Digital Shadows

Digital Shadows monitors and manages an organization’s digital risk across the widest range of data sources within the open, deep, and dark web.

Configure Digital Shadows in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ds-get-breach-reviews

Retrieve all review updates for a given data breach record

Base Command

ds-get-breach-reviews

Input

Context Output

ds-snapshot-breach-status

Snapshot the review status of a data breach record

Base Command

ds-snapshot-breach-status

Input

Context Output

There is no context output for this command.

ds-find-breach-records

Find data breach records

Base Command

ds-find-breach-records

Input

Context Output

Command Example

!ds-find-breach-records pagination_size=2

Context Example

{
    "DigitalShadows": {
        "BreachRecords": [
            {
                "Content": "A",
                "DataBreachId": 99000001,
                "DomainNames": [
                    "xsoar.com"
                ],
                "Id": 140260931001,
                "Password": "1",
                "PriorRowTextBreachCount": null,
                "PriorUsernameBreachCount": 0,
                "PriorUsernamePasswordBreachCount": 0,
                "Published": "2019-05-30T20:52:59.489Z",
                "Review": {
                    "Created": null,
                    "Status": "OPEN",
                    "User": null
                },
                "Username": "some_mail@mail.com"
            },
            {
                "Content": "B",
                "DataBreachId": 99000002,
                "DomainNames": [
                    "xsoar.com"
                ],
                "Id": 140261100001,
                "Password": "2",
                "PriorRowTextBreachCount": null,
                "PriorUsernameBreachCount": 0,
                "PriorUsernamePasswordBreachCount": 0,
                "Published": "2019-05-30T20:53:00.635Z",
                "Review": {
                    "Created": null,
                    "Status": "OPEN",
                    "User": null
                },
                "Username": "another_mail@mail.com"
            }
        ]
    }
}

Human Readable Output

Digital Shadows Breach Records

Content	DataBreachId	DomainNames	Id	Password	PriorRowTextBreachCount	PriorUsernameBreachCount	PriorUsernamePasswordBreachCount	Published	Review Created	Review Status	Review User	Username
A	99000001	xsoar.com	140260931001	1		0	0	2019-05-30T20:52:59.489Z		OPEN		some_mail@mail.com
aB	99000002	xsoar.com	140261100001	2		0	0	2019-05-30T20:53:00.635Z		OPEN		another_mail@mail.com

ds-get-breach-summary

Summary of all data breaches for the current client

Base Command

ds-get-breach-summary

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

#### Context Example

```json
{}

Human Readable Output

{“breachesPerDomain”:[{“count”:3,”key”:”molnnet.com”}],”totalBreaches”:3,”totalUsernames”:238,”usernamesPerDomain”:[{“count”:238,”key”:”xsoar.com”}]}

ds-find-breach-usernames

Find unique usernames found across all data breaches

Base Command

ds-find-breach-usernames

Input

Context Output

Command Example

!ds-find-breach-usernames pagination_size=2

Context Example

{
    "DigitalShadows": {
        "Users": [
            {
                "BreachCount": 1,
                "DistinctPasswordCount": 1,
                "Username": "mail1@mail.com"
            },
            {
                "BreachCount": 1,
                "DistinctPasswordCount": 1,
                "Username": "mail2@mail.com"
            }
        ]
    }
}

Human Readable Output

Digital SHadows Breach Reviews

BreachCount	DistinctPasswordCount	Username
1	1	mail1@mail.com
1	1	mail2@mail.com

ds-get-breach

Retrieve a data breach by its id

Base Command

ds-get-breach

Input

Context Output

Command Example

!ds-get-breach breach_id=99000001

Context Example

{
    "DigitalShadows": {
        "Breaches": {
            "DataClasses": [
                "EMAIL_ADDRESSES",
                "PASSWORDS"
            ],
            "DomainCount": 3372,
            "DomainName": "xsoar.com",
            "Id": 99000001,
            "IncidentId": 99002706,
            "IncidentScope": "ORGANIZATION",
            "IncidentSeverity": "HIGH",
            "IncidentTitle": "Report of data leak from xsoar.com",
            "IncidentType": "DATA_LEAKAGE",
            "Occurred": "2016-07-03",
            "RecordCount": 5846,
            "SourceUrl": "some_url",
            "Title": "Report of data leak from xsoar.com"
        }
    }
}

Human Readable Output

Digital Shadows Breaches

DataClasses	DomainCount	DomainName	Id	IncidentId	IncidentScope	IncidentSeverity	IncidentTitle	IncidentType	Occurred	RecordCount	SourceUrl	Title
EMAIL_ADDRESSES,PASSWORDS	3372	xsoar.com	99000001	99002706	ORGANIZATION	HIGH	Report of data leak from xsoar.com	DATA_LEAKAGE	2016-07-03	5846	some_url	Report of data leak from xsoar.com

ds-get-breach-records

Find data breach records

Base Command

ds-get-breach-records

Input

Context Output

Command Example

!ds-get-breach-records breach_id=99000001 pagination_size=2

Context Example

{
    "DigitalShadows": {
        "BreachRecords": [
            {
                "Id": 140260931001,
                "Password": "1",
                "PriorRowTextBreachCount": null,
                "PriorUsernameBreachCount": 0,
                "PriorUsernamePasswordBreachCount": 0,
                "Published": "2019-05-30T20:52:59.489Z",
                "Review": {
                    "Created": null,
                    "Status": "OPEN",
                    "User": null
                },
                "Username": "some_mail@mail.com"
            },
            {
                "Id": 140260944001,
                "Password": "2",
                "PriorRowTextBreachCount": null,
                "PriorUsernameBreachCount": 0,
                "PriorUsernamePasswordBreachCount": 0,
                "Published": "2019-05-30T20:52:59.489Z",
                "Review": {
                    "Created": null,
                    "Status": "OPEN",
                    "User": null
                },
                "Username": "another_mail@mail.com"
            }
        ]
    }
}

Human Readable Output

Digital Shadows Breach Records

Id	Password	PriorRowTextBreachCount	PriorUsernameBreachCount	PriorUsernamePasswordBreachCount	Published	Review Created	Review Status	Review User	Username
140260931001	1		0	0	2019-05-30T20:52:59.489Z		OPEN		some_mail@mail.com
140260944001	2		0	0	2019-05-30T20:52:59.489Z		OPEN		another_mail@mail.com

ds-find-data-breaches

Find data breaches

Base Command

ds-find-data-breaches

Input

Context Output

Command Example

!ds-find-data-breaches pagination_size=2

Context Example

{
    "DigitalShadows": {
        "Breaches": [
            {
                "DataClasses": null,
                "DomainCount": 3372,
                "DomainName": "xsoar.com",
                "Id": 99000001,
                "IncidentId": 99002706,
                "IncidentScope": "ORGANIZATION",
                "IncidentSeverity": "HIGH",
                "IncidentTitle": "Report of data leak from xsoar.com",
                "IncidentType": "DATA_LEAKAGE",
                "Modified": "2018-07-24T18:24:59.449Z",
                "Occurred": "2016-07-03",
                "OrganisationUsernameCount": 100,
                "RecordCount": 5846,
                "SourceUrl": "some_url",
                "Title": "Report of data leak from xsoar.com"
            },
            {
                "DataClasses": null,
                "DomainCount": 5848,
                "DomainName": "someDomain.com",
                "Id": 99000000,
                "IncidentId": 99002728,
                "IncidentScope": "ORGANIZATION",
                "IncidentSeverity": "HIGH",
                "IncidentTitle": "Report of data leak from someDomain.com",
                "IncidentType": "DATA_LEAKAGE",
                "Modified": "2018-07-24T18:22:42.780Z",
                "Occurred": "2016-06-29",
                "OrganisationUsernameCount": 100,
                "RecordCount": 5858,
                "SourceUrl": "another_url",
                "Title": "Report of data leak from someDomain.com"
            }
        ]
    }
}

Human Readable Output

Digital Shadows Breaches

DataClasses	DomainCount	DomainName	Id	IncidentId	IncidentScope	IncidentSeverity	IncidentTitle	IncidentType	Modified	Occurred	OrganisationUsernameCount	RecordCount	SourceUrl	Title
	3372	xsoar.com	99000001	99002706	ORGANIZATION	HIGH	Report of data leak from xsoar.com	DATA_LEAKAGE	2018-07-24T18:24:59.449Z	2016-07-03	100	5846	some_url	Report of data leak from xsoar.com
	5848	someDomain.com	99000000	99002728	ORGANIZATION	HIGH	Report of data leak from someDomain.com	DATA_LEAKAGE	2018-07-24T18:22:42.780Z	2016-06-29	100	5858	another_url	Report of data leak from someDomain.com

ds-get-incident

Retrieve an incident by its id

Base Command

ds-get-incident

Input

Context Output

Command Example

!ds-get-incident incident_id=99002724

Context Example

{
    "DigitalShadows": {
        "Incidents": {
            "Alerted": null,
            "Description": "Several documents in .docx, .xls, and .ppt format were identified on a publicly accessible some derive on the following IP: 1.2.3.4. \r\n",
            "Id": 99002724,
            "ImpactDescription": "The IP address contained 30 documents relating to the Company at the following paths: \r\n\r\n1.\thxxps://1.2.3.4//man",
            "Internal": false,
            "Mitigation": "As the drives are no longer accessible",
            "Modified": "2020-11-06T00:22:57.753Z",
            "Occurred": "2018-08-23T03:45:57.215Z",
            "Review": {
                "Created": "2019-08-01T13:19:53.522Z",
                "Status": "UNREAD",
                "User": null
            },
            "Scope": "ORGANIZATION",
            "Severity": "MEDIUM",
            "SubType": "UNMARKED_DOCUMENT",
            "Title": "Vendor documents identified on publicly accessible Network Attached Storage drive",
            "Type": "DATA_LEAKAGE"
        }
    }
}

Human Readable Output

Digital Shadows Incidents

Alerted	Description	Id	ImpactDescription	Internal	Mitigation	Modified	Occurred	Review Created	Review Status	Review User	Scope	Severity	SubType	Title	Type
	Several documents in .docx, .xls, and .ppt format were identified on a publicly accessible some derive on the following IP: 1.2.3.4.	99002724	The IP address contained 30 documents relating to the Company at the following paths: 1. hxxps://1.2.3.4//man	false	As the drives are no longer accessible.	2020-11-06T00:22:57.753Z	2018-08-23T03:45:57.215Z	2019-08-01T13:19:53.522Z	UNREAD		ORGANIZATION	MEDIUM	UNMARKED_DOCUMENT	Vendor documents identified on publicly accessible Network Attached Storage drive	DATA_LEAKAGE

ds-get-incident-reviews

Retrieve all review updates for a given incident

Base Command

ds-get-incident-reviews

Input

Context Output

Command Example

!ds-get-incident-reviews incident_id=99002724

Context Example

{
    "DigitalShadows": {
        "IncidentReviews": {
            "Created": "2019-08-01T13:19:53.522Z",
            "Note": null,
            "Status": "UNREAD",
            "User": {
                "EmailAddress": null,
                "FullName": null,
                "Id": null,
                "Role": null,
                "Status": null
            },
            "Version": 1
        }
    }
}

Human Readable Output

Digital Shadows Incident Reviews

Created	Note	Status	User EmailAddress	User FullName	User Id	User Role	User Status	Version
2019-08-01T13:19:53.522Z		UNREAD						1

ds-snapshot-incident-review

Snapshot the review status of an incident

Base Command

ds-snapshot-incident-review

Input

Context Output

There is no context output for this command.

ds-find-incidents-filtered

Find incidents with filtering options

Base Command

ds-find-incidents-filtered

Input

Context Output

Command Example

!ds-find-incidents-filtered pagination_size=3

Context Example

{
    "DigitalShadows": {
        "Incidents": {
            "Alerted": null,
            "Description": "Several documents in .docx, .xls, and .ppt format were identified on a publicly accessible some derive on the following IP: 1.2.3.4.",
            "Id": 99002724,
            "Internal": null,
            "Mitigation": "As the drives are no longer accessible.",
            "Modified": "2020-11-05T00:33:48.344Z",
            "Occurred": "2018-08-23T03:45:57.215Z",
            "Published": "2020-11-04T23:59:59.999Z",
            "RecordCount": null,
            "RestrictedContent": null,
            "Review": {
                "Created": "2019-08-01T13:19:53.522Z",
                "Status": "UNREAD",
                "User": null
            },
            "Scope": "ORGANIZATION",
            "Score": 0,
            "Severity": "MEDIUM",
            "SubType": {
                "Error": "You must provide the query to use"
            },
            "Title": "Vendor documents identified on publicly accessible Network Attached Storage drive",
            "Type": "DATA_LEAKAGE",
            "Verified": {
                "Error": "You must provide the query to use"
            },
            "Version": {
                "Error": "You must provide the query to use"
            }
        }
    }
}

Human Readable Output

Digital Shadows Incidents

Alerted	Description	Id	Internal	Mitigation	Modified	Occurred	Published	RecordCount	RestrictedContent	Review Created	Review Status	Review User	Scope	Score	Severity	SubType	Title	Type	Verified	Version
	Several documents in .docx, .xls, and .ppt format were identified on a publicly accessible some derive on the following IP: 1.2.3.4.	99002724		As the drives are no longer accessible.	2020-11-05T00:33:48.344Z	2018-08-23T03:45:57.215Z	2020-11-04T23:59:59.999Z			2019-08-01T13:19:53.522Z	UNREAD		ORGANIZATION	0	MEDIUM	{“Error”:”You must provide the query to use”}	Vendor documents identified on publicly accessible Network Attached Storage drive	DATA_LEAKAGE	{“Error”:”You must provide the query to use”}	{“Error”:”You must provide the query to use”}

ds-get-incidents-summary

Aggregated summary of incident information used to generate reports/statistics

Base Command

ds-get-incidents-summary

Input

Context Output

There is no context output for this command.

Command Example

!ds-get-incidents-summary pagination_size=2

Human Readable Output

{“keySet”:[null],”ranges”:[{“groupedIncidentCounts”:[{“count”:25}],”rangeEnd”:”2020-11-05T17:37:26.533Z”,”rangeStart”:”2020-11-01T00:00:00.000Z”,”total”:25}]}

ds-get-apt-report

Retrieve details of the specified APT report

Base Command

ds-get-apt-report

Input

Context Output

ds-get-intelligence-incident

Retrieve an intelligence incident by its id

Base Command

ds-get-intelligence-incident

Input

Context Output

Command Example

!ds-get-intelligence-incident incident_id=6470614

Context Example

{
    "DigitalShadows": {
        "IntelligenceIncidents": {
            "Description": "Summary: some event in the past",
            "Id": 6470614,
            "IndicatorOfCompromiseCount": 0,
            "Internal": false,
            "LinkedContentIncidents": null,
            "Modified": "2018-08-30T07:18:22.566Z",
            "Occurred": "2016-02-08T10:55:00.000Z",
            "Published": "2016-02-08T12:22:03.203Z",
            "RelatedIncidentId": null,
            "RestrictedContent": false,
            "Scope": "GLOBAL",
            "Severity": "LOW",
            "SubType": null,
            "Title": "08 Feb 2016 protest update",
            "Type": "CYBER_THREAT",
            "Verified": "2016-02-08T11:22:48.539Z",
            "Version": 12
        }
    }
}

Human Readable Output

Digital Shadows Intelligence Incident

Description	Id	IndicatorOfCompromiseCount	Internal	LinkedContentIncidents	Modified	Occurred	Published	RelatedIncidentId	RestrictedContent	Scope	Severity	SubType	Title	Type	Verified	Version
Summary: some event in the past	6470614	0	false		2018-08-30T07:18:22.566Z	2016-02-08T10:55:00.000Z	2016-02-08T12:22:03.203Z		false	GLOBAL	LOW		08 Feb 2016 protest update	CYBER_THREAT	2016-02-08T11:22:48.539Z	12

ds-get-intelligence-incident-iocs

Retrieve the indicatorsOfCompromise for this intel incident

Base Command

ds-get-intelligence-incident-iocs

Input

Context Output

Command Example

#### Human Readable Output

### ds-find-intelligence-incidents

***
Find intelligence incidents

#### Base Command

`ds-find-intelligence-incidents`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| filter_dateRange | Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. | Optional |
| filter_dateRangeField | Determines which date/time field the dateRange will apply to. | Optional |
| filter_domainName | Only incidents that have this domain, applied if domainSelection is null or CUSTOM | Optional |
| filter_domainSelection | Determine how domain filtering will be applied. | Optional |
| filter_identifier | Only return the incident that has this identifier. | Optional |
| filter_severities | Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE | Optional |
| filter_tagOperator | Whether multiple tags should be logically applied as AND/OR with the resultset | Optional |
| filter_tags_id | Limit to incidents that have these tags ids only. | Optional |
| filter_threatRecordIds | Restrict intel incidents to those tagged with one or more of these threat records. | Optional |
| filter_threatTypes_type | Restrict intel incidents to those associated with threats of these types:ACTOR,CAMPAIGN,EVENT,TOOL,SPECIFIC_TTP,LOCATION | Optional |
| filter_threatTypes | The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. | Optional |
| filter_threatSubTypes | List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT | Optional |
| pagination_containingId | Select the page containing the record with this id, if supported. Mutually exclusive with offset. | Optional |
| pagination_offset | Include results at this offset within the full resultset, where the first result is at position 0 | Optional |
| pagination_size | Maximum number of results to return per page, can be initially null to be replaced by default later | Optional |
| sort_direction | The direction of sorting. If not specified, ASCENDING is assumed | Optional |
| sort_property | The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IntelligenceIncidents.Description | unknown | Plain text description of this incident. |
| DigitalShadows.IntelligenceIncidents.Id | unknown | Identifier for this incident, unique in combination with the scope |
| DigitalShadows.IntelligenceIncidents.IndicatorOfCompromiseCount | unknown | Count of IOCs that can be retrieved via /api/incidents/\{id\}/iocs endpoint |
| DigitalShadows.IntelligenceIncidents.Internal | unknown | Will be true if domain belongs to your organization \(as defined by the assets\), false otherwise |
| DigitalShadows.IntelligenceIncidents.LinkedContentIncidents | unknown | Other incidents that appear to be based on the same content as this incident. Each incident record will normally only contain the id and the scope it applies to. Could also include more details depending on the context it is called in. |
| DigitalShadows.IntelligenceIncidents.Modified | unknown | When was this incident last modified |
| DigitalShadows.IntelligenceIncidents.Occurred | unknown | Best effort to establish when the incident occurred |
| DigitalShadows.IntelligenceIncidents.Published | unknown | When was this incident originally published |
| DigitalShadows.IntelligenceIncidents.RelatedIncidentId | unknown | If an incident specific to your organization exists for this intelligence incident, it will be included here. |
| DigitalShadows.IntelligenceIncidents.RestrictedContent | unknown | Identifies this incident as potentially containing questionable content. If this is true images will be restricted. |
| DigitalShadows.IntelligenceIncidents.Scope | unknown | Identifies whether this incident applies globally \(intelligence\) or just to your organization. |
| DigitalShadows.IntelligenceIncidents.Severity | unknown | Analyst defined severity based on potential risk to the client |
| DigitalShadows.IntelligenceIncidents.SubType | unknown | The sub-category of incident that has been raised, if available |
| DigitalShadows.IntelligenceIncidents.Title | unknown | A short but descriptive identifier for the incident |
| DigitalShadows.IntelligenceIncidents.Type | unknown | The category of incident that has been raised |
| DigitalShadows.IntelligenceIncidents.Verified | unknown | The moment when the incident was verified. |
| DigitalShadows.IntelligenceIncidents.Version | unknown | Each time an update occurs, this version number is incremented |

#### Command Example

```!ds-find-intelligence-incidents pagination_size=2```

#### Context Example

```json
{
    "DigitalShadows": {
        "IntelligenceIncidents": [
            {
                "Description": "A new post was added to Happy Blog.",
                "Id": 65624604,
                "IndicatorOfCompromiseCount": 0,
                "Internal": false,
                "LinkedContentIncidents": null,
                "Modified": "2020-11-05T15:53:33.166Z",
                "Occurred": "2020-11-05T05:48:42.588Z",
                "Published": "2020-11-05T15:53:33.161Z",
                "RelatedIncidentId": null,
                "RestrictedContent": false,
                "Scope": "GLOBAL",
                "Severity": "LOW",
                "SubType": null,
                "Title": "Tipper: Richardson Sales Performance named on Happy Blog ",
                "Type": "CYBER_THREAT",
                "Verified": "2020-11-05T14:01:48.656Z",
                "Version": 7
            },
            {
                "Description": "A new post was added to Happy Blog.",
                "Id": 65604506,
                "IndicatorOfCompromiseCount": 0,
                "Internal": false,
                "LinkedContentIncidents": null,
                "Modified": "2020-11-05T15:47:36.590Z",
                "Occurred": "2020-11-04T21:48:04.784Z",
                "Published": "2020-11-05T15:47:36.582Z",
                "RelatedIncidentId": null,
                "RestrictedContent": false,
                "Scope": "GLOBAL",
                "Severity": "LOW",
                "SubType": null,
                "Title": "Tipper: New Jersey Dental Hygienists' Association",
                "Type": "CYBER_THREAT",
                "Verified": "2020-11-05T14:01:48.656Z",
                "Version": 7
            }
        ]
    }
}
```

#### Human Readable Output

>### Digital Shadows Intelligence Incidents
>
> Description| Id| IndicatorOfCompromiseCount| Internal| LinkedContentIncidents| Modified| Occurred| Published| RelatedIncidentId| RestrictedContent| Scope| Severity| SubType| Title| Type| Verified| Version
>---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
>A new post was added to Happy Blog. | 65624604 | 0 | false |   | 2020-11-05T15:53:33.166Z | 2020-11-05T05:48:42.588Z | 2020-11-05T15:53:33.161Z |   | false | GLOBAL | LOW |   | Tipper: Richardson Sales Performance named on Happy Blog  | CYBER_THREAT | 2020-11-05T14:01:48.656Z | 7
>A new post was added to Happy Blog. | 65604506 | 0 | false |   | 2020-11-05T15:47:36.590Z | 2020-11-04T21:48:04.784Z | 2020-11-05T15:47:36.582Z |   | false | GLOBAL | LOW |   | Tipper: New Jersey Dental Hygienists' Association | CYBER_THREAT | 2020-11-05T14:01:48.656Z | 7

### ds-find-intelligence-incidents-regional

***
Incidents grouped by the target country over a given time range

#### Base Command

`ds-find-intelligence-incidents-regional`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| threat_id | Threat ID | Optional |
| countryTag_created | When was this tag created. | Optional |
| countryTag_description | Description text for this tag. | Optional |
| countryTag_id | Unique integer identifier for this tag | Optional |
| countryTag_name | The name of this tag. Is unique in combination with the type | Optional |
| countryTag_parent_id | Parent id of the tag | Optional |
| countryTag_threat_id | Unique integer identifier (among threats). | Optional |
| countryTag_threat_type | The type of profile being represented. | Optional |
| countryTag_type | The type of this tag. The name of tags with the same type must be unique. | Optional |
| filter_dateRange | Determines the interval the incidents must have occurred within to be included. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. | Optional |
| filter_periodRelativeTo | Optional timestamp that will be used as the end date for a period based dateRange. If not specified, then the end of the current day (based on the requesting user's timezone) will be used. | Optional |
| filter_tagType | What types of tags should be considered. Should be one of SOURCE_GEOGRAPHY or TARGET_GEOGRAPHY (the default) | Optional |
| regionTag_created | When was this tag created. | Optional |
| regionTag_description | Description text for this tag. | Optional |
| regionTag_id | Unique integer identifier for this tag | Optional |
| regionTag_name | The name of this tag. Is unique in combination with the type | Optional |
| regionTag_parent_id | Parent id of the tag | Optional |
| regionTag_threat_id | Unique integer identifier (among threats). | Optional |
| regionTag_threat_type | The type of profile being represented. | Optional |
| regionTag_type | The type of this tag. The name of tags with the same type must be unique. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Id | unknown | The ID of the country these incidents are attributed to |
| DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Name | unknown | The country name these incidents are attributed to |
| DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ParentId | unknown | The parent ID of the country these incidents are attributed to |
| DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ThreatId | unknown | The threat id of the country tag these incidents are attributed to |
| DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Type | unknown | The country tag type these incidents are attributed to |
| DigitalShadows.IntelligenceIncidentsRegional.IncidentIds | unknown | The list of intelligence incidents |

### ds-get-intelligence-threat

***
Retrieve a specific item of intelligence by its id

#### Base Command

`ds-get-intelligence-threat`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| threat_id | The id of the intelligence threat to retrieve. | Required |
| opt | Options to include additional relevant data with the request | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IntelligenceThreats.ActivityLevel | unknown | Level of activity, based on last active |
| DigitalShadows.IntelligenceThreats.DetailLevel | unknown | Determines how detailed the record is |
| DigitalShadows.IntelligenceThreats.EndDate | unknown | The end date of the period this was/is active |
| DigitalShadows.IntelligenceThreats.Id | unknown | Unique integer identifier \(among threats\) |
| DigitalShadows.IntelligenceThreats.ImageId | unknown | The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/\{id\} \(replacing \{id\} with the value of this property\). |
| DigitalShadows.IntelligenceThreats.ImageThumbnailId | unknown | The unique identifier for a thumbnail of the image, if available. The image can be retrieved by requesting /api/thumbnails/\{id\} \(replacing \{id\} with the value of this property\) |
| DigitalShadows.IntelligenceThreats.IndicatorOfCompromiseCount | unknown | Count of IOCs |
| DigitalShadows.IntelligenceThreats.LastActive | unknown | The date of last activity \(last incident\) |
| DigitalShadows.IntelligenceThreats.Recurring | unknown | Will this become active again in future? |
| DigitalShadows.IntelligenceThreats.StartDate | unknown | The start date of the period this was/is active |
| DigitalShadows.IntelligenceThreats.Type | unknown | The type of profile being represented |
| DigitalShadows.IntelligenceThreats.Tags.ActorTypeTags | unknown | Tags for the type of actor |
| DigitalShadows.IntelligenceThreats.AnnouncementIncidentIDs | unknown | List of public declarations made \(incidents\) |
| DigitalShadows.IntelligenceThreats.AptReportIDs | unknown | APT reports associated with this threat. Each entry can be resolved via the /api/apt-report/\{id\} endpoint. |
| DigitalShadows.IntelligenceThreats.Tags.AssociatedActorTags | unknown | Actors related to this threat \(if any\) |
| DigitalShadows.IntelligenceThreats.Tags.AssociatedCampaignTags | unknown | Campaigns related to this threat \(if any\) |
| DigitalShadows.IntelligenceThreats.AssociatedEventIDs | unknown | Events associated with this threat \(if any\) |
| DigitalShadows.IntelligenceThreats.AttackEvidenceIncidentIDs | unknown | List of damage caused incidents |
| DigitalShadows.IntelligenceThreats.Tags.ImpactEffectTags | unknown | What impact did it have |
| DigitalShadows.IntelligenceThreats.Tags.IntendedEffectTags | unknown | What the threat intended to happen |
| DigitalShadows.IntelligenceThreats.LatestIncidentID | unknown | The latest incident attributed to this threat |
| DigitalShadows.IntelligenceThreats.Tags.MotivationTags | unknown | Tags that define what motivates the threat |
| DigitalShadows.IntelligenceThreats.Tags.OverviewTags | unknown | Tags that will appear in the overview. Only one per primary type |
| DigitalShadows.IntelligenceThreats.Tags.PrimaryLanguageTags | unknown | Tags that identify the primary languages used |
| DigitalShadows.IntelligenceThreats.ThreatLevel | unknown | Information about the level of threat, for example low or high |

#### Command Example

```!ds-get-intelligence-threat threat_id=2351```

#### Context Example

```json
{
    "DigitalShadows": {
        "IntelligenceThreats": {
            "ActivityLevel": "INACTIVE",
            "AnnouncementIncidentIDs": null,
            "AptReportIDs": null,
            "AssociatedEventIDs": null,
            "AttackEvidenceIncidentIDs": null,
            "EndDate": null,
            "Id": 2351,
            "ImageId": "id",
            "ImageThumbnailId": "id",
            "IndicatorOfCompromiseCount": 0,
            "LastActive": "2016-07-20T22:00:00.000Z",
            "LatestIncident": null,
            "LatestIncidentID": null,
            "Recurring": null,
            "StartDate": null,
            "Tags": {
                "ActorTypeTags": [
                    {
                        "id": 1107,
                        "name": "Hacker - Black hat",
                        "type": "ACTOR_TYPE"
                    },
                ],
                "AssociatedActorTags": [
                    {
                        "id": 3208,
                        "name": "Peace of Mind",
                        "type": "ACTOR"
                    },
                ],
                "AssociatedCampaignTags": [],
                "ImpactEffectTags": [
                    {
                        "id": 424,
                        "name": "Data Breach or Compromise",
                        "type": "IMPACT_EFFECTS"
                    },
                    {
                        "id": 431,
                        "name": "Unintended Access",
                        "type": "IMPACT_EFFECTS"
                    }
                ],
                "IntendedEffectTags": [
                    {
                        "id": 418,
                        "name": "Unauthorised Access",
                        "type": "INTENDED_EFFECTS"
                    },
                    {
                        "id": 412,
                        "name": " Exposure",
                        "type": "INTENDED_EFFECTS"
                    }
                ],
                "MotivationTags": [
                    {
                        "id": 434,
                        "name": "Ideological - Anti-Corruption",
                        "type": "MOTIVATION"
                    },
                    {
                        "id": 440,
                        "name": "Ideological - Security Awareness",
                        "type": "MOTIVATION"
                    }
                ],
                "OverviewTags": [
                    {
                        "id": 1874,
                        "name": "Data Leakage",
                        "parent": {
                            "id": 2684
                        },
                        "type": "GENERAL_TTP"
                    },
                    {
                        "id": 1088,
                        "name": "Government",
                        "type": "TARGET_SECTORS"
                    }
                ],
                "PrimaryLanguageTags": [
                    {
                        "id": 467,
                        "name": "English",
                        "type": "LANGUAGE"
                    },
                    {
                        "id": 526,
                        "name": "Spanish",
                        "type": "LANGUAGE"
                    }
                ],
                "PrimaryTag": {
                    "id": 3177,
                    "name": "CthulhuSec",
                    "type": "ACTOR"
                },
                "SourceGeographyTags": []
            },
            "ThreatLevel": "LOW",
            "Type": "ACTOR"
        }
    }
}
```

#### Human Readable Output

>### Digital Shadows Intelligence Threat
>
> ActivityLevel| AnnouncementIncidentIDs| AptReportIDs| AssociatedEventIDs| AttackEvidenceIncidentIDs| EndDate| Id| ImageId| ImageThumbnailId| IndicatorOfCompromiseCount| LastActive| LatestIncident| LatestIncidentID| Recurring| StartDate| ThreatLevel| Type
>---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
>INACTIVE |   |   |   |   |   | 2351 | id | id | 0 | 2016-07-20T22:00:00.000Z |   |   |   |   | LOW | ACTOR

### ds-get-intelligence-threat-iocs

***
Retrieve the indicatorsOfCompromise for a threat record

#### Base Command

`ds-get-intelligence-threat-iocs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| threat_id | The intelligence threat identifier | Required |
| filter_types | List of types to filter by. Possible values are IP,MD5,SHA1,SHA256,URL,CVE,EMAIL,HOST,REGISTRY,FILEPATH,FILENAME | Optional |
| filter_value | Value to filter by | Optional |
| visible | List of values to control the visibility of elements. If a value is present then the correspinding element should be displayed | Optional |
| sort_direction | The direction of sorting. If not specified, ASCENDING is assumed | Optional |
| sort_property | The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. | Optional |
| pagination_containingId | Select the page containing the record with this id, if supported. Mutually exclusive with offset. | Optional |
| pagination_offset | Include results at this offset within the full resultset, where the first result is at position 0 | Optional |
| pagination_size | Maximum number of results to return per page, can be initially null to be replaced by default later | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IntelligenceThreatIOCs.AptReportId | unknown | If this IOC is associated with an APT report |
| DigitalShadows.IntelligenceThreatIOCs.Id | unknown | Internal identifier for uniquely identifying this IOC |
| DigitalShadows.IntelligenceThreatIOCs.IntelIncidentId | unknown | If this IOC is associated with an intel incident |
| DigitalShadows.IntelligenceThreatIOCs.LastUpdated | unknown | When this record last changed |
| DigitalShadows.IntelligenceThreatIOCs.Source | unknown | A comment provided by the analysts as to where this IOC came from |
| DigitalShadows.IntelligenceThreatIOCs.Type | unknown | Identifies the type of incidicator that also determines how it is encoded into a string |
| DigitalShadows.IntelligenceThreatIOCs.Value | unknown | The value of this indicator, encoded according to its type. For example hashes are base16 encoded. |

#### Command Example

Human Readable Output

ds-get-intelligence-threat-activity

Threat activity based on the number of intelligence incidents over a given period of time.

Base Command

ds-get-intelligence-threat-activity

Input

Context Output

There is no context output for this command.

Command Example

!ds-get-intelligence-threat-activity threat_id=2351 filter_dateRange=2016-08-16T19:55:00.000Z/2016-09-16T19:55:00.000Z

Human Readable Output

{“tagActivities”:[{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:1,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:1,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:4,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:0,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:0,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:11303017,”scope”:”GLOBAL”},{“id”:11300637,”scope”:”GLOBAL”},{“id”:11212704,”scope”:”GLOBAL”},{“id”:11187135,”scope”:”GLOBAL”},{“id”:11187153,”scope”:”GLOBAL”},{“id”:11186833,”scope”:”GLOBAL”}],”tag”:{“id”:3065,”name”:”The Real Deal”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:2144,”threatLevel”:{“type”:”LOW”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”},{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:0,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:1,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:0,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:1,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:0,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:11258586,”scope”:”GLOBAL”},{“id”:10924047,”scope”:”GLOBAL”}],”tag”:{“id”:4742,”name”:”CrdClub”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:3199,”threatLevel”:{“type”:”LOW”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”},{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:1,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:0,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:0,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:0,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:0,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:11303017,”scope”:”GLOBAL”}],”tag”:{“id”:3044,”name”:”Hell Forum”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:2122,”threatLevel”:{“type”:”MEDIUM”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”},{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:0,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:1,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:0,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:0,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:0,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:11222970,”scope”:”GLOBAL”}],”tag”:{“id”:6966,”name”:”Hansa”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:4159,”threatLevel”:{“type”:”VERY_LOW”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”},{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:0,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:0,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:0,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:1,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:0,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:10923947,”scope”:”GLOBAL”}],”tag”:{“id”:3048,”name”:”AlphaBay”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:2126,”threatLevel”:{“type”:”VERY_LOW”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”},{“counts”:[{“count”:0,”key”:”2016-09-13T19:55:00.001Z/2016-09-16T19:55:00.000Z”},{“count”:0,”key”:”2016-09-10T19:55:00.001Z/2016-09-13T19:55:00.000Z”},{“count”:0,”key”:”2016-09-07T19:55:00.001Z/2016-09-10T19:55:00.000Z”},{“count”:0,”key”:”2016-09-04T19:55:00.001Z/2016-09-07T19:55:00.000Z”},{“count”:0,”key”:”2016-09-01T19:55:00.001Z/2016-09-04T19:55:00.000Z”},{“count”:0,”key”:”2016-08-29T19:55:00.001Z/2016-09-01T19:55:00.000Z”},{“count”:0,”key”:”2016-08-26T19:55:00.001Z/2016-08-29T19:55:00.000Z”},{“count”:0,”key”:”2016-08-23T19:55:00.001Z/2016-08-26T19:55:00.000Z”},{“count”:0,”key”:”2016-08-20T19:55:00.001Z/2016-08-23T19:55:00.000Z”},{“count”:1,”key”:”2016-08-17T19:55:00.001Z/2016-08-20T19:55:00.000Z”},{“count”:0,”key”:”2016-08-16T19:55:00.000Z/2016-08-17T19:55:00.000Z”}],”from”:”2016-08-16T19:55:00.000Z”,”incidents”:[{“id”:10847816,”scope”:”GLOBAL”}],”tag”:{“id”:3121,”name”:”DownThem”,”threat”:{“activityLevel”:”INACTIVE”,”closedSource”:false,”id”:2275,”threatLevel”:{“type”:”LOW”},”type”:”LOCATION”}},”until”:”2016-09-16T19:55:00.000Z”}],”threatType”:”LOCATION”,”timeSpanDays”:31}

ds-find-intelligence-threats

Find intelligence threat records

Base Command

ds-find-intelligence-threats

Input

Context Output

Command Example

!ds-find-intelligence-threats filter_dateRange=2016-08-16T19:55:00.000Z/2016-08-16T19:55:00.000Z

Context Example

{
    "DigitalShadows": {
        "IntelligenceThreats": {
            "ActivityLevel": "INACTIVE",
            "Event": null,
            "Id": 5013,
            "ImageId": null,
            "LastActive": "2016-08-16T19:55:00.000Z",
            "ThreatLevelType": "LOW",
            "Type": "SPECIFIC_TTP"
        }
    }
}

Human Readable Output

Digital Shadows Intelligence Threats

ActivityLevel	Event	Id	ImageId	LastActive	ThreatLevelType	Type
INACTIVE		5013		2016-08-16T19:55:00.000Z	LOW	SPECIFIC_TTP

ds-find-intelligence-threats-regional

Threat profiles associated with incidents over a given time range

Base Command

ds-find-intelligence-threats-regional

Input

Context Output

Command Example

#### Human Readable Output

### ds-get-port-reviews

***
Retrieve all review updates for a given port inspection

#### Base Command

`ds-get-port-reviews`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| port | Port inspection id | Required |
| incidentId | ID of incident to query | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IpPortReviews.Created | unknown | The moment in time the review was created |
| DigitalShadows.IpPortReviews.Status | unknown | Review status |
| DigitalShadows.IpPortReviews.Version | unknown | Starts counting at 1 and increments for each review of a given port. Will initially be 0 until a review is performed \(when returned as part of a port\) |
| DigitalShadows.IpPortReviews.Incident.Id | unknown | Id of the incident the port inspection is associated with |
| DigitalShadows.IpPortReviews.Incident.Scope | unknown | Scope of the incident the port inspection is associated with |
| DigitalShadows.IpPortReviews.User.Id | unknown | ID of the user that changed the status/set the note. |
| DigitalShadows.IpPortReviews.User.FullName | unknown | Full name of the user that changed the status/set the note. |

#### Command Example

Human Readable Output

ds-snapshot-port-review

Snapshot the review status of a port inspection

Base Command

ds-snapshot-port-review

Input

Context Output

There is no context output for this command.

Command Example

#### Human Readable Output

### ds-find-ports

***
Find ports

#### Base Command

`ds-find-ports`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| filter_alerted | Only include SSL/certificates with associated incidents that have been alerted | Optional |
| filter_detectedClosed | Only return IP ports that were detected closed | Optional |
| filter_detectedOpen | Only return IP ports that were detected open within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. | Optional |
| filter_domainName | Name of domain to filter by | Optional |
| filter_incidentTypes | The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. | Optional |
| filter_incidentSubTypes | List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT | Optional |
| filter_ipAddress | IP address to filter by | Optional |
| filter_ipRange_lowerAddress | Lower address for ip range | Optional |
| filter_ipRange_maskBits | Int value for mask bits | Optional |
| filter_ipRange_upperAddress | Upper address for ip range | Optional |
| filter_markedClosed | Is incident closed | Optional |
| filter_published | Only return IP ports that were published within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. | Optional |
| filter_severities | Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE | Optional |
| sort_direction | The direction of sorting. If not specified, ASCENDING is assumed | Optional |
| sort_property | The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. | Optional |
| pagination_offset | Include results at this offset within the full resultset, where the first result is at position 0 | Optional |
| pagination_size | Maximum number of results to return per page, can be initially null to be replaced by default later | Optional |
| pagination_containingId | Select the page containing the record with this id, if supported. Mutually exclusive with offset. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DigitalShadows.IpPorts.DiscoveredOpen | unknown | When was the port found to be open |
| DigitalShadows.IpPorts.Id | unknown | Identifier for the port inspection |
| DigitalShadows.IpPorts.IpAddress | unknown | The IP address this port was found on |
| DigitalShadows.IpPorts.PortNumber | unknown | The IP port number scanned \(1-65535\) |
| DigitalShadows.IpPorts.Transport | unknown | IP transport protocol used |
| DigitalShadows.IpPorts.Incident.Id | unknown | Id the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.Scope | unknown | Scope of the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.Severity | unknown | Severity of the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.SubType | unknown | Subtype of the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.Type | unknown | Type of the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.Title | unknown | Title of the most recent incident to include this port |
| DigitalShadows.IpPorts.Incident.Published | unknown | Published time the most recent incident to include this port |
| DigitalShadows.IpPorts.Review.Status | unknown | Status of when the port was last reviewed |
| DigitalShadows.IpPorts.Review.UserId | unknown | User Id of the port last review |
| DigitalShadows.IpPorts.Review.UserName | unknown | Name of user who created last review |
| DigitalShadows.IpPorts.Review.Version | unknown | Version of last port review |

#### Command Example

```!ds-find-ports pagination_size=1```

#### Context Example

```json
{
    "DigitalShadows": {
        "IpPorts": [
            {
                "DiscoveredOpen": "2018-08-22T00:58:07.014Z",
                "Id": 8247047,
                "Incident": {
                    "Id": 99002722,
                    "Published": "2020-11-03T21:44:41.840Z",
                    "Scope": "ORGANIZATION",
                    "Severity": "MEDIUM",
                    "SubType": "EXPOSED_PORT",
                    "Title": "Block listed open ports found on IP",
                    "Type": "INFRASTRUCTURE"
                },
                "IpAddress": "1.2.3.4",
                "PortNumber": 179,
                "Review": {
                    "Status": "OPEN",
                    "UserId": null,
                    "UserName": null,
                    "Version": null
                },
                "Transport": "TCP"
            }
        ]
    }
}

Human Readable Output

Digital Shadows Ports

DiscoveredOpen	Id	Incident Id	Incident Published	Incident Scope	Incident Severity	Incident SubType	Incident Title	Incident Type	IpAddress	PortNumber	Review Status	Review UserId	Review UserName	Review Version	Transport
2018-08-22T00:58:07.014Z	8247047	99002722	2020-11-03T21:44:41.840Z	ORGANIZATION	MEDIUM	EXPOSED_PORT	Blacklisted open ports found on IP	INFRASTRUCTURE	1.2.3.4	179	OPEN				TCP

ds-find-secure-sockets

Find secure sockets

Base Command

ds-find-secure-sockets

Input

Context Output

ds-find-vulnerabilities

Find vulnerabilities

Base Command

ds-find-vulnerabilities

Input

Context Output

Command Example

!ds-find-vulnerabilities pagination_size=2

Context Example

{
    "DigitalShadows": {
        "Vulnerabilities": [
            {
                "CveId": "CVE-id",
                "Discovered": "2018-04-12T14:15:51.991Z",
                "Id": 529072,
                "Incident": {
                    "Id": 99002720,
                    "Published": "2020-11-04T17:32:57.855Z",
                    "Scope": "ORGANIZATION",
                    "Severity": "VERY_HIGH",
                    "SubType": "CVE",
                    "Title": "CVE with 4 exploits detected on 1.2.3.4.\r\n",
                    "Type": "INFRASTRUCTURE"
                },
                "IpAddress": "1.2.3.4",
                "Review": {
                    "Status": "UNREAD",
                    "UserId": null,
                    "UserName": null,
                    "Version": null
                }
            },
            {
                "CveId": "CVE-2018-6789",
                "Discovered": "2019-01-27T17:39:55.428Z",
                "Id": 879356,
                "Incident": {
                    "Id": 99002711,
                    "Published": "2020-11-04T23:54:22.672Z",
                    "Scope": "ORGANIZATION",
                    "Severity": "HIGH",
                    "SubType": "CVE",
                    "Title": "CVE with 2 exploits detected on 2.2.2.2",
                    "Type": "INFRASTRUCTURE"
                },
                "IpAddress": "2.2.2.2",
                "Review": {
                    "Status": "UNREAD",
                    "UserId": null,
                    "UserName": null,
                    "Version": null
                }
            }
        ]
    }
}

Human Readable Output

Digital Shadows Vulnerabilities

CveId	Discovered	Id	Incident Id	Incident Published	Incident Scope	Incident Severity	Incident SubType	Incident Title	Incident Type	IpAddress	Review Status	Review UserId	Review UserName	Review Version
CVE-id	2018-04-12T14:15:51.991Z	529072	99002720	2020-11-04T17:32:57.855Z	ORGANIZATION	VERY_HIGH	CVE	CVE with 4 exploits detected on 1.2.3.4.	INFRASTRUCTURE	1.2.3.4	UNREAD
CVE-id	2019-01-27T17:39:55.428Z	879356	99002711	2020-11-04T23:54:22.672Z	ORGANIZATION	HIGH	CVE	CVE with 2 exploits detected on 2.2.2.2	INFRASTRUCTURE	2.2.2.2	UNREAD

ds-search

Perform a textual search against the available record types

Base Command

ds-search

Input

Context Output

There is no context output for this command.

Command Example

!ds-search query=breach pagination_size=1

Human Readable Output

{“content”:[{“entity”:{“author”:”name”,”id”:”id”,”observableCounts”:{“cve”:{“count”:1,”exceededMaximum”:false},”email”:{“count”:0,”exceededMaximum”:false},”host”:{“count”:0,”exceededMaximum”:false},”ipV4”:{“count”:0,”exceededMaximum”:false},”md5”:{“count”:0,”exceededMaximum”:false},”sha1”:{“count”:0,”exceededMaximum”:false},”sha256”:{“count”:0,”exceededMaximum”:false}},”published”:”2016-05-16T00:00:00.000Z”,”screenshot”:{“id”:”id,”link”:”https://portal-digitalshadows.com/api/external/resources/id”},”screenshotThumbnail”:{“id”:”id”,”link”:”https://portal-digitalshadows.com/api/thumbnails/id.jpg”},”siteCategories”:[“BLOG”,”SECURITY_COMMENTATOR”],”title”:”The popular crime forum nnn…”,”sortDate”:”2016-05-16T00:00:00.000Z”,”type”:”BLOG_POST”}],”currentPage”:{“offset”:0,”size”:1},”facets”:{},”total”:284483}

ds-get-tags

Batch retrieve specic tags by their ids

Base Command

ds-get-tags

Input

Context Output

There is no context output for this command.