CyberTotal

CyberTotal is a cloud-based threat intelligence service developed by CyCraft.

Data Enrichment & Threat Intelligence · CyberTotal

Details

IDCyberTotal
ProviderCyCraft Technology
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

CyberTotal is a cloud-based threat intelligence service developed by CyCraft.
This integration was integrated and tested with version 1.6.4 of CyberTotal

Configure CyberTotal in Cortex

Parameter Description Required
url CyberTotal URL True
token CyberTotal API Token True
feed Fetch indicators False
threshold_ip Bad ip threshold False
threshold_file Bad hash threshold False
threshold_domain Bad domain threshold False
threshold_url Bad url threshold False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP information and reputation

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required
threshold If the IP has reputation above the threshold then the IP defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.IP.scan_date date Scan date format: ISO 8601
CyberTotal.IP.resource string The scan target sent to CyberTotal.
CyberTotal.IP.task_id string The unique id of each scan in CyberTotal.
CyberTotal.IP.permalink string The link of this IP’s report in CyberTotal.
CyberTotal.IP.severity number Severity of this IP. The range is from 0 to 10.
CyberTotal.IP.confidence number Confidence of this IP. The range is from 0 to 10.
CyberTotal.IP.threat string Threat of this IP, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.IP.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.IP.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.IP.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.IP.message string Message about this search.
IP.Address String IP address
IP.DetectionEngines Number The total number of engines that checked the indicator.
IP.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!ip ip=1.1.1.1

Context Example

{
    "CyberTotal": {
        "IP": {
            "confidence": 3,
            "detection_engines": 87,
            "detection_ratio": "4/87",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d",
            "positive_detections": 4,
            "resource": "1.1.1.1",
            "scan_date": "2020-07-28T14:11:19+00:00",
            "severity": 9,
            "task_id": "5a2601d575ea44058efeb1aba995dc8d",
            "threat": "High"
        }
    },
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 1,
        "Type": "ip",
        "Vendor": "CyberTotal"
    },
    "IP": {
        "Address": "1.1.1.1",
        "DetectionEngines": 87,
        "PositiveDetections": 4
    }
}

Human Readable Output

IP List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
3 87 4/87 search success https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d 4 1.1.1.1 2020-07-28T14:11:19+00:00 9 5a2601d575ea44058efeb1aba995dc8d High

file

Return file’s information and reputation

Base Command

file

Input

Argument Name Description Required
file list of hash(s). Required
threshold If the HASH has reputation above the threshold then the HASH defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.File.scan_date date Scan date format: ISO 8601
CyberTotal.File.resource string The scan target sent to CyberTotal.
CyberTotal.File.task_id string The unique id of each scan in CyberTotal.
CyberTotal.File.permalink string The link of this HASH’s report in CyberTotal.
CyberTotal.File.severity number Severity of this HASH. The range is from 0 to 10.
CyberTotal.File.confidence number Confidence of this HASH. The range is from 0 to 10.
CyberTotal.File.threat string Threat of this HASH, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.File.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.File.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.File.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.File.message string Message about this search.
CyberTotal.File.size string Size of this file.
CyberTotal.File.md5 string This file’s md5 value.
CyberTotal.File.sha1 string This file’s sha1 value.
CyberTotal.File.sha256 string This file’s sha256 value.
CyberTotal.File.extension string This file’s extension type.
CyberTotal.File.name string This file’s name, separated by ‘,’ if more than 2 names.
File.MD5 String The MD5 hash of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA1 hash of the file.
File.Name String The full file name (including file extension).
File.Extension String The file extension, for example: ‘xls’.
File.Size Number The size of the file in bytes.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!file file=b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e

Context Example

{
    "CyberTotal": {
        "File": {
            "confidence": 10,
            "detection_engines": 70,
            "detection_ratio": "58/70",
            "extension": "exe",
            "md5": "19063b2a1b1a7930aef31678903b7088",
            "message": "search success",
            "name": "19063b2a1b1a7930aef31678903b7088.virus",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/7a37a8d7a32847c9b3eee5a4431c9ab5",
            "positive_detections": 58,
            "resource": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
            "scan_date": "2020-07-09T15:11:56+00:00",
            "severity": 10,
            "sha1": "c771b33f4f3867f95721d0eceed5c4040c78d3ee",
            "sha256": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
            "size": "28672",
            "task_id": "7a37a8d7a32847c9b3eee5a4431c9ab5",
            "threat": "High"
        }
    },
    "DBotScore": {
        "Indicator": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
        "Score": 3,
        "Type": "file",
        "Vendor": "CyberTotal"
    },
    "File": {
        "Extension": "exe",
        "MD5": "19063b2a1b1a7930aef31678903b7088",
        "Malicious": {
            "Description": "CyberTotal returned reputation 58",
            "Vendor": "CyberTotal"
        },
        "Name": "19063b2a1b1a7930aef31678903b7088.virus",
        "SHA1": "c771b33f4f3867f95721d0eceed5c4040c78d3ee",
        "SHA256": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
        "Size": "28672"
    }
}

Human Readable Output

File List

confidence detection_engines detection_ratio extension md5 message name permalink positive_detections resource scan_date severity sha1 sha256 size task_id threat
10 70 58/70 exe 19063b2a1b1a7930aef31678903b7088 search success 19063b2a1b1a7930aef31678903b7088.virus https://cybertotal.cycraft.com/app/intelligence/7a37a8d7a32847c9b3eee5a4431c9ab5 58 b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e 2020-07-09T15:11:56+00:00 10 c771b33f4f3867f95721d0eceed5c4040c78d3ee b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e 28672 7a37a8d7a32847c9b3eee5a4431c9ab5 High

domain

Return domain information and reputation

Base Command

domain

Input

Argument Name Description Required
domain List of domains. Required
threshold If the domain has reputation above the threshold then the domain defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.Domain.scan_date date Scan date format: ISO 8601
CyberTotal.Domain.resource string The scan target sent to CyberTotal.
CyberTotal.Domain.permalink string The link of this domain’s report in CyberTotal.
CyberTotal.Domain.severity number Severity of this domain. The range is from 0 to 10.
CyberTotal.Domain.confidence number Confidence of this domain. The range is from 0 to 10.
CyberTotal.Domain.threat string Threat of this domain, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.Domain.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.Domain.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.Domain.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.Domain.message string Message about this search.
Domain.Name String The domain name, for example: “google.com”.
Domain.DetectionEngines Number The total number of engines that checked the indicator.
Domain.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!domain domain=abc.com

Context Example

{
    "CyberTotal": {
        "Domain": {
            "confidence": 7,
            "detection_engines": 79,
            "detection_ratio": "0/79",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d",
            "positive_detections": 0,
            "resource": "abc.com",
            "scan_date": "2020-06-18T03:19:48+00:00",
            "severity": 6,
            "task_id": "79ca1bd740564c36a7a4a78df5dc719d",
            "threat": "Medium"
        }
    },
    "DBotScore": {
        "Indicator": "abc.com",
        "Score": 0,
        "Type": "domain",
        "Vendor": "CyberTotal"
    },
    "Domain": {
        "DetectionEngines": 79,
        "Name": "abc.com"
    }
}

Human Readable Output

Domain List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
7 79 0/79 search success https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d 0 abc.com 2020-06-18T03:19:48+00:00 6 79ca1bd740564c36a7a4a78df5dc719d Medium

url

Return domain information and reputation

Base Command

url

Input

Argument Name Description Required
url List of url(s). Required
threshold If the URL has reputation above the threshold then the URL defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.URL.scan_date date Scan date format: ISO 8601
CyberTotal.URL.resource string The scan target sent to CyberTotal.
CyberTotal.URL.task_id string The unique id of each scan in CyberTotal.
CyberTotal.URL.permalink string The link of this URL’s report in CyberTotal.
CyberTotal.URL.severity number Severity of this URL. The range is from 0 to 10.
CyberTotal.URL.confidence number Confidence of this URL. The range is from 0 to 10.
CyberTotal.URL.threat string Threat of this URL, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.URL.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.URL.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.URL.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.URL.message string Message about this search.
URL.Data String The URL
URL.DetectionEngines String The total number of engines that checked the indicator.
URL.PositiveDetections String The number of engines that positively detected the indicator as malicious.
URL.Malicious.Vendor String The vendor reporting the URL as malicious.
URL.Malicious.Description String A description of the malicious URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!url url=http://abc.com

Context Example

{
    "CyberTotal": {
        "URL": {
            "confidence": 1,
            "detection_engines": 79,
            "detection_ratio": "0/79",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96",
            "positive_detections": 0,
            "resource": "http://abc.com",
            "scan_date": "2020-06-22T07:24:16+00:00",
            "severity": 5,
            "task_id": "61bbc65f5c034930b8a659c39e745d96",
            "threat": "Medium"
        }
    },
    "DBotScore": {
        "Indicator": "http://abc.com",
        "Score": 0,
        "Type": "url",
        "Vendor": "CyberTotal"
    },
    "URL": {
        "Data": "http://abc.com",
        "DetectionEngines": 79
    }
}

Human Readable Output

URL List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
1 79 0/79 search success https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96 0 http://abc.com 2020-06-22T07:24:16+00:00 5 61bbc65f5c034930b8a659c39e745d96 Medium

cybertotal-ip-whois

Return ip whois information

Base Command

cybertotal-ip-whois

Input

Argument Name Description Required
ip List of IP(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-IP.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-IP.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-IP.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-IP.message string Message about this search.
CyberTotal.WHOIS-IP.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-IP.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-IP.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-IP.status string Status of this IP
CyberTotal.WHOIS-IP.domain string Domain of this IP
CyberTotal.WHOIS-IP.domainMd5 string MD5 translation of CyberTotal.WHOIS-IP.domain
CyberTotal.WHOIS-IP.domainUnicode string Encode CyberTotal.WHOIS-IP.domain by using unicode
CyberTotal.WHOIS-IP.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-IP.registrarName string The name of registrar
CyberTotal.WHOIS-IP.registrarEmail string The email address of registrar
CyberTotal.WHOIS-IP.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-IP.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-IP.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-IP.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-IP.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-IP.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-IP.registrant.name string The name of registrant
CyberTotal.WHOIS-IP.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-IP.registrant.street string The street name of registrant
CyberTotal.WHOIS-IP.registrant.city string The location city of registrant
CyberTotal.WHOIS-IP.registrant.state string The location state name of registrant
CyberTotal.WHOIS-IP.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-IP.registrant.country string The country of registrant
CyberTotal.WHOIS-IP.registrant.address string The address of registrant
CyberTotal.WHOIS-IP.admin.name string The name of admin
CyberTotal.WHOIS-IP.admin.organization string The organization name of admin
CyberTotal.WHOIS-IP.admin.street string The street name of admin
CyberTotal.WHOIS-IP.admin.city string The location city of admin
CyberTotal.WHOIS-IP.admin.state string The location state name of admin
CyberTotal.WHOIS-IP.admin.zip string The post zip code of admin
CyberTotal.WHOIS-IP.admin.country string The country of admin
CyberTotal.WHOIS-IP.admin.address string The address of admin
CyberTotal.WHOIS-IP.technical.name string The name of technical
CyberTotal.WHOIS-IP.technical.organization string The organization name of technical
CyberTotal.WHOIS-IP.technical.street string The street name of technical
CyberTotal.WHOIS-IP.technical.city string The location city of technical
CyberTotal.WHOIS-IP.technical.state string The location state name of technical
CyberTotal.WHOIS-IP.technical.zip string The post zip code of technical
CyberTotal.WHOIS-IP.technical.country string The country of technical
CyberTotal.WHOIS-IP.technical.address string The address of technical
CyberTotal.WHOIS-IP.contactEmails string An array of all contact email address
CyberTotal.WHOIS-IP.contacts string An array of all contact details
CyberTotal.WHOIS-IP.contactNames string An array of all contact names
CyberTotal.WHOIS-IP.contactCountries string An array of all contact countries
CyberTotal.WHOIS-IP.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-IP.expired boolean If this IP is expired

Command Example

!cybertotal-ip-whois ip=1.1.1.1

Context Example

{
    "CyberTotal": {
        "WHOIS-IP": {
            "abuse": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "xxx@xxx.net",
                "id": 0,
                "name": "IRT-APNICRANDNET-AU",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "admin": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "research@apnic.net",
                "fax": "+61-7-3858-3199",
                "id": 0,
                "name": "APNIC RESEARCH",
                "phone": "+61-7-3858-3188",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "auditCreatedAt": "2020-07-18T02:07:02+00:00",
            "auditUpdatedAt": "2020-07-18T02:07:02+00:00",
            "compositeParseCode": 10528,
            "contactCountries": [
                "australia"
            ],
            "contactEmails": [
                "research@apnic.net"
            ],
            "contactNames": [
                "APNIC RESEARCH"
            ],
            "contactOrganizations": [],
            "contacts": [
                {
                    "address": "po box 3646\n4101\nqld\naustralia\n",
                    "country": "australia",
                    "email": "research@apnic.net",
                    "fax": "+61-7-3858-3199",
                    "id": 0,
                    "name": "APNIC RESEARCH",
                    "phone": "+61-7-3858-3188",
                    "state": "qld",
                    "street": "po box 3646",
                    "whoisContactID": 0,
                    "zip": "4101"
                }
            ],
            "createdAt": "2020-07-18T02:07:02+00:00",
            "domain": "1.1.1.0",
            "domainAvailable": false,
            "domainMd5": "ede514d996ecdf82a0abf5356ff6a13c",
            "domainUnicode": "1.1.1.0",
            "expired": false,
            "id": 6690074356934458000,
            "message": "search success",
            "nameservers": [],
            "netRange": {
                "ipEnd": "1.1.1.255",
                "ipStart": "1.1.1.0",
                "netName": "APNIC-LABS",
                "netRange": "1.1.1.0 - 1.1.1.255",
                "numericEnd": 16843263,
                "numericStart": 16843008,
                "status": "INACTIVE",
                "whoisNetRangeID": 0
            },
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d"
            ],
            "registrarName": "APNIC",
            "registrarParseCode": 10528,
            "registrarUpdatedAt": "2020-07-15T13:10:57+00:00",
            "resource": [
                "1.1.1.1"
            ],
            "scan_date": [
                "2020-07-28 14:11:19"
            ],
            "status": "ACTIVE",
            "task_id": "5a2601d575ea44058efeb1aba995dc8d",
            "technical": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "research@apnic.net",
                "fax": "+61-7-3858-3199",
                "id": 0,
                "name": "APNIC RESEARCH",
                "phone": "+61-7-3858-3188",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "tld": "ipv4",
            "updatedAt": "2020-07-18T02:07:02+00:00",
            "whoisID": 6690074356934458000,
            "whoisServer": "rdap.apnic.net"
        }
    }
}

Human Readable Output

Results

abuse admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainUnicode expired id message nameservers netRange noRecord permalink registrarName registrarParseCode registrarUpdatedAt resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: IRT-APNICRANDNET-AU
street: po box 3646
state: qld
zip: 4101
country: australia
address: po box 3646
4101
qld
australia

id: 0		 whoisContactID: 0
email: research@apnic.net
name: APNIC RESEARCH
street: po box 3646
state: qld
zip: 4101
country: australia
phone: +61-7-3858-3188
fax: +61-7-3858-3199
address: po box 3646
4101
qld
australia

id: 0		 2020-07-18T02:07:02+00:00 2020-07-18T02:07:02+00:00 10528 australia research@apnic.net APNIC RESEARCH   {‘whoisContactID’: 0, ‘email’: ‘research@apnic.net’, ‘name’: ‘APNIC RESEARCH’, ‘street’: ‘po box 3646’, ‘state’: ‘qld’, ‘zip’: ‘4101’, ‘country’: ‘australia’, ‘phone’: ‘+61-7-3858-3188’, ‘fax’: ‘+61-7-3858-3199’, ‘address’: ‘po box 3646\n4101\nqld\naustralia\n’, ‘id’: 0} 2020-07-18T02:07:02+00:00 1.1.1.0 false ede514d996ecdf82a0abf5356ff6a13c 1.1.1.0 false 6690074356934458403 search success   status: INACTIVE
whoisNetRangeID: 0
netRange: 1.1.1.0 - 1.1.1.255
netName: APNIC-LABS
ipStart: 1.1.1.0
ipEnd: 1.1.1.255
numericEnd: 16843263
numericStart: 16843008		 false [“https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d”] APNIC 10528 2020-07-15T13:10:57+00:00 [“1.1.1.1”] [“2020-07-28 14:11:19”] ACTIVE 5a2601d575ea44058efeb1aba995dc8d whoisContactID: 0
email: research@apnic.net
name: APNIC RESEARCH
street: po box 3646
state: qld
zip: 4101
country: australia
phone: +61-7-3858-3188
fax: +61-7-3858-3199
address: po box 3646
4101
qld
australia

id: 0		 ipv4 2020-07-18T02:07:02+00:00 6690074356934458403 rdap.apnic.net

cybertotal-url-whois

Return url whois information

Base Command

cybertotal-url-whois

Input

Argument Name Description Required
url List of URL(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-URL.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-URL.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-URL.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-URL.message string Message about this search.
CyberTotal.WHOIS-URL.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-URL.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-URL.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-URL.status string Status of this IP
CyberTotal.WHOIS-URL.domain string Domain of this IP
CyberTotal.WHOIS-URL.domainMd5 string MD5 translation of CyberTotal.WHOIS-URL.domain
CyberTotal.WHOIS-URL.domainUnicode string Encode CyberTotal.WHOIS-URL.domain by using unicode
CyberTotal.WHOIS-URL.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-URL.registrarName string The name of registrar
CyberTotal.WHOIS-URL.registrarEmail string The email address of registrar
CyberTotal.WHOIS-URL.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-URL.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-URL.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-URL.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-URL.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-URL.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-URL.registrant.name string The name of registrant
CyberTotal.WHOIS-URL.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-URL.registrant.street string The street name of registrant
CyberTotal.WHOIS-URL.registrant.city string The location city of registrant
CyberTotal.WHOIS-URL.registrant.state string The location state name of registrant
CyberTotal.WHOIS-URL.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-URL.registrant.country string The country of registrant
CyberTotal.WHOIS-URL.registrant.address string The address of registrant
CyberTotal.WHOIS-URL.admin.name string The name of admin
CyberTotal.WHOIS-URL.admin.organization string The organization name of admin
CyberTotal.WHOIS-URL.admin.street string The street name of admin
CyberTotal.WHOIS-URL.admin.city string The location city of admin
CyberTotal.WHOIS-URL.admin.state string The location state name of admin
CyberTotal.WHOIS-URL.admin.zip string The post zip code of admin
CyberTotal.WHOIS-URL.admin.country string The country of admin
CyberTotal.WHOIS-URL.admin.address string The address of admin
CyberTotal.WHOIS-URL.technical.name string The name of technical
CyberTotal.WHOIS-URL.technical.organization string The organization name of technical
CyberTotal.WHOIS-URL.technical.street string The street name of technical
CyberTotal.WHOIS-URL.technical.city string The location city of technical
CyberTotal.WHOIS-URL.technical.state string The location state name of technical
CyberTotal.WHOIS-URL.technical.zip string The post zip code of technical
CyberTotal.WHOIS-URL.technical.country string The country of technical
CyberTotal.WHOIS-URL.technical.address string The address of technical
CyberTotal.WHOIS-URL.contactEmails string An array of all contact email address
CyberTotal.WHOIS-URL.contacts string An array of all contact details
CyberTotal.WHOIS-URL.contactNames string An array of all contact names
CyberTotal.WHOIS-URL.contactCountries string An array of all contact countries
CyberTotal.WHOIS-URL.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-URL.expired boolean If this URL is expired

Command Example

!cybertotal-url-whois url=http://abc.com

Context Example

{
    "CyberTotal": {
        "WHOIS-URL": {
            "admin": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "auditCreatedAt": "2020-04-09T07:17:45+00:00",
            "auditUpdatedAt": "2020-04-09T07:17:45+00:00",
            "compositeParseCode": 3579,
            "contactCountries": [
                "US"
            ],
            "contactEmails": [
                "corp.dns.domains@testcorp.com"
            ],
            "contactNames": [
                "ABC, Inc.; Domain Administrator"
            ],
            "contactOrganizations": [
                "ABC, Inc."
            ],
            "contacts": [
                {
                    "address": "New York\n10023-6298\nNY\nUS\n",
                    "city": "New York",
                    "country": "US",
                    "email": "xxx@xxx.net",
                    "fax": "18182384694",
                    "id": 0,
                    "name": "ABC, Inc.; Domain Administrator",
                    "organization": "ABC, Inc.",
                    "phone": "18182384694",
                    "state": "NY",
                    "whoisContactID": 0,
                    "zip": "10023-6298"
                }
            ],
            "createdAt": "2020-04-09T07:17:45+00:00",
            "domain": "abc.com",
            "domainAvailable": false,
            "domainMd5": "929ba26f492f86d4a9d66a080849865a",
            "domainStatus": "clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited",
            "domainUnicode": "abc.com",
            "expired": false,
            "id": 6653913764397840000,
            "message": "search success",
            "nameservers": [
                "ns-1368.awsdns-43.org",
                "ns-1869.awsdns-41.co.uk",
                "ns-318.awsdns-39.com",
                "ns-736.awsdns-28.net"
            ],
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96"
            ],
            "registrant": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "registrarCreatedAt": "1996-05-22T04:00:00+00:00",
            "registrarEmail": "domainabuse@cscglobal.com",
            "registrarExpiresAt": "2021-05-23T04:00:00+00:00",
            "registrarIanaID": 299,
            "registrarName": "CSC Corporate Domains, Inc.",
            "registrarParseCode": 3579,
            "registrarPhone": "+1.8887802723",
            "registrarUpdatedAt": "2020-04-08T07:06:06+00:00",
            "registryParseCode": 251,
            "resource": [
                "http://abc.com"
            ],
            "scan_date": [
                "2020-06-22 07:24:16"
            ],
            "status": "ACTIVE",
            "task_id": "61bbc65f5c034930b8a659c39e745d96",
            "technical": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "tld": "com",
            "updatedAt": "2020-04-09T07:17:45+00:00",
            "whoisID": 6653913764397840000,
            "whoisServer": "whois.corporatedomains.com"
        }
    }
}

Human Readable Output

Results

admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainStatus domainUnicode expired id message nameservers noRecord permalink registrant registrarCreatedAt registrarEmail registrarExpiresAt registrarIanaID registrarName registrarParseCode registrarPhone registrarUpdatedAt registryParseCode resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 2020-04-09T07:17:45+00:00 2020-04-09T07:17:45+00:00 3579 US corp.dns.domains@testcorp.com ABC, Inc.; Domain Administrator ABC, Inc. {‘whoisContactID’: 0, ‘email’: ‘xxx@xxx.net’, ‘name’: ‘ABC, Inc.; Domain Administrator’, ‘organization’: ‘ABC, Inc.’, ‘city’: ‘New York’, ‘state’: ‘NY’, ‘zip’: ‘10023-6298’, ‘country’: ‘US’, ‘phone’: ‘18182384694’, ‘fax’: ‘18182384694’, ‘address’: ‘New York\n10023-6298\nNY\nUS\n’, ‘id’: 0} 2020-04-09T07:17:45+00:00 abc.com false 929ba26f492f86d4a9d66a080849865a clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited abc.com false 6653913764397840884 search success ns-1368.awsdns-43.org,
ns-1869.awsdns-41.co.uk,
ns-318.awsdns-39.com,
ns-736.awsdns-28.net		 false [“https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96”] whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 1996-05-22T04:00:00+00:00 domainabuse@cscglobal.com 2021-05-23T04:00:00+00:00 299 CSC Corporate Domains, Inc. 3579 +1.8887802723 2020-04-08T07:06:06+00:00 251 [“http://abc.com”] [“2020-06-22 07:24:16”] ACTIVE 61bbc65f5c034930b8a659c39e745d96 whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 com 2020-04-09T07:17:45+00:00 6653913764397840884 whois.corporatedomains.com

cybertotal-domain-whois

Return domain whois information

Base Command

cybertotal-domain-whois

Input

Argument Name Description Required
domain List of domain(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-Domain.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-Domain.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-Domain.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-Domain.message string Message about this search.
CyberTotal.WHOIS-Domain.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-Domain.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-Domain.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-Domain.status string Status of this Domain
CyberTotal.WHOIS-Domain.domain string Top level Domain of this domain
CyberTotal.WHOIS-Domain.domainMd5 string MD5 translation of CyberTotal.WHOIS-Domain.domain
CyberTotal.WHOIS-Domain.domainUnicode string Encode CyberTotal.WHOIS-Domain.domain by using unicode
CyberTotal.WHOIS-Domain.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-Domain.registrarName string The name of registrar
CyberTotal.WHOIS-Domain.registrarEmail string The email address of registrar
CyberTotal.WHOIS-Domain.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-Domain.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-Domain.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-Domain.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-Domain.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-Domain.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-Domain.registrant.name string The name of registrant
CyberTotal.WHOIS-Domain.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-Domain.registrant.street string The street name of registrant
CyberTotal.WHOIS-Domain.registrant.city string The location city of registrant
CyberTotal.WHOIS-Domain.registrant.state string The location state name of registrant
CyberTotal.WHOIS-Domain.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-Domain.registrant.country string The country of registrant
CyberTotal.WHOIS-Domain.registrant.address string The address of registrant
CyberTotal.WHOIS-Domain.admin.name string The name of admin
CyberTotal.WHOIS-Domain.admin.organization string The organization name of admin
CyberTotal.WHOIS-Domain.admin.street string The street name of admin
CyberTotal.WHOIS-Domain.admin.city string The location city of admin
CyberTotal.WHOIS-Domain.admin.state string The location state name of admin
CyberTotal.WHOIS-Domain.admin.zip string The post zip code of admin
CyberTotal.WHOIS-Domain.admin.country string The country of admin
CyberTotal.WHOIS-Domain.admin.address string The address of admin
CyberTotal.WHOIS-Domain.technical.name string The name of technical
CyberTotal.WHOIS-Domain.technical.organization string The organization name of technical
CyberTotal.WHOIS-Domain.technical.street string The street name of technical
CyberTotal.WHOIS-Domain.technical.city string The location city of technical
CyberTotal.WHOIS-Domain.technical.state string The location state name of technical
CyberTotal.WHOIS-Domain.technical.zip string The post zip code of technical
CyberTotal.WHOIS-Domain.technical.country string The country of technical
CyberTotal.WHOIS-Domain.technical.address string The address of technical
CyberTotal.WHOIS-Domain.contactEmails string An array of all contact email address
CyberTotal.WHOIS-Domain.contacts string An array of all contact details
CyberTotal.WHOIS-Domain.contactNames string An array of all contact names
CyberTotal.WHOIS-Domain.contactCountries string An array of all contact countries
CyberTotal.WHOIS-Domain.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-Domain.expired boolean If this domain is expired

Command Example

!cybertotal-domain-whois domain=abc.com

Context Example

{
    "CyberTotal": {
        "WHOIS-Domain": {
            "admin": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "auditCreatedAt": "2020-04-09T07:17:45+00:00",
            "auditUpdatedAt": "2020-04-09T07:17:45+00:00",
            "compositeParseCode": 3579,
            "contactCountries": [
                "US"
            ],
            "contactEmails": [
                "corp.dns.domains@testcorp.com"
            ],
            "contactNames": [
                "ABC, Inc.; Domain Administrator"
            ],
            "contactOrganizations": [
                "ABC, Inc."
            ],
            "contacts": [
                {
                    "address": "New York\n10023-6298\nNY\nUS\n",
                    "city": "New York",
                    "country": "US",
                    "email": "xxx@xxx.net",
                    "fax": "18182384694",
                    "id": 0,
                    "name": "ABC, Inc.; Domain Administrator",
                    "organization": "ABC, Inc.",
                    "phone": "18182384694",
                    "state": "NY",
                    "whoisContactID": 0,
                    "zip": "10023-6298"
                }
            ],
            "createdAt": "2020-04-09T07:17:45+00:00",
            "domain": "abc.com",
            "domainAvailable": false,
            "domainMd5": "929ba26f492f86d4a9d66a080849865a",
            "domainStatus": "clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited",
            "domainUnicode": "abc.com",
            "expired": false,
            "id": 6653913764397840000,
            "message": "search success",
            "nameservers": [
                "ns-1368.awsdns-43.org",
                "ns-1869.awsdns-41.co.uk",
                "ns-318.awsdns-39.com",
                "ns-736.awsdns-28.net"
            ],
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d"
            ],
            "registrant": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "registrarCreatedAt": "1996-05-22T04:00:00+00:00",
            "registrarEmail": "domainabuse@cscglobal.com",
            "registrarExpiresAt": "2021-05-23T04:00:00+00:00",
            "registrarIanaID": 299,
            "registrarName": "CSC Corporate Domains, Inc.",
            "registrarParseCode": 3579,
            "registrarPhone": "+1.8887802723",
            "registrarUpdatedAt": "2020-04-08T07:06:06+00:00",
            "registryParseCode": 251,
            "resource": [
                "abc.com"
            ],
            "scan_date": [
                "2020-06-18 03:19:48"
            ],
            "status": "ACTIVE",
            "task_id": "79ca1bd740564c36a7a4a78df5dc719d",
            "technical": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "tld": "com",
            "updatedAt": "2020-04-09T07:17:45+00:00",
            "whoisID": 6653913764397840000,
            "whoisServer": "whois.corporatedomains.com"
        }
    }
}

Human Readable Output

Results

admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainStatus domainUnicode expired id message nameservers noRecord permalink registrant registrarCreatedAt registrarEmail registrarExpiresAt registrarIanaID registrarName registrarParseCode registrarPhone registrarUpdatedAt registryParseCode resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 2020-04-09T07:17:45+00:00 2020-04-09T07:17:45+00:00 3579 US corp.dns.domains@testcorp.com ABC, Inc.; Domain Administrator ABC, Inc. {‘whoisContactID’: 0, ‘email’: ‘xxx@xxx.net’, ‘name’: ‘ABC, Inc.; Domain Administrator’, ‘organization’: ‘ABC, Inc.’, ‘city’: ‘New York’, ‘state’: ‘NY’, ‘zip’: ‘10023-6298’, ‘country’: ‘US’, ‘phone’: ‘18182384694’, ‘fax’: ‘18182384694’, ‘address’: ‘New York\n10023-6298\nNY\nUS\n’, ‘id’: 0} 2020-04-09T07:17:45+00:00 abc.com false 929ba26f492f86d4a9d66a080849865a clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited abc.com false 6653913764397840884 search success ns-1368.awsdns-43.org,
ns-1869.awsdns-41.co.uk,
ns-318.awsdns-39.com,
ns-736.awsdns-28.net		 false [“https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d”] whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 1996-05-22T04:00:00+00:00 domainabuse@cscglobal.com 2021-05-23T04:00:00+00:00 299 CSC Corporate Domains, Inc. 3579 +1.8887802723 2020-04-08T07:06:06+00:00 251 [“abc.com”] [“2020-06-18 03:19:48”] ACTIVE 79ca1bd740564c36a7a4a78df5dc719d whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 com 2020-04-09T07:17:45+00:00 6653913764397840884 whois.corporatedomains.com

Configuration parameters

  • url — CyberTotal URL (required)
  • token — CyberTotal API Token (required)
  • feed — Fetch indicators
  • threshold_ip — Bad ip threshold
  • threshold_file — Bad hash threshold
  • threshold_domain — Bad domain threshold
  • threshold_url — Bad url threshold
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (7)

  • cybertotal-domain-whois

    Return domain whois information.

  • cybertotal-ip-whois

    Return ip whois information.

  • cybertotal-url-whois

    Return url whois information.

  • domain

    Return domain information and reputation.

  • file

    Return file's information and reputation.

  • ip

    Return IP information and reputation.

  • url

    Return domain information and reputation.

Source

CyberTotal.py CyberTotal_test.py CyberTotal.yml CyberTotal_description.md command_examples.txt
Download History Raw 
commonfields:
  id: CyberTotal
  version: -1
name: CyberTotal
display: CyberTotal
category: Data Enrichment & Threat Intelligence
provider: CyCraft Technology
description: CyberTotal is a cloud-based threat intelligence service developed by CyCraft.
configuration:
- display: CyberTotal URL
  name: url
  defaultvalue: https://cybertotal.cycraft.com
  type: 0
  required: true
- display: CyberTotal API Token
  name: token
  defaultvalue: ""
  type: 4
  required: true
  additionalinfo: A necessary token is a credential, used for CyberTotal API.
- display: Fetch indicators
  name: feed
  type: 8
  required: false
- display: Bad ip threshold
  name: threshold_ip
  defaultvalue: "10"
  type: 0
  required: false
- display: Bad hash threshold
  name: threshold_file
  defaultvalue: "10"
  type: 0
  required: false
- display: Bad domain threshold
  name: threshold_domain
  defaultvalue: "10"
  type: 0
  required: false
- display: Bad url threshold
  name: threshold_url
  defaultvalue: "10"
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: python
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: List of IPs.
      isArray: true
    - name: threshold
      description: If the IP has reputation above the threshold then the IP defined as malicious. If threshold not set, then threshold from instance configuration is used.
      defaultValue: "10"
    outputs:
    - contextPath: CyberTotal.IP.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.IP.resource
      description: ' The scan target sent to CyberTotal.'
      type: string
    - contextPath: CyberTotal.IP.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.IP.permalink
      description: The link of this IP’s report in CyberTotal.
      type: string
    - contextPath: CyberTotal.IP.severity
      description: Severity of this IP. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.IP.confidence
      description: Confidence of this IP. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.IP.threat
      description: Threat of this IP, which is a select from ‘High’, ‘Medium’ and ‘Low’.
      type: string
    - contextPath: CyberTotal.IP.detection_engines
      description: The number of all antivirus vendors scanned.
      type: number
    - contextPath: CyberTotal.IP.positive_detections
      description: The number of antivirus vendors scanned with positive detection.
      type: number
    - contextPath: CyberTotal.IP.detection_ratio
      description: The ratio of positive_detections and detection_engines.
      type: string
    - contextPath: CyberTotal.IP.message
      description: Message about this search.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: Number
    - contextPath: IP.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: Number
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Return IP information and reputation.
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: list of hash(s).
      isArray: true
    - name: threshold
      description: If the HASH has reputation above the threshold then the HASH defined as malicious. If threshold not set, then threshold from instance configuration is used.
      defaultValue: "10"
    outputs:
    - contextPath: CyberTotal.File.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.File.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.File.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.File.permalink
      description: The link of this HASH’s report in CyberTotal.
      type: string
    - contextPath: CyberTotal.File.severity
      description: Severity of this HASH. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.File.confidence
      description: Confidence of this HASH. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.File.threat
      description: Threat of this HASH, which is a select from ‘High’, ‘Medium’ and ‘Low’.
      type: string
    - contextPath: CyberTotal.File.detection_engines
      description: The number of all antivirus vendors scanned.
      type: number
    - contextPath: CyberTotal.File.positive_detections
      description: The number of antivirus vendors scanned with positive detection.
      type: number
    - contextPath: CyberTotal.File.detection_ratio
      description: The ratio of positive_detections and detection_engines.
      type: string
    - contextPath: CyberTotal.File.message
      description: Message about this search.
      type: string
    - contextPath: CyberTotal.File.size
      description: Size of this file.
      type: string
    - contextPath: CyberTotal.File.md5
      description: This file’s md5 value.
      type: string
    - contextPath: CyberTotal.File.sha1
      description: This file’s sha1 value.
      type: string
    - contextPath: CyberTotal.File.sha256
      description: This file’s sha256 value.
      type: string
    - contextPath: CyberTotal.File.extension
      description: This file’s extension type.
      type: string
    - contextPath: CyberTotal.File.name
      description: This file’s name, separated by ‘,’ if more than 2 names.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Extension
      description: "The file extension, for example: 'xls'."
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Return file's information and reputation.
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      description: List of domains.
      isArray: true
    - name: threshold
      description: If the domain has reputation above the threshold then the domain defined as malicious. If threshold not set, then threshold from instance configuration is used.
      defaultValue: "10"
    outputs:
    - contextPath: CyberTotal.Domain.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.Domain.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.Domain.permalink
      description: The link of this domain’s report in CyberTotal.
      type: string
    - contextPath: CyberTotal.Domain.severity
      description: Severity of this domain. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.Domain.confidence
      description: Confidence of this domain. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.Domain.threat
      description: Threat of this domain, which is a select from ‘High’, ‘Medium’ and ‘Low’.
      type: string
    - contextPath: CyberTotal.Domain.detection_engines
      description: The number of all antivirus vendors scanned.
      type: number
    - contextPath: CyberTotal.Domain.positive_detections
      description: The number of antivirus vendors scanned with positive detection.
      type: number
    - contextPath: CyberTotal.Domain.detection_ratio
      description: The ratio of positive_detections and detection_engines.
      type: string
    - contextPath: CyberTotal.Domain.message
      description: Message about this search.
      type: string
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: Domain.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: Number
    - contextPath: Domain.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: Number
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Return domain information and reputation.
  - name: url
    arguments:
    - name: url
      required: true
      default: true
      description: List of url(s).
      isArray: true
    - name: threshold
      description: If the URL has reputation above the threshold then the URL defined as malicious. If threshold not set, then threshold from instance configuration is used.
      defaultValue: "10"
    outputs:
    - contextPath: CyberTotal.URL.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.URL.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.URL.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.URL.permalink
      description: The link of this URL’s report in CyberTotal.
      type: string
    - contextPath: CyberTotal.URL.severity
      description: Severity of this URL. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.URL.confidence
      description: Confidence of this URL. The range is from 0 to 10.
      type: number
    - contextPath: CyberTotal.URL.threat
      description: Threat of this URL, which is a select from ‘High’, ‘Medium’ and ‘Low’.
      type: string
    - contextPath: CyberTotal.URL.detection_engines
      description: The number of all antivirus vendors scanned.
      type: number
    - contextPath: CyberTotal.URL.positive_detections
      description: The number of antivirus vendors scanned with positive detection.
      type: number
    - contextPath: CyberTotal.URL.detection_ratio
      description: The ratio of positive_detections and detection_engines.
      type: string
    - contextPath: CyberTotal.URL.message
      description: Message about this search.
      type: string
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: String
    - contextPath: URL.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Return domain information and reputation.
  - name: cybertotal-ip-whois
    arguments:
    - name: ip
      required: true
      default: true
      description: List of IP(s).
      isArray: true
    outputs:
    - contextPath: CyberTotal.WHOIS-IP.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.message
      description: Message about this search.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.permalink
      description: The link of this whois report in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.createdAt
      description: 'Create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.updatedAt
      description: 'Update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.status
      description: Status of this IP.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.domain
      description: Domain of this IP.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.domainMd5
      description: MD5 translation of CyberTotal.WHOIS-IP.domain
      type: string
    - contextPath: CyberTotal.WHOIS-IP.domainUnicode
      description: Encode CyberTotal.WHOIS-IP.domain by using unicode.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.nameservers
      description: An array of all DNS nameservers.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrarName
      description: The name of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrarEmail
      description: The email address of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrarPhone
      description: The phone number of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrarCreatedAt
      description: 'Registrar create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.registrarUpdatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.registrarExpiresAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.auditCreatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.auditUpdatedAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-IP.registrant.name
      description: The name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.organization
      description: The organization name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.street
      description: The street name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.city
      description: The location city of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.state
      description: The location state name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.zip
      description: The post zip code of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.country
      description: The country of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.registrant.address
      description: The address of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.name
      description: The name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.organization
      description: The organization name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.street
      description: The street name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.city
      description: The location city of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.state
      description: The location state name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.zip
      description: The post zip code of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.country
      description: The country of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.admin.address
      description: The address of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.name
      description: The name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.organization
      description: The organization name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.street
      description: The street name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.city
      description: The location city of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.state
      description: The location state name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.zip
      description: The post zip code of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.country
      description: The country of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.technical.address
      description: The address of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.contactEmails
      description: An array of all contact email address.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.contacts
      description: An array of all contact details.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.contactNames
      description: An array of all contact names.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.contactCountries
      description: An array of all contact countries.
      type: string
    - contextPath: CyberTotal.WHOIS-IP.domainAvailable
      description: If this domain is available.
      type: boolean
    - contextPath: CyberTotal.WHOIS-IP.expired
      description: If this IP is expired.
      type: boolean
    description: Return ip whois information.
  - name: cybertotal-url-whois
    arguments:
    - name: url
      required: true
      default: true
      description: List of URL(s).
      isArray: true
    outputs:
    - contextPath: CyberTotal.WHOIS-URL.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.message
      description: Message about this search.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.permalink
      description: The link of this whois report in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.createdAt
      description: 'Create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.updatedAt
      description: 'Update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.status
      description: Status of this IP.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.domain
      description: Domain of this IP.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.domainMd5
      description: MD5 translation of CyberTotal.WHOIS-URL.domain
      type: string
    - contextPath: CyberTotal.WHOIS-URL.domainUnicode
      description: Encode CyberTotal.WHOIS-URL.domain by using unicode.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.nameservers
      description: An array of all DNS nameservers.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrarName
      description: The name of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrarEmail
      description: The email address of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrarPhone
      description: The phone number of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrarCreatedAt
      description: 'Registrar create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.registrarUpdatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.registrarExpiresAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.auditCreatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.auditUpdatedAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-URL.registrant.name
      description: The name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.organization
      description: The organization name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.street
      description: The street name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.city
      description: The location city of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.state
      description: The location state name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.zip
      description: The post zip code of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.country
      description: The country of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.registrant.address
      description: The address of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.name
      description: The name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.organization
      description: The organization name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.street
      description: The street name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.city
      description: The location city of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.state
      description: The location state name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.zip
      description: The post zip code of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.country
      description: The country of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.admin.address
      description: The address of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.name
      description: The name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.organization
      description: The organization name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.street
      description: The street name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.city
      description: The location city of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.state
      description: The location state name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.zip
      description: The post zip code of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.country
      description: The country of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.technical.address
      description: The address of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.contactEmails
      description: An array of all contact email address.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.contacts
      description: An array of all contact details.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.contactNames
      description: An array of all contact names.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.contactCountries
      description: An array of all contact countries.
      type: string
    - contextPath: CyberTotal.WHOIS-URL.domainAvailable
      description: If this domain is available.
      type: boolean
    - contextPath: CyberTotal.WHOIS-URL.expired
      description: If this URL is expired.
      type: boolean
    description: Return url whois information.
  - name: cybertotal-domain-whois
    arguments:
    - name: domain
      required: true
      default: true
      description: List of domain(s).
      isArray: true
    outputs:
    - contextPath: CyberTotal.WHOIS-Domain.scan_date
      description: 'Scan date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.task_id
      description: The unique id of each scan in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.resource
      description: The scan target sent to CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.message
      description: Message about this search.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.permalink
      description: The link of this whois report in CyberTotal.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.createdAt
      description: 'Create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.updatedAt
      description: 'Update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.status
      description: Status of this Domain.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.domain
      description: Top level Domain of this domain.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.domainMd5
      description: MD5 translation of CyberTotal.WHOIS-Domain.domain
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.domainUnicode
      description: Encode CyberTotal.WHOIS-Domain.domain by using unicode.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.nameservers
      description: An array of all DNS nameservers.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrarName
      description: The name of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrarEmail
      description: The email address of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrarPhone
      description: The phone number of registrar.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrarCreatedAt
      description: 'Registrar create date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.registrarUpdatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.registrarExpiresAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.auditCreatedAt
      description: 'Registrar update date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.auditUpdatedAt
      description: 'Registrar expire date format: ISO 8601.'
      type: date
    - contextPath: CyberTotal.WHOIS-Domain.registrant.name
      description: The name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.organization
      description: The organization name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.street
      description: The street name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.city
      description: The location city of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.state
      description: The location state name of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.zip
      description: The post zip code of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.country
      description: The country of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.registrant.address
      description: The address of registrant.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.name
      description: The name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.organization
      description: The organization name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.street
      description: The street name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.city
      description: The location city of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.state
      description: The location state name of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.zip
      description: The post zip code of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.country
      description: The country of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.admin.address
      description: The address of admin.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.name
      description: The name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.organization
      description: The organization name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.street
      description: The street name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.city
      description: The location city of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.state
      description: The location state name of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.zip
      description: The post zip code of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.country
      description: The country of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.technical.address
      description: The address of technical.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.contactEmails
      description: An array of all contact email address.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.contacts
      description: An array of all contact details.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.contactNames
      description: An array of all contact names.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.contactCountries
      description: An array of all contact countries.
      type: string
    - contextPath: CyberTotal.WHOIS-Domain.domainAvailable
      description: If this domain is available.
      type: boolean
    - contextPath: CyberTotal.WHOIS-Domain.expired
      description: If this domain is expired.
      type: boolean
    description: Return domain whois information.
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)