the last time this IP was reported
CrowdSec.Info.history.full_age	Number	Delta in days between first seen and today
CrowdSec.Info.history.days_age	Number	Delta in days between first and last seen timestamps
CrowdSec.Info.classifications.classifications	Array	A list of categories associated with the IP. Those data can be sourced from 3rd parties (i.e. tor exit nodes list)
CrowdSec.Info.classifications.false_positives	Array	A list of false positives tags associated with the IP. Any IP with false_positives tags shouldn’t be considered as malicious
CrowdSec.Info.classifications.classifications.description	String
CrowdSec.Info.attack_details	Array	A more exhaustive list of the scenarios for which a given IP was reported
CrowdSec.Info.target_countries	Object	The top 10 reports repartition by country about the IP, as a percentage
CrowdSec.Info.scores.overall.aggressiveness	Number	Overall aggressiveness score
CrowdSec.Info.scores.overall.threat	Number	Overall threat score
CrowdSec.Info.scores.overall.trust	Number	Overall trust score
CrowdSec.Info.scores.overall.anomaly	Number	Overall anomaly score
CrowdSec.Info.scores.overall.total	Number	Overall score
CrowdSec.Info.scores.last_day.aggressiveness	Number	Last day aggressiveness score
CrowdSec.Info.scores.last_day.threat	Number	Last day threat score
CrowdSec.Info.scores.last_day.trust	Number	Last day trust score
CrowdSec.Info.scores.last_day.anomaly	Number	Last day anomaly score
CrowdSec.Info.scores.last_day.total	Number	Last day score
CrowdSec.Info.scores.last_week.aggressiveness	Number	Last week aggressiveness score
CrowdSec.Info.scores.last_week.threat	Number	Last week threat score
CrowdSec.Info.scores.last_week.trust	Number	Last week trust score
CrowdSec.Info.scores.last_week.anomaly	Number	Last week anomaly score
CrowdSec.Info.scores.last_week.total	Number	Last week score
CrowdSec.Info.scores.last_month.aggressiveness	Number	Last month aggressiveness score
CrowdSec.Info.scores.last_month.threat	Number	Last month threat score
CrowdSec.Info.scores.last_month.trust	Number	Last month trust score
CrowdSec.Info.scores.last_month.anomaly	Number	Last month anomaly score
CrowdSec.Info.scores.last_month.total	Number	Last month score
IP.Address	String	The IP Address	.
DBotScore.Score	number	The actual score.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Type	String	The indicator type.
DBotScore.Indicator	String	The indicator that was tested.

Configuration parameters

integrationReliability — Source Reliability (required)
apikey — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

ip
Check the specified IP Address against the CrowdSec CTI.

Source

CrowdSec.py CrowdSec_test.py CrowdSec.yml CrowdSec_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: CrowdSec
sectionorder:
- Connect
- Collect
commonfields:
  id: CrowdSec
  version: -1
configuration:
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: 'Identify Malicious IP addresses with the CrowdSec CTI API.'
display: 'CrowdSec'
name: CrowdSec
script:
  commands:
  - arguments:
    - default: true
      description: 'The IP Address to check.'
      isArray: true
      name: ip
      required: true
    description: 'Check the specified IP Address against the CrowdSec CTI.'
    name: ip
    outputs:
    - contextPath: CrowdSec.Info.ip_range_score
      description: 'The score of the IP Range.'
      type: Number
    - contextPath: CrowdSec.Info.ip
      description: 'The IP address.'
      type: String
    - contextPath: IP.Address
      description: 'The IP address.'
      type: String
    - contextPath: CrowdSec.Info.ip_range
      description: 'The IP range.'
      type: String
    - contextPath: CrowdSec.Info.as_name
      description: 'The AS name.'
      type: String
    - contextPath: CrowdSec.Info.as_num
      description: 'The AS number.'
      type: Number
    - contextPath: CrowdSec.Info.location.country
      description: 'The country of the IP.'
      type: String
    - contextPath: CrowdSec.Info.location.city
      description: 'The city of the IP.'
      type: String
    - contextPath: CrowdSec.Info.location.latitude
      description: 'The latitude of the IP.'
      type: Number
    - contextPath: CrowdSec.Info.location.longitude
      description: 'The longitude of the IP.'
      type: Number
    - contextPath: CrowdSec.Info.reverse_dns
      description: 'The reverse DNS of the IP.'
      type: String
    - contextPath: CrowdSec.Info.behaviors
      description: 'List of IP behaviors.'
      type: Array
    - contextPath: CrowdSec.Info.history.first_seen
      description: 'Date of the first time this IP was reported.'
      type: Date
    - contextPath: CrowdSec.Info.history.last_seen
      description: 'Date of the last time this IP was reported.'
      type: Date
    - contextPath: CrowdSec.Info.history.full_age
      description: 'Delta in days between first seen and today.'
      type: Number
    - contextPath: CrowdSec.Info.history.days_age
      description: 'Delta in days between first and last seen timestamps.'
      type: Number
    - contextPath: CrowdSec.Info.classifications.classifications
      description: 'A list of categories associated with the IP. Those data can be sourced from 3rd parties (i.e. tor exit nodes list).'
      type: Array
    - contextPath: CrowdSec.Info.classifications.false_positives
      description: "A list of false positives tags associated with the IP. Any IP with false_positives tags shouldn't be considered as malicious."
      type: Array
    - contextPath: CrowdSec.Info.classifications.classifications.description
      description: ''
      type: String
    - contextPath: CrowdSec.Info.attack_details
      description: 'A more exhaustive list of the scenarios for which a given IP was reported.'
      type: Array
    - contextPath: CrowdSec.Info.target_countries
      description: 'The top 10 reports repartition by country about the IP, as a percentage.'
      type: Object
    - contextPath: CrowdSec.Info.scores.overall.aggressiveness
      description: 'Overall aggressiveness score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.overall.threat
      description: 'Overall threat score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.overall.trust
      description: 'Overall trust score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.overall.anomaly
      description: 'Overall anomaly score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.overall.total
      description: 'Overall score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_day.aggressiveness
      description: 'Last day aggressiveness score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_day.threat
      description: 'Last day threat score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_day.trust
      description: 'Last day trust score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_day.anomaly
      description: 'Last day anomaly score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_day.total
      description: 'Last day score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_week.aggressiveness
      description: 'Last week aggressiveness score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_week.threat
      description: 'Last week threat score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_week.trust
      description: 'Last week trust score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_week.anomaly
      description: 'Last week anomaly score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_week.total
      description: 'Last week score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_month.aggressiveness
      description: 'Last month aggressiveness score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_month.threat
      description: 'Last month threat score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_month.trust
      description: 'Last month trust score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_month.anomaly
      description: 'Last month anomaly score.'
      type: Number
    - contextPath: CrowdSec.Info.scores.last_month.total
      description: 'Last month score.'
      type: Number
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.5.0
tests:
- No tests (auto formatted)