CyberTotal

CyberTotal is a cloud-based threat intelligence service developed by CyCraft.

Data Enrichment & Threat Intelligence · CyberTotal

Details

IDCyberTotal
ProviderCyCraft Technology
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

CyberTotal is a cloud-based threat intelligence service developed by CyCraft.
This integration was integrated and tested with version 1.6.4 of CyberTotal

Configure CyberTotal in Cortex

Parameter Description Required
url CyberTotal URL True
token CyberTotal API Token True
feed Fetch indicators False
threshold_ip Bad ip threshold False
threshold_file Bad hash threshold False
threshold_domain Bad domain threshold False
threshold_url Bad url threshold False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP information and reputation

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required
threshold If the IP has reputation above the threshold then the IP defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.IP.scan_date date Scan date format: ISO 8601
CyberTotal.IP.resource string The scan target sent to CyberTotal.
CyberTotal.IP.task_id string The unique id of each scan in CyberTotal.
CyberTotal.IP.permalink string The link of this IP’s report in CyberTotal.
CyberTotal.IP.severity number Severity of this IP. The range is from 0 to 10.
CyberTotal.IP.confidence number Confidence of this IP. The range is from 0 to 10.
CyberTotal.IP.threat string Threat of this IP, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.IP.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.IP.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.IP.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.IP.message string Message about this search.
IP.Address String IP address
IP.DetectionEngines Number The total number of engines that checked the indicator.
IP.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!ip ip=1.1.1.1

Context Example

{
    "CyberTotal": {
        "IP": {
            "confidence": 3,
            "detection_engines": 87,
            "detection_ratio": "4/87",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d",
            "positive_detections": 4,
            "resource": "1.1.1.1",
            "scan_date": "2020-07-28T14:11:19+00:00",
            "severity": 9,
            "task_id": "5a2601d575ea44058efeb1aba995dc8d",
            "threat": "High"
        }
    },
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 1,
        "Type": "ip",
        "Vendor": "CyberTotal"
    },
    "IP": {
        "Address": "1.1.1.1",
        "DetectionEngines": 87,
        "PositiveDetections": 4
    }
}

Human Readable Output

IP List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
3 87 4/87 search success https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d 4 1.1.1.1 2020-07-28T14:11:19+00:00 9 5a2601d575ea44058efeb1aba995dc8d High

file

Return file’s information and reputation

Base Command

file

Input

Argument Name Description Required
file list of hash(s). Required
threshold If the HASH has reputation above the threshold then the HASH defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.File.scan_date date Scan date format: ISO 8601
CyberTotal.File.resource string The scan target sent to CyberTotal.
CyberTotal.File.task_id string The unique id of each scan in CyberTotal.
CyberTotal.File.permalink string The link of this HASH’s report in CyberTotal.
CyberTotal.File.severity number Severity of this HASH. The range is from 0 to 10.
CyberTotal.File.confidence number Confidence of this HASH. The range is from 0 to 10.
CyberTotal.File.threat string Threat of this HASH, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.File.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.File.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.File.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.File.message string Message about this search.
CyberTotal.File.size string Size of this file.
CyberTotal.File.md5 string This file’s md5 value.
CyberTotal.File.sha1 string This file’s sha1 value.
CyberTotal.File.sha256 string This file’s sha256 value.
CyberTotal.File.extension string This file’s extension type.
CyberTotal.File.name string This file’s name, separated by ‘,’ if more than 2 names.
File.MD5 String The MD5 hash of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA1 hash of the file.
File.Name String The full file name (including file extension).
File.Extension String The file extension, for example: ‘xls’.
File.Size Number The size of the file in bytes.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!file file=b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e

Context Example

{
    "CyberTotal": {
        "File": {
            "confidence": 10,
            "detection_engines": 70,
            "detection_ratio": "58/70",
            "extension": "exe",
            "md5": "19063b2a1b1a7930aef31678903b7088",
            "message": "search success",
            "name": "19063b2a1b1a7930aef31678903b7088.virus",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/7a37a8d7a32847c9b3eee5a4431c9ab5",
            "positive_detections": 58,
            "resource": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
            "scan_date": "2020-07-09T15:11:56+00:00",
            "severity": 10,
            "sha1": "c771b33f4f3867f95721d0eceed5c4040c78d3ee",
            "sha256": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
            "size": "28672",
            "task_id": "7a37a8d7a32847c9b3eee5a4431c9ab5",
            "threat": "High"
        }
    },
    "DBotScore": {
        "Indicator": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
        "Score": 3,
        "Type": "file",
        "Vendor": "CyberTotal"
    },
    "File": {
        "Extension": "exe",
        "MD5": "19063b2a1b1a7930aef31678903b7088",
        "Malicious": {
            "Description": "CyberTotal returned reputation 58",
            "Vendor": "CyberTotal"
        },
        "Name": "19063b2a1b1a7930aef31678903b7088.virus",
        "SHA1": "c771b33f4f3867f95721d0eceed5c4040c78d3ee",
        "SHA256": "b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e",
        "Size": "28672"
    }
}

Human Readable Output

File List

confidence detection_engines detection_ratio extension md5 message name permalink positive_detections resource scan_date severity sha1 sha256 size task_id threat
10 70 58/70 exe 19063b2a1b1a7930aef31678903b7088 search success 19063b2a1b1a7930aef31678903b7088.virus https://cybertotal.cycraft.com/app/intelligence/7a37a8d7a32847c9b3eee5a4431c9ab5 58 b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e 2020-07-09T15:11:56+00:00 10 c771b33f4f3867f95721d0eceed5c4040c78d3ee b5e8793b216cf2e63c47af4ac424ac9a77601405c131c32a2eaa22812306123e 28672 7a37a8d7a32847c9b3eee5a4431c9ab5 High

domain

Return domain information and reputation

Base Command

domain

Input

Argument Name Description Required
domain List of domains. Required
threshold If the domain has reputation above the threshold then the domain defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.Domain.scan_date date Scan date format: ISO 8601
CyberTotal.Domain.resource string The scan target sent to CyberTotal.
CyberTotal.Domain.permalink string The link of this domain’s report in CyberTotal.
CyberTotal.Domain.severity number Severity of this domain. The range is from 0 to 10.
CyberTotal.Domain.confidence number Confidence of this domain. The range is from 0 to 10.
CyberTotal.Domain.threat string Threat of this domain, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.Domain.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.Domain.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.Domain.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.Domain.message string Message about this search.
Domain.Name String The domain name, for example: “google.com”.
Domain.DetectionEngines Number The total number of engines that checked the indicator.
Domain.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!domain domain=abc.com

Context Example

{
    "CyberTotal": {
        "Domain": {
            "confidence": 7,
            "detection_engines": 79,
            "detection_ratio": "0/79",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d",
            "positive_detections": 0,
            "resource": "abc.com",
            "scan_date": "2020-06-18T03:19:48+00:00",
            "severity": 6,
            "task_id": "79ca1bd740564c36a7a4a78df5dc719d",
            "threat": "Medium"
        }
    },
    "DBotScore": {
        "Indicator": "abc.com",
        "Score": 0,
        "Type": "domain",
        "Vendor": "CyberTotal"
    },
    "Domain": {
        "DetectionEngines": 79,
        "Name": "abc.com"
    }
}

Human Readable Output

Domain List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
7 79 0/79 search success https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d 0 abc.com 2020-06-18T03:19:48+00:00 6 79ca1bd740564c36a7a4a78df5dc719d Medium

url

Return domain information and reputation

Base Command

url

Input

Argument Name Description Required
url List of url(s). Required
threshold If the URL has reputation above the threshold then the URL defined as malicious. If threshold not set, then threshold from instance configuration is used. Optional

Context Output

Path Type Description
CyberTotal.URL.scan_date date Scan date format: ISO 8601
CyberTotal.URL.resource string The scan target sent to CyberTotal.
CyberTotal.URL.task_id string The unique id of each scan in CyberTotal.
CyberTotal.URL.permalink string The link of this URL’s report in CyberTotal.
CyberTotal.URL.severity number Severity of this URL. The range is from 0 to 10.
CyberTotal.URL.confidence number Confidence of this URL. The range is from 0 to 10.
CyberTotal.URL.threat string Threat of this URL, which is a select from ‘High’, ‘Medium’ and ‘Low’.
CyberTotal.URL.detection_engines number The number of all antivirus vendors scanned.
CyberTotal.URL.positive_detections number The number of antivirus vendors scanned with positive detection.
CyberTotal.URL.detection_ratio string The ratio of positive_detections and detection_engines.
CyberTotal.URL.message string Message about this search.
URL.Data String The URL
URL.DetectionEngines String The total number of engines that checked the indicator.
URL.PositiveDetections String The number of engines that positively detected the indicator as malicious.
URL.Malicious.Vendor String The vendor reporting the URL as malicious.
URL.Malicious.Description String A description of the malicious URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!url url=http://abc.com

Context Example

{
    "CyberTotal": {
        "URL": {
            "confidence": 1,
            "detection_engines": 79,
            "detection_ratio": "0/79",
            "message": "search success",
            "permalink": "https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96",
            "positive_detections": 0,
            "resource": "http://abc.com",
            "scan_date": "2020-06-22T07:24:16+00:00",
            "severity": 5,
            "task_id": "61bbc65f5c034930b8a659c39e745d96",
            "threat": "Medium"
        }
    },
    "DBotScore": {
        "Indicator": "http://abc.com",
        "Score": 0,
        "Type": "url",
        "Vendor": "CyberTotal"
    },
    "URL": {
        "Data": "http://abc.com",
        "DetectionEngines": 79
    }
}

Human Readable Output

URL List

confidence detection_engines detection_ratio message permalink positive_detections resource scan_date severity task_id threat
1 79 0/79 search success https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96 0 http://abc.com 2020-06-22T07:24:16+00:00 5 61bbc65f5c034930b8a659c39e745d96 Medium

cybertotal-ip-whois

Return ip whois information

Base Command

cybertotal-ip-whois

Input

Argument Name Description Required
ip List of IP(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-IP.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-IP.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-IP.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-IP.message string Message about this search.
CyberTotal.WHOIS-IP.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-IP.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-IP.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-IP.status string Status of this IP
CyberTotal.WHOIS-IP.domain string Domain of this IP
CyberTotal.WHOIS-IP.domainMd5 string MD5 translation of CyberTotal.WHOIS-IP.domain
CyberTotal.WHOIS-IP.domainUnicode string Encode CyberTotal.WHOIS-IP.domain by using unicode
CyberTotal.WHOIS-IP.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-IP.registrarName string The name of registrar
CyberTotal.WHOIS-IP.registrarEmail string The email address of registrar
CyberTotal.WHOIS-IP.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-IP.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-IP.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-IP.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-IP.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-IP.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-IP.registrant.name string The name of registrant
CyberTotal.WHOIS-IP.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-IP.registrant.street string The street name of registrant
CyberTotal.WHOIS-IP.registrant.city string The location city of registrant
CyberTotal.WHOIS-IP.registrant.state string The location state name of registrant
CyberTotal.WHOIS-IP.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-IP.registrant.country string The country of registrant
CyberTotal.WHOIS-IP.registrant.address string The address of registrant
CyberTotal.WHOIS-IP.admin.name string The name of admin
CyberTotal.WHOIS-IP.admin.organization string The organization name of admin
CyberTotal.WHOIS-IP.admin.street string The street name of admin
CyberTotal.WHOIS-IP.admin.city string The location city of admin
CyberTotal.WHOIS-IP.admin.state string The location state name of admin
CyberTotal.WHOIS-IP.admin.zip string The post zip code of admin
CyberTotal.WHOIS-IP.admin.country string The country of admin
CyberTotal.WHOIS-IP.admin.address string The address of admin
CyberTotal.WHOIS-IP.technical.name string The name of technical
CyberTotal.WHOIS-IP.technical.organization string The organization name of technical
CyberTotal.WHOIS-IP.technical.street string The street name of technical
CyberTotal.WHOIS-IP.technical.city string The location city of technical
CyberTotal.WHOIS-IP.technical.state string The location state name of technical
CyberTotal.WHOIS-IP.technical.zip string The post zip code of technical
CyberTotal.WHOIS-IP.technical.country string The country of technical
CyberTotal.WHOIS-IP.technical.address string The address of technical
CyberTotal.WHOIS-IP.contactEmails string An array of all contact email address
CyberTotal.WHOIS-IP.contacts string An array of all contact details
CyberTotal.WHOIS-IP.contactNames string An array of all contact names
CyberTotal.WHOIS-IP.contactCountries string An array of all contact countries
CyberTotal.WHOIS-IP.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-IP.expired boolean If this IP is expired

Command Example

!cybertotal-ip-whois ip=1.1.1.1

Context Example

{
    "CyberTotal": {
        "WHOIS-IP": {
            "abuse": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "xxx@xxx.net",
                "id": 0,
                "name": "IRT-APNICRANDNET-AU",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "admin": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "research@apnic.net",
                "fax": "+61-7-3858-3199",
                "id": 0,
                "name": "APNIC RESEARCH",
                "phone": "+61-7-3858-3188",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "auditCreatedAt": "2020-07-18T02:07:02+00:00",
            "auditUpdatedAt": "2020-07-18T02:07:02+00:00",
            "compositeParseCode": 10528,
            "contactCountries": [
                "australia"
            ],
            "contactEmails": [
                "research@apnic.net"
            ],
            "contactNames": [
                "APNIC RESEARCH"
            ],
            "contactOrganizations": [],
            "contacts": [
                {
                    "address": "po box 3646\n4101\nqld\naustralia\n",
                    "country": "australia",
                    "email": "research@apnic.net",
                    "fax": "+61-7-3858-3199",
                    "id": 0,
                    "name": "APNIC RESEARCH",
                    "phone": "+61-7-3858-3188",
                    "state": "qld",
                    "street": "po box 3646",
                    "whoisContactID": 0,
                    "zip": "4101"
                }
            ],
            "createdAt": "2020-07-18T02:07:02+00:00",
            "domain": "1.1.1.0",
            "domainAvailable": false,
            "domainMd5": "ede514d996ecdf82a0abf5356ff6a13c",
            "domainUnicode": "1.1.1.0",
            "expired": false,
            "id": 6690074356934458000,
            "message": "search success",
            "nameservers": [],
            "netRange": {
                "ipEnd": "1.1.1.255",
                "ipStart": "1.1.1.0",
                "netName": "APNIC-LABS",
                "netRange": "1.1.1.0 - 1.1.1.255",
                "numericEnd": 16843263,
                "numericStart": 16843008,
                "status": "INACTIVE",
                "whoisNetRangeID": 0
            },
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d"
            ],
            "registrarName": "APNIC",
            "registrarParseCode": 10528,
            "registrarUpdatedAt": "2020-07-15T13:10:57+00:00",
            "resource": [
                "1.1.1.1"
            ],
            "scan_date": [
                "2020-07-28 14:11:19"
            ],
            "status": "ACTIVE",
            "task_id": "5a2601d575ea44058efeb1aba995dc8d",
            "technical": {
                "address": "po box 3646\n4101\nqld\naustralia\n",
                "country": "australia",
                "email": "research@apnic.net",
                "fax": "+61-7-3858-3199",
                "id": 0,
                "name": "APNIC RESEARCH",
                "phone": "+61-7-3858-3188",
                "state": "qld",
                "street": "po box 3646",
                "whoisContactID": 0,
                "zip": "4101"
            },
            "tld": "ipv4",
            "updatedAt": "2020-07-18T02:07:02+00:00",
            "whoisID": 6690074356934458000,
            "whoisServer": "rdap.apnic.net"
        }
    }
}

Human Readable Output

Results

abuse admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainUnicode expired id message nameservers netRange noRecord permalink registrarName registrarParseCode registrarUpdatedAt resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: IRT-APNICRANDNET-AU
street: po box 3646
state: qld
zip: 4101
country: australia
address: po box 3646
4101
qld
australia

id: 0		 whoisContactID: 0
email: research@apnic.net
name: APNIC RESEARCH
street: po box 3646
state: qld
zip: 4101
country: australia
phone: +61-7-3858-3188
fax: +61-7-3858-3199
address: po box 3646
4101
qld
australia

id: 0		 2020-07-18T02:07:02+00:00 2020-07-18T02:07:02+00:00 10528 australia research@apnic.net APNIC RESEARCH   {‘whoisContactID’: 0, ‘email’: ‘research@apnic.net’, ‘name’: ‘APNIC RESEARCH’, ‘street’: ‘po box 3646’, ‘state’: ‘qld’, ‘zip’: ‘4101’, ‘country’: ‘australia’, ‘phone’: ‘+61-7-3858-3188’, ‘fax’: ‘+61-7-3858-3199’, ‘address’: ‘po box 3646\n4101\nqld\naustralia\n’, ‘id’: 0} 2020-07-18T02:07:02+00:00 1.1.1.0 false ede514d996ecdf82a0abf5356ff6a13c 1.1.1.0 false 6690074356934458403 search success   status: INACTIVE
whoisNetRangeID: 0
netRange: 1.1.1.0 - 1.1.1.255
netName: APNIC-LABS
ipStart: 1.1.1.0
ipEnd: 1.1.1.255
numericEnd: 16843263
numericStart: 16843008		 false [“https://cybertotal.cycraft.com/app/intelligence/5a2601d575ea44058efeb1aba995dc8d”] APNIC 10528 2020-07-15T13:10:57+00:00 [“1.1.1.1”] [“2020-07-28 14:11:19”] ACTIVE 5a2601d575ea44058efeb1aba995dc8d whoisContactID: 0
email: research@apnic.net
name: APNIC RESEARCH
street: po box 3646
state: qld
zip: 4101
country: australia
phone: +61-7-3858-3188
fax: +61-7-3858-3199
address: po box 3646
4101
qld
australia

id: 0		 ipv4 2020-07-18T02:07:02+00:00 6690074356934458403 rdap.apnic.net

cybertotal-url-whois

Return url whois information

Base Command

cybertotal-url-whois

Input

Argument Name Description Required
url List of URL(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-URL.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-URL.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-URL.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-URL.message string Message about this search.
CyberTotal.WHOIS-URL.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-URL.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-URL.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-URL.status string Status of this IP
CyberTotal.WHOIS-URL.domain string Domain of this IP
CyberTotal.WHOIS-URL.domainMd5 string MD5 translation of CyberTotal.WHOIS-URL.domain
CyberTotal.WHOIS-URL.domainUnicode string Encode CyberTotal.WHOIS-URL.domain by using unicode
CyberTotal.WHOIS-URL.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-URL.registrarName string The name of registrar
CyberTotal.WHOIS-URL.registrarEmail string The email address of registrar
CyberTotal.WHOIS-URL.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-URL.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-URL.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-URL.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-URL.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-URL.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-URL.registrant.name string The name of registrant
CyberTotal.WHOIS-URL.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-URL.registrant.street string The street name of registrant
CyberTotal.WHOIS-URL.registrant.city string The location city of registrant
CyberTotal.WHOIS-URL.registrant.state string The location state name of registrant
CyberTotal.WHOIS-URL.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-URL.registrant.country string The country of registrant
CyberTotal.WHOIS-URL.registrant.address string The address of registrant
CyberTotal.WHOIS-URL.admin.name string The name of admin
CyberTotal.WHOIS-URL.admin.organization string The organization name of admin
CyberTotal.WHOIS-URL.admin.street string The street name of admin
CyberTotal.WHOIS-URL.admin.city string The location city of admin
CyberTotal.WHOIS-URL.admin.state string The location state name of admin
CyberTotal.WHOIS-URL.admin.zip string The post zip code of admin
CyberTotal.WHOIS-URL.admin.country string The country of admin
CyberTotal.WHOIS-URL.admin.address string The address of admin
CyberTotal.WHOIS-URL.technical.name string The name of technical
CyberTotal.WHOIS-URL.technical.organization string The organization name of technical
CyberTotal.WHOIS-URL.technical.street string The street name of technical
CyberTotal.WHOIS-URL.technical.city string The location city of technical
CyberTotal.WHOIS-URL.technical.state string The location state name of technical
CyberTotal.WHOIS-URL.technical.zip string The post zip code of technical
CyberTotal.WHOIS-URL.technical.country string The country of technical
CyberTotal.WHOIS-URL.technical.address string The address of technical
CyberTotal.WHOIS-URL.contactEmails string An array of all contact email address
CyberTotal.WHOIS-URL.contacts string An array of all contact details
CyberTotal.WHOIS-URL.contactNames string An array of all contact names
CyberTotal.WHOIS-URL.contactCountries string An array of all contact countries
CyberTotal.WHOIS-URL.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-URL.expired boolean If this URL is expired

Command Example

!cybertotal-url-whois url=http://abc.com

Context Example

{
    "CyberTotal": {
        "WHOIS-URL": {
            "admin": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "auditCreatedAt": "2020-04-09T07:17:45+00:00",
            "auditUpdatedAt": "2020-04-09T07:17:45+00:00",
            "compositeParseCode": 3579,
            "contactCountries": [
                "US"
            ],
            "contactEmails": [
                "corp.dns.domains@testcorp.com"
            ],
            "contactNames": [
                "ABC, Inc.; Domain Administrator"
            ],
            "contactOrganizations": [
                "ABC, Inc."
            ],
            "contacts": [
                {
                    "address": "New York\n10023-6298\nNY\nUS\n",
                    "city": "New York",
                    "country": "US",
                    "email": "xxx@xxx.net",
                    "fax": "18182384694",
                    "id": 0,
                    "name": "ABC, Inc.; Domain Administrator",
                    "organization": "ABC, Inc.",
                    "phone": "18182384694",
                    "state": "NY",
                    "whoisContactID": 0,
                    "zip": "10023-6298"
                }
            ],
            "createdAt": "2020-04-09T07:17:45+00:00",
            "domain": "abc.com",
            "domainAvailable": false,
            "domainMd5": "929ba26f492f86d4a9d66a080849865a",
            "domainStatus": "clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited",
            "domainUnicode": "abc.com",
            "expired": false,
            "id": 6653913764397840000,
            "message": "search success",
            "nameservers": [
                "ns-1368.awsdns-43.org",
                "ns-1869.awsdns-41.co.uk",
                "ns-318.awsdns-39.com",
                "ns-736.awsdns-28.net"
            ],
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96"
            ],
            "registrant": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "registrarCreatedAt": "1996-05-22T04:00:00+00:00",
            "registrarEmail": "domainabuse@cscglobal.com",
            "registrarExpiresAt": "2021-05-23T04:00:00+00:00",
            "registrarIanaID": 299,
            "registrarName": "CSC Corporate Domains, Inc.",
            "registrarParseCode": 3579,
            "registrarPhone": "+1.8887802723",
            "registrarUpdatedAt": "2020-04-08T07:06:06+00:00",
            "registryParseCode": 251,
            "resource": [
                "http://abc.com"
            ],
            "scan_date": [
                "2020-06-22 07:24:16"
            ],
            "status": "ACTIVE",
            "task_id": "61bbc65f5c034930b8a659c39e745d96",
            "technical": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "tld": "com",
            "updatedAt": "2020-04-09T07:17:45+00:00",
            "whoisID": 6653913764397840000,
            "whoisServer": "whois.corporatedomains.com"
        }
    }
}

Human Readable Output

Results

admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainStatus domainUnicode expired id message nameservers noRecord permalink registrant registrarCreatedAt registrarEmail registrarExpiresAt registrarIanaID registrarName registrarParseCode registrarPhone registrarUpdatedAt registryParseCode resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 2020-04-09T07:17:45+00:00 2020-04-09T07:17:45+00:00 3579 US corp.dns.domains@testcorp.com ABC, Inc.; Domain Administrator ABC, Inc. {‘whoisContactID’: 0, ‘email’: ‘xxx@xxx.net’, ‘name’: ‘ABC, Inc.; Domain Administrator’, ‘organization’: ‘ABC, Inc.’, ‘city’: ‘New York’, ‘state’: ‘NY’, ‘zip’: ‘10023-6298’, ‘country’: ‘US’, ‘phone’: ‘18182384694’, ‘fax’: ‘18182384694’, ‘address’: ‘New York\n10023-6298\nNY\nUS\n’, ‘id’: 0} 2020-04-09T07:17:45+00:00 abc.com false 929ba26f492f86d4a9d66a080849865a clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited abc.com false 6653913764397840884 search success ns-1368.awsdns-43.org,
ns-1869.awsdns-41.co.uk,
ns-318.awsdns-39.com,
ns-736.awsdns-28.net		 false [“https://cybertotal.cycraft.com/app/intelligence/61bbc65f5c034930b8a659c39e745d96”] whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 1996-05-22T04:00:00+00:00 domainabuse@cscglobal.com 2021-05-23T04:00:00+00:00 299 CSC Corporate Domains, Inc. 3579 +1.8887802723 2020-04-08T07:06:06+00:00 251 [“http://abc.com”] [“2020-06-22 07:24:16”] ACTIVE 61bbc65f5c034930b8a659c39e745d96 whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 com 2020-04-09T07:17:45+00:00 6653913764397840884 whois.corporatedomains.com

cybertotal-domain-whois

Return domain whois information

Base Command

cybertotal-domain-whois

Input

Argument Name Description Required
domain List of domain(s). Required

Context Output

Path Type Description
CyberTotal.WHOIS-Domain.scan_date date Scan date format: ISO 8601
CyberTotal.WHOIS-Domain.task_id string The unique id of each scan in CyberTotal.
CyberTotal.WHOIS-Domain.resource string The scan target sent to CyberTotal.
CyberTotal.WHOIS-Domain.message string Message about this search.
CyberTotal.WHOIS-Domain.permalink string The link of this whois report in CyberTotal.
CyberTotal.WHOIS-Domain.createdAt date Create date format: ISO 8601
CyberTotal.WHOIS-Domain.updatedAt date Update date format: ISO 8601
CyberTotal.WHOIS-Domain.status string Status of this Domain
CyberTotal.WHOIS-Domain.domain string Top level Domain of this domain
CyberTotal.WHOIS-Domain.domainMd5 string MD5 translation of CyberTotal.WHOIS-Domain.domain
CyberTotal.WHOIS-Domain.domainUnicode string Encode CyberTotal.WHOIS-Domain.domain by using unicode
CyberTotal.WHOIS-Domain.nameservers string An array of all DNS nameservers
CyberTotal.WHOIS-Domain.registrarName string The name of registrar
CyberTotal.WHOIS-Domain.registrarEmail string The email address of registrar
CyberTotal.WHOIS-Domain.registrarPhone string The phone number of registrar
CyberTotal.WHOIS-Domain.registrarCreatedAt date Registrar create date format: ISO 8601
CyberTotal.WHOIS-Domain.registrarUpdatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-Domain.registrarExpiresAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-Domain.auditCreatedAt date Registrar update date format: ISO 8601
CyberTotal.WHOIS-Domain.auditUpdatedAt date Registrar expire date format: ISO 8601
CyberTotal.WHOIS-Domain.registrant.name string The name of registrant
CyberTotal.WHOIS-Domain.registrant.organization string The organization name of registrant
CyberTotal.WHOIS-Domain.registrant.street string The street name of registrant
CyberTotal.WHOIS-Domain.registrant.city string The location city of registrant
CyberTotal.WHOIS-Domain.registrant.state string The location state name of registrant
CyberTotal.WHOIS-Domain.registrant.zip string The post zip code of registrant
CyberTotal.WHOIS-Domain.registrant.country string The country of registrant
CyberTotal.WHOIS-Domain.registrant.address string The address of registrant
CyberTotal.WHOIS-Domain.admin.name string The name of admin
CyberTotal.WHOIS-Domain.admin.organization string The organization name of admin
CyberTotal.WHOIS-Domain.admin.street string The street name of admin
CyberTotal.WHOIS-Domain.admin.city string The location city of admin
CyberTotal.WHOIS-Domain.admin.state string The location state name of admin
CyberTotal.WHOIS-Domain.admin.zip string The post zip code of admin
CyberTotal.WHOIS-Domain.admin.country string The country of admin
CyberTotal.WHOIS-Domain.admin.address string The address of admin
CyberTotal.WHOIS-Domain.technical.name string The name of technical
CyberTotal.WHOIS-Domain.technical.organization string The organization name of technical
CyberTotal.WHOIS-Domain.technical.street string The street name of technical
CyberTotal.WHOIS-Domain.technical.city string The location city of technical
CyberTotal.WHOIS-Domain.technical.state string The location state name of technical
CyberTotal.WHOIS-Domain.technical.zip string The post zip code of technical
CyberTotal.WHOIS-Domain.technical.country string The country of technical
CyberTotal.WHOIS-Domain.technical.address string The address of technical
CyberTotal.WHOIS-Domain.contactEmails string An array of all contact email address
CyberTotal.WHOIS-Domain.contacts string An array of all contact details
CyberTotal.WHOIS-Domain.contactNames string An array of all contact names
CyberTotal.WHOIS-Domain.contactCountries string An array of all contact countries
CyberTotal.WHOIS-Domain.domainAvailable boolean If this domain is available
CyberTotal.WHOIS-Domain.expired boolean If this domain is expired

Command Example

!cybertotal-domain-whois domain=abc.com

Context Example

{
    "CyberTotal": {
        "WHOIS-Domain": {
            "admin": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "auditCreatedAt": "2020-04-09T07:17:45+00:00",
            "auditUpdatedAt": "2020-04-09T07:17:45+00:00",
            "compositeParseCode": 3579,
            "contactCountries": [
                "US"
            ],
            "contactEmails": [
                "corp.dns.domains@testcorp.com"
            ],
            "contactNames": [
                "ABC, Inc.; Domain Administrator"
            ],
            "contactOrganizations": [
                "ABC, Inc."
            ],
            "contacts": [
                {
                    "address": "New York\n10023-6298\nNY\nUS\n",
                    "city": "New York",
                    "country": "US",
                    "email": "xxx@xxx.net",
                    "fax": "18182384694",
                    "id": 0,
                    "name": "ABC, Inc.; Domain Administrator",
                    "organization": "ABC, Inc.",
                    "phone": "18182384694",
                    "state": "NY",
                    "whoisContactID": 0,
                    "zip": "10023-6298"
                }
            ],
            "createdAt": "2020-04-09T07:17:45+00:00",
            "domain": "abc.com",
            "domainAvailable": false,
            "domainMd5": "929ba26f492f86d4a9d66a080849865a",
            "domainStatus": "clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited",
            "domainUnicode": "abc.com",
            "expired": false,
            "id": 6653913764397840000,
            "message": "search success",
            "nameservers": [
                "ns-1368.awsdns-43.org",
                "ns-1869.awsdns-41.co.uk",
                "ns-318.awsdns-39.com",
                "ns-736.awsdns-28.net"
            ],
            "noRecord": false,
            "permalink": [
                "https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d"
            ],
            "registrant": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "registrarCreatedAt": "1996-05-22T04:00:00+00:00",
            "registrarEmail": "domainabuse@cscglobal.com",
            "registrarExpiresAt": "2021-05-23T04:00:00+00:00",
            "registrarIanaID": 299,
            "registrarName": "CSC Corporate Domains, Inc.",
            "registrarParseCode": 3579,
            "registrarPhone": "+1.8887802723",
            "registrarUpdatedAt": "2020-04-08T07:06:06+00:00",
            "registryParseCode": 251,
            "resource": [
                "abc.com"
            ],
            "scan_date": [
                "2020-06-18 03:19:48"
            ],
            "status": "ACTIVE",
            "task_id": "79ca1bd740564c36a7a4a78df5dc719d",
            "technical": {
                "address": "New York\n10023-6298\nNY\nUS\n",
                "city": "New York",
                "country": "US",
                "email": "xxx@xxx.net",
                "fax": "18182384694",
                "id": 0,
                "name": "ABC, Inc.; Domain Administrator",
                "organization": "ABC, Inc.",
                "phone": "18182384694",
                "state": "NY",
                "whoisContactID": 0,
                "zip": "10023-6298"
            },
            "tld": "com",
            "updatedAt": "2020-04-09T07:17:45+00:00",
            "whoisID": 6653913764397840000,
            "whoisServer": "whois.corporatedomains.com"
        }
    }
}

Human Readable Output

Results

admin auditCreatedAt auditUpdatedAt compositeParseCode contactCountries contactEmails contactNames contactOrganizations contacts createdAt domain domainAvailable domainMd5 domainStatus domainUnicode expired id message nameservers noRecord permalink registrant registrarCreatedAt registrarEmail registrarExpiresAt registrarIanaID registrarName registrarParseCode registrarPhone registrarUpdatedAt registryParseCode resource scan_date status task_id technical tld updatedAt whoisID whoisServer
whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 2020-04-09T07:17:45+00:00 2020-04-09T07:17:45+00:00 3579 US corp.dns.domains@testcorp.com ABC, Inc.; Domain Administrator ABC, Inc. {‘whoisContactID’: 0, ‘email’: ‘xxx@xxx.net’, ‘name’: ‘ABC, Inc.; Domain Administrator’, ‘organization’: ‘ABC, Inc.’, ‘city’: ‘New York’, ‘state’: ‘NY’, ‘zip’: ‘10023-6298’, ‘country’: ‘US’, ‘phone’: ‘18182384694’, ‘fax’: ‘18182384694’, ‘address’: ‘New York\n10023-6298\nNY\nUS\n’, ‘id’: 0} 2020-04-09T07:17:45+00:00 abc.com false 929ba26f492f86d4a9d66a080849865a clientTransferProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited abc.com false 6653913764397840884 search success ns-1368.awsdns-43.org,
ns-1869.awsdns-41.co.uk,
ns-318.awsdns-39.com,
ns-736.awsdns-28.net		 false [“https://cybertotal.cycraft.com/app/intelligence/79ca1bd740564c36a7a4a78df5dc719d”] whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 1996-05-22T04:00:00+00:00 domainabuse@cscglobal.com 2021-05-23T04:00:00+00:00 299 CSC Corporate Domains, Inc. 3579 +1.8887802723 2020-04-08T07:06:06+00:00 251 [“abc.com”] [“2020-06-18 03:19:48”] ACTIVE 79ca1bd740564c36a7a4a78df5dc719d whoisContactID: 0
email: xxx@xxx.net
name: ABC, Inc.; Domain Administrator
organization: ABC, Inc.
city: New York
state: NY
zip: 10023-6298
country: US
phone: 18182384694
fax: 18182384694
address: New York
10023-6298
NY
US

id: 0		 com 2020-04-09T07:17:45+00:00 6653913764397840884 whois.corporatedomains.com

Configuration parameters

  • url — CyberTotal URL (required)
  • token — CyberTotal API Token (required)
  • feed — Fetch indicators
  • threshold_ip — Bad ip threshold
  • threshold_file — Bad hash threshold
  • threshold_domain — Bad domain threshold
  • threshold_url — Bad url threshold
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (7)

  • cybertotal-domain-whois

    Return domain whois information.

  • cybertotal-ip-whois

    Return ip whois information.

  • cybertotal-url-whois

    Return url whois information.

  • domain

    Return domain information and reputation.

  • file

    Return file's information and reputation.

  • ip

    Return IP information and reputation.

  • url

    Return domain information and reputation.

Source

CyberTotal.py CyberTotal_test.py CyberTotal.yml CyberTotal_description.md command_examples.txt
Download History Raw 
"""CyberTotal Integration for Cortex XSOAR - Unit Tests file
This file contains the Unit Tests for the CyberTotal Integration based
on pytest. Cortex XSOAR contribution requirements mandate that every
integration should have a proper set of unit tests to automatically
verify that the integration is behaving as expected during CI/CD pipeline.
"""

import json


def util_load_json(path):
    with open(path) as f:
        return json.load(f)


def test_ip(requests_mock):
    """Tests the ip reputation command function.
    Configures requests_mock instance to generate the appropriate
    ip reputation API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CommonServerPython import Common
    from CyberTotal import Client, ip_reputation_command

    ip_to_check = "1.1.1.1"
    mock_response = util_load_json("test_data/reputation.json")
    requests_mock.get(f"http://test.com/_api/search/ip/basic/{ip_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {
        "ip": ip_to_check,
        "threshold": 10,
    }

    response = ip_reputation_command(client, args, 10)[0]

    assert response.outputs_prefix == "CyberTotal.IP"
    assert response.outputs_key_field == "task_id"
    assert response.outputs["resource"] == ip_to_check
    assert response.outputs["severity"] == 9
    assert response.outputs["confidence"] == 3
    assert response.outputs["threat"] == "High"
    assert response.outputs["permalink"] == "https://test.com/app/intelligence/2e11509eb3034aabaf3c006425050247"
    assert response.outputs["detection_ratio"] == "1/2"

    # This command also returns Common.IP data
    assert isinstance(response.indicator, Common.IP)
    assert response.indicator.ip == ip_to_check
    assert type(response.indicator.detection_engines) is int
    assert type(response.indicator.positive_engines) is int


def test_url(requests_mock):
    """Tests the url reputation command function.
    Configures requests_mock instance to generate the appropriate
    url reputation API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CommonServerPython import Common
    from CyberTotal import Client, url_reputation_command

    url_to_check = "http://abc.com"
    mock_response = util_load_json("test_data/reputation.json")
    requests_mock.get(f"http://test.com/_api/search/url/basic?q={url_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {
        "url": url_to_check,
        "threshold": 10,
    }

    response = url_reputation_command(client, args, 10)[0]

    assert response.outputs_prefix == "CyberTotal.URL"
    assert response.outputs_key_field == "task_id"
    assert response.outputs["resource"] == url_to_check
    assert response.outputs["severity"] == 9
    assert response.outputs["confidence"] == 3
    assert response.outputs["threat"] == "High"
    assert response.outputs["permalink"] == "https://test.com/app/intelligence/2e11509eb3034aabaf3c006425050247"
    assert response.outputs["detection_ratio"] == "1/2"

    # This command also returns Common.URL data
    assert isinstance(response.indicator, Common.URL)
    assert response.indicator.url == url_to_check
    assert type(response.indicator.detection_engines) is int
    assert type(response.indicator.positive_detections) is int


def test_domain(requests_mock):
    """Tests the domain reputation command function.
    Configures requests_mock instance to generate the appropriate
    domain reputation API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CommonServerPython import Common
    from CyberTotal import Client, domain_reputation_command

    domain_to_check = "abc.com"
    mock_response = util_load_json("test_data/reputation.json")
    requests_mock.get(f"http://test.com/_api/search/domain/basic/{domain_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {
        "domain": domain_to_check,
        "threshold": 10,
    }

    response = domain_reputation_command(client, args, 10)[0]

    assert response.outputs_prefix == "CyberTotal.Domain"
    assert response.outputs_key_field == "task_id"
    assert response.outputs["resource"] == domain_to_check
    assert response.outputs["severity"] == 9
    assert response.outputs["confidence"] == 3
    assert response.outputs["threat"] == "High"
    assert response.outputs["permalink"] == "https://test.com/app/intelligence/2e11509eb3034aabaf3c006425050247"
    assert response.outputs["detection_ratio"] == "1/2"

    # This command also returns Common.Domain data
    assert isinstance(response.indicator, Common.Domain)
    assert response.indicator.domain == domain_to_check
    assert type(response.indicator.detection_engines) is int
    assert type(response.indicator.positive_detections) is int


def test_file(requests_mock):
    """Tests the file reputation command function.
    Configures requests_mock instance to generate the appropriate
    file reputation API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CommonServerPython import Common
    from CyberTotal import Client, file_reputation_command

    file_to_check = "e594b31feb5f31c2bf611593f1651354"
    mock_response = util_load_json("test_data/reputation.json")
    requests_mock.get(f"http://test.com/_api/search/hash/basic/{file_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {
        "file": file_to_check,
        "threshold": 10,
    }

    response = file_reputation_command(client, args, 10)[0]

    assert response.outputs_prefix == "CyberTotal.File"
    assert response.outputs_key_field == "task_id"
    assert response.outputs["resource"] == file_to_check
    assert response.outputs["severity"] == 9
    assert response.outputs["confidence"] == 3
    assert response.outputs["threat"] == "High"
    assert response.outputs["permalink"] == "https://test.com/app/intelligence/2e11509eb3034aabaf3c006425050247"
    assert response.outputs["detection_ratio"] == "1/2"

    # This command also returns Common.File data
    assert isinstance(response.indicator, Common.File)
    assert response.indicator.md5 == file_to_check


def test_ip_whois(requests_mock):
    """Tests the ip whois command function.
    Configures requests_mock instance to generate the appropriate
    ip whois API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CyberTotal import Client, ip_whois_command

    ip_to_check = "1.1.1.1"
    mock_response = util_load_json("test_data/whois.json")
    requests_mock.get(f"http://test.com/_api/search/ip/whois/{ip_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {"ip": ip_to_check}

    response = ip_whois_command(client, args)

    assert response.outputs_prefix == "CyberTotal.WHOIS-IP"
    assert response.outputs_key_field == "task_id"


def test_url_whois(requests_mock):
    """Tests the URL whois command function.
    Configures requests_mock instance to generate the appropriate
    url whois API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CyberTotal import Client, url_whois_command

    url_to_check = "http://abc.com"
    mock_response = util_load_json("test_data/whois.json")
    requests_mock.get(f"http://test.com/_api/search/url/whois?q={url_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {"url": url_to_check}

    response = url_whois_command(client, args)

    assert response.outputs_prefix == "CyberTotal.WHOIS-URL"
    assert response.outputs_key_field == "task_id"


def test_domain_whois(requests_mock):
    """Tests the domain whois command function.
    Configures requests_mock instance to generate the appropriate
    domain whois API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CyberTotal import Client, domain_whois_command

    domain_to_check = "abc.com"
    mock_response = util_load_json("test_data/whois.json")
    requests_mock.get(f"http://test.com/_api/search/domain/whois/{domain_to_check}", json=mock_response)

    client = Client(base_url="http://test.com", verify=False, headers={"Authorization": "Token cybertotal_api_key"})

    args = {"domain": domain_to_check}

    response = domain_whois_command(client, args)

    assert response.outputs_prefix == "CyberTotal.WHOIS-Domain"
    assert response.outputs_key_field == "task_id"