Cryptocurrency
Cryptocurrency will help classify Cryptocurrency indicators with the configured score when ingested.
Data Enrichment & Threat Intelligence · Cryptocurrency
Details
| ID | Cryptocurrency |
|---|---|
| Provider | Open Source |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Cryptocurrency will help classify Cryptocurrency indicators as suspicious when ingested.
Configure Cryptocurrency in Cortex
| Parameter | Description | Required |
|---|---|---|
| reliability | Source Reliability | False |
| reputation | Reputation | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
crypto
Return Cryptocurrency reputation.
Base Command
crypto
Input
| Argument Name | Description | Required |
|---|---|---|
| crypto | List of cryptocurrency addresses. | Optional |
| address_type | The cryptocurrency address type, if known. e.g. ‘bitcoin’. Possible values are: bitcoin. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| DBotScore.Indicator | string | The indicator that was tested. |
| DBotScore.Score | number | The actual score. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| Cryptocurrency.Address | string | The cryptocurrency address. |
| Cryptocurrency.AddressType | string | The cryptocurrency type. e.g. ‘bitcoin’. |
Command Example
!crypto crypto=bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i
Context Example
{
"Cryptocurrency": {
"Address": "bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i",
"AddressType": "bitcoin"
},
"DBotScore": {
"Indicator": "bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i",
"Reliability": "B - Usually reliable",
"Score": 2,
"Type": "cryptocurrency",
"Vendor": "Cryptocurrency"
}
}
Human Readable Output
Cryptocurrency reputation for bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i
Address Cryptocurrency Address Type Reputation bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i bitcoin Suspicious
Configuration parameters
reliability— Source Reliabilityreputation— Reputation
Commands (1)
-
cryptoReturn Cryptocurrency reputation.
import demistomock as demisto import urllib3 from CommonServerPython import * # Disable insecure warnings urllib3.disable_warnings() """ CONSTANTS """ DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" BITCOIN = "bitcoin" INTEGRATION_NAME = "Cryptocurrency" SCORE = { "None": 0, "Good": 1, "Suspicious": 2, "Bad": 3, } def get_bitcoin_reputation(addresses, reliability, reputation, score) -> list[CommandResults]: command_results: list[CommandResults] = [] for address in addresses: dbot_score = Common.DBotScore( indicator=address, indicator_type=DBotScoreType.CRYPTOCURRENCY, integration_name=INTEGRATION_NAME, # Vendor score=score, reliability=reliability, ) crypto_context = Common.Cryptocurrency( address=address, address_type=BITCOIN, dbot_score=dbot_score, ) table_data = { "Address": address, "Cryptocurrency Address Type": BITCOIN, "Reputation": reputation, } table_name = f"{INTEGRATION_NAME} reputation for {address}" hr = tableToMarkdown(table_name, table_data) command_results.append( CommandResults( outputs_prefix="Cryptocurrency", readable_output=hr, outputs_key_field="Address", indicator=crypto_context, ) ) return command_results def crypto_reputation_command(args: dict[str, str], reliability: str, reputation: str): crypto_addresses = argToList(args.get("crypto", "")) # For cases the command was executed by a playbook/user and the addresses received are verified # Stripping the `bitcoin` prefix from the given addresses (if exists) then add it to match the convention. if args.get("address_type") == BITCOIN: bitcoin_addresses = [f'bitcoin:{address.lstrip("bitcoin:")}' for address in crypto_addresses] # noqa: B005 else: bitcoin_addresses = [address for address in crypto_addresses if BITCOIN in address] score = SCORE[reputation] result = get_bitcoin_reputation(bitcoin_addresses, reliability, reputation, score) return result def main(): params = demisto.params() reliability = params["reliability"] reputation = params["reputation"] demisto.info(f"Command being called is {demisto.command()}") try: if demisto.command() == "test-module": return_results("ok") elif demisto.command() == "crypto": return_results(crypto_reputation_command(demisto.args(), reliability, reputation)) # Log exceptions and return errors except Exception as e: return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()