Expanse Deprecated

Deprecated. Use the Expanse v2 integration instead. The Expanse App for Demisto leverages the Expander API to retrieve network exposures and risky flows to create incidents in Demisto. This application also allows for IP, Domain, Certificate, Behavior, and Exposure enrichment, retrieving assets and exposures information drawn from Expanse’s unparalleled view of the Internet.

Data Enrichment & Threat Intelligence · Expanse (Deprecated)

Details

IDExpanse
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.9.5.21272

README

Overview

The Expanse App for Cortex XSOAR leverages the Expander API to retrieve network exposures and create incidents in Cortex XSOAR. This application also allows for IP, Domain, Certificate, and Behavior enrichment, retrieving assets and exposures information drawn from Expanse’s unparalleled view of the Internet.
This integration was integrated and tested with Expanse Events API v1, Assets API v2, and Behavior API v1.

Configure Expanse on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Expanse.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • API Key
    • Fetch incidents
    • Include Behavior data in incidents
    • Trust any certificate (not secure)
    • Use system proxy settings
    • How many events to pull from Expander per run
    • How many days to pull past events on first run
    • Minimum severity of Expanse Exposure to create an incident for
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

{
    'eventType': 'ON_PREM_EXPOSURE_APPEARANCE',
    'eventTime': '2020-02-05T00:00:00Z',
    'businessUnit': {
        'id': 'a1f0f39b-f358-3c8c-947b-926887871b88',
        'name': 'VanDelay Import-Export'
    },
    'payload': {
        '_type': 'ExposurePayload',
        'id': 'b0acfbc5-4d55-3fdb-9155-4927eab91218',
        'exposureType': 'NTP_SERVER',
        'ip': '203.215.173.113',
        'port': 123,
        'portProtocol': 'UDP',
        'exposureId': '6bedf636-5b6a-3b47-82a5-92b511c0649b',
        'domainName': None,
        'scanned': '2020-02-05T00:00:00Z',
        'geolocation': {
            'latitude': 33.7,
            'longitude': 73.17,
            'city': 'ISLAMABAD',
            'regionCode': '',
            'countryCode':
                'PK'
        },
        'configuration': {
            '_type': 'NtpServerConfiguration',
            'response': {
                'ntp': {
                    'leapIndicator': 0,
                    'mode': 4,
                    'poll': 4,
                    'precision': -19,
                    'stratum': 5,
                    'delay': 0,
                    'dispersion': 22,
                    'version': 4,
                    'originateTime': '2004-11-24T15:12:11.444Z',
                    'receiveTime': '2020-02-05T14:25:08.963Z',
                    'updateTime': '2020-02-05T14:25:01.597Z',
                    'transmitTime': '2020-02-05T14:25:08.963Z',
                    'reference': {
                        'ref_ip': {
                            'reference': {
                                'ipv4': '127.127.1.1'
                            }
                        }
                    },
                    'extentionData': None,
                    'keyIdentifier': None,
                    'messageDigest': None
                }
            }
        },
        'severity': 'ROUTINE',
        'tags': {
            'ipRange': ['untagged']
        },
        'providers': ['InternallyHosted'],
        'certificatePem': None,
        'remediationStatuses': []
    },
    'id': 'b4a1e2e6-165a-31a5-9e6a-af286adc3dcd'
}

Fetched Behavior Incident Data

{
    "id": "c9704240-5021-321e-a82b-32865e07d541",
    "tenantBusinessUnitId": "04b5140e-bbe2-3e9c-9318-a39a3b547ed5",
    "businessUnit": {
        "id": "6b73ef6c-b230-3797-b321-c4a340169eb7",
        "name": "Acme Latex Supply"
    },
    "riskRule": {
        "id": "02b6c647-65f4-4b69-b4b0-64af34fd1b29",
        "name": "Connections to and from countries on block list",
        "description": "Connections to and from countries on block list (Belarus, Côte d'Ivoire, Cuba, Democratic Republic of the Congo, Iran, Iraq, Liberia, North Korea, South Sudan, Sudan, Syria, Zimbabwe)",
        "additionalDataFields": "[]"
    },
    "internalAddress": "184.174.38.51",
    "internalPort": 35125,
    "externalAddress": "217.218.108.188",
    "externalPort": 443,
    "flowDirection": "OUTBOUND",
    "acked": true,
    "protocol": "TCP",
    "externalCountryCodes": [
        "IR"
    ],
    "internalCountryCodes": [
        "US"
    ],
    "externalCountryCode": "IR",
    "internalCountryCode": "US",
    "internalExposureTypes": [],
    "internalDomains": [],
    "internalTags": {
        "ipRange": []
    },
    "observationTimestamp": "2020-03-23T14:59:04.211Z",
    "created": "2020-03-24T02:45:28.450131Z"
}

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. ip
  2. domain
  3. expanse-get-certificate
  4. expanse-get-behavior
  5. expanse-get-exposures
  6. expanse-get-domains-for-certificate

1. ip

ip command

Required Permissions

none

Base Command

ip

Input
Argument Name Description Required
ip ip address Required
Context Output
Path Type Description
IP.Address String Internet Protocol Address
IP.Geo.Location String The geolocation where the IP address is located, in the format: latitude:longitude
IP.Geo.Country String The country in which the IP address is located.
IP.Geo.Description String Additional information about the location
Expanse.IP.Address String Internet Protocol Address
Expanse.IP.Version String Internet Protocol Address Version
Expanse.IP.BusinessUnits String Expanse Business Units this IP belongs to
Expanse.IP.IPRange.StartAdress String First IP address in IP Network this IP address belongs to
Expanse.IP.IPRange.EndAddress String Last IP address in IP Network this IP address belongs to
Expanse.IP.IPRange.RangeSize Number Number of IP addresses in IP Network this IP address belongs to
Expanse.IP.IPRange.ResponsiveIPCount Number Number of responsive IP addresses in IP Network this IP address belongs to
Expanse.IP.IPRange.RangeIntroduced Date Date the IP network this IP address belongs to was introduced to Expanse
Expanse.IP.IPRange.AttributionReasons String The reason why this IP belongs to the IP Range
Expanse.IP.Geo.Latitude String Geo coordinates: Latitude of IP address
Expanse.IP.Geo.Longitude String Geo coordinates: Longitude of IP address
Expanse.IP.Geo.City String Geo coordinates city for this IP address
Expanse.IP.Geo.RegionCode String Geo coordinates Region Code for this IP address
Expanse.IP.Geo.CountryCode String Geo coordinates Country Code for this IP address
Expanse.IP.Annotations.Tags String Customer defined Tags from Expanse related to this IP Range
Expanse.IP.Annotations.AdditionalNotes String Customer defined Notes from Expanse related to this IP Range
Expanse.IP.Annotations.PointsOfContact String Customer defined Points of Contact from Expanse related to this IP Range
Expanse.IP.SeverityCounts.CRITICAL Number Count of CRITICAL Events for this IP address
Expanse.IP.SeverityCounts.ROUTINE Number Count of ROUTINE Events for this IP address
Expanse.IP.SeverityCounts.WARNING Number Count of WARNING Events for this IP address
Expanse.IP.Geo.Description String Additional information about the location
Expanse.IP.Geo.Country String The country in which the IP address is located.
Command Example

!ip ip=74.142.119.130

Context Example
{
    "IP": {
        "Geo": {
            "Country": "US", 
            "Description": "AKRON", 
            "Location": "41.0433:-81.5239"
        }, 
        "Address": "74.142.119.130"
    }, 
    "DBotScore": {
        "Vendor": "Expanse", 
        "Indicator": "74.142.119.130", 
        "Score": 0, 
        "Type": "ip"
    }, 
    "Expanse.IP": {
        "Version": "4", 
        "Annotations": {
            "AdditionalNotes": "", 
            "Tags": [], 
            "PointsOfContact": []
        }, 
        "BusinessUnits": [
            "Acme Latex Supply"
        ], 
        "SeverityCounts": {
            "CRITICAL": 2, 
            "WARNING": 4, 
            "ROUTINE": 2
        }, 
        "Address": "74.142.119.130", 
        "Geo": {
            "City": "AKRON", 
            "Description": "AKRON", 
            "CountryCode": "US", 
            "Longitude": -81.5239, 
            "RegionCode": "OH", 
            "Location": "41.0433:-81.5239", 
            "Latitude": 41.0433
        }, 
        "IPRange": {
            "AttributionReasons": [
                "This parent range is attributed via IP network registration records for 74.142.119.128\u201374.142.119.135"
            ], 
            "ResponsiveIPCount": 1, 
            "EndAddress": "74.142.119.135", 
            "RangeIntroduced": "2019-08-02", 
            "StartAddress": "74.142.119.128", 
            "RangeSize": 8
        }
    }
}
Human Readable Output

IP information for: 74.142.119.130

Address Annotations BusinessUnits Geo IPRange SeverityCounts Version
74.142.119.130 AdditionalNotes: null
PointsOfContact: null
Tags: null		 Acme Latex Supply Description: AKRON
Latitude: 41.0433
Longitude: -81.5239
City: AKRON
RegionCode: OH
CountryCode: US
Location: 41.0433:-81.5239		 StartAddress: 74.142.119.128
EndAddress: 74.142.119.135
RangeSize: 8
ResponsiveIPCount: 2
RangeIntroduced: 2019-08-02
AttributionReasons: This parent range is attributed via IP network registration records for 74.142.119.128–74.142.119.135		 CRITICAL: 1
ROUTINE: 4
WARNING: 2		 4

2. domain

domain command

Required Permissions

none

Base Command

domain

Input
Argument Name Description Required
domain domain to search Required
Context Output
Path Type Description
Domain.Name String The domain name, for example: “google.com
Domain.DNS String A list of IP objects resolved by DNS
Domain.CreationDate Date The date that the domain was created
Domain.DomainStatus String The status of the domain
Domain.ExpirationDate Date The expiration date of the domain
Domain.NameServers String Name servers of the domain
Domain.Organization String The organization of the domain
Domain.Admin.Country String The country of the domain administrator
Domain.Admin.Email String The email of the domain administrator
Domain.Admin.Name String The name of the domain administrator
Domain.Admin.Phone String The phone of the domain administrator
Domain.Registrant.Country String The country of the registrant
Domain.Registrant.Email String The email of the registrant
Domain.Registrant.Name String The name of the registrant
Domain.Registrant.Phone String The phone of the registrant
Domain.WHOIS.DomainStatus String The status of the domain
Domain.WHOIS.NameServers String A list of name servers, for example: “ns1.bla.com, ns2.bla.com”
Domain.WHOIS.CreationDate Date The date that the domain was created
Domain.WHOIS.UpdatedDate Date The date that the domain was last updated
Domain.WHOIS.ExpirationDate Date The date that the domain expires
Domain.WHOIS.Registrant.Email String The email address of the registrant
Domain.WHOIS.Registrant.Name String The name of the registrant
Domain.WHOIS.Registrant.Phone String The phone of the registrant
Domain.WHOIS.Registrar.Name String The name of the registrar, for example: “GoDaddy”
Domain.WHOIS.Registrar.AbuseEmail String The email address of the contact for reporting abuse
Domain.WHOIS.Registrar.AbusePhone Unknown The phone number of contact for reporting abuse
Domain.WHOIS.Admin.Name String The name of the domain administrator
Domain.WHOIS.Admin.Email String The email address of the domain administrator
Domain.WHOIS.Admin.Phone Unknown The phone number of the domain administrator
Expanse.Domain.Name String The domain name, for example: “google.com
Expanse.Domain.DateAdded Date Date the domain was added to Expanse
Expanse.Domain.FirstObserved Date Date Expanse first observed the domain
Expanse.Domain.LastObserved Date Date Expanse last observed the domain
Expanse.Domain.HasLinkedCloudResources Boolean Does this domain have linked cloud resources ?
Expanse.Domain.SourceDomain String Top level domain
Expanse.Domain.Tenant String Customer defined Tenant from Expanse
Expanse.Domain.BusinessUnits String Customer defined Business Units from Expanse
Expanse.Domain.DNSSEC String DNSSEC info
Expanse.Domain.RecentIPs String Any recent IP addresses Expanse has seen for this domain
Expanse.Domain.CloudResources String Any Cloud Resources Expanse has seen for this domain
Expanse.Domain.LastSubdomainMetadata String Any recent subdomain metadata Expanse has seen for this domain
Expanse.Domain.ServiceStatus String Service Status Expanse sees for this domain
Expanse.Domain.LastSampledIP String Last seen IP address for this domain
Expanse.Domain.DNS String A list of IP objects resolved by DNS
Expanse.Domain.CreationDate Date The date that the domain was created
Expanse.Domain.DomainStatus String The status of the domain
Expanse.Domain.ExpirationDate Date The expiration date of the domain
Expanse.Domain.NameServers String Name servers of the domain
Expanse.Domain.Organization String The organization of the domain
Expanse.Domain.Admin.Country String The country of the domain administrator
Expanse.Domain.Admin.Email String The email address of the domain administrator
Expanse.Domain.Admin.Name String The name of the domain administrator
Expanse.Domain.Admin.Phone String The phone number of the domain administrator
Expanse.Domain.Registrant.Country String The country of the registrant
Expanse.Domain.Registrant.Email String The email address of the registrant
Expanse.Domain.Registrant.Name String The name of the registrant
Expanse.Domain.Registrant.Phone String The phone number for receiving abuse reports
Expanse.Domain.WHOIS.DomainStatus String The status of the domain
Expanse.Domain.WHOIS.NameServers String A list of name servers, for example: “ns1.bla.com, ns2.bla.com”
Expanse.Domain.WHOIS.CreationDate Date The date that the domain was created
Expanse.Domain.WHOIS.UpdatedDate String The date that the domain was last updated
Expanse.Domain.WHOIS.ExpirationDate String The date that the domain expires
Expanse.Domain.WHOIS.Registrant.Email String The email address of the registrant
Expanse.Domain.WHOIS.Registrant.Name String The name of the registrant
Expanse.Domain.WHOIS.Registrant.Phone String The phone number of the registrant
Expanse.Domain.WHOIS.Registrar.Name String The name of the registrar, for example: “GoDaddy”
Expanse.Domain.WHOIS.Registrar.AbuseEmail String The email address of the contact for reporting abuse
Expanse.Domain.WHOIS.Registrar.AbusePhone String The phone number of contact for reporting abuse
Expanse.Domain.WHOIS.Admin.Name String The name of the domain administrator
Expanse.Domain.WHOIS.Admin.Email String The email address of the domain administrator
Expanse.Domain.WHOIS.Admin.Phone String The phone number of the domain administrator
Command Example

!domain domain=atlas.enron.com

Context Example
{
    "Domain": {
        "Name": "atlas.enron.com", 
        "Admin": {
            "Phone": "14806242599", 
            "Country": "UNITED STATES", 
            "Email": "ENRON.COM@domainsbyproxy.com", 
            "Name": "Registration Private"
        }, 
        "DomainStatus": [
            "HAS_DNS_RESOLUTION"
        ], 
        "NameServers": [
            "NS73.DOMAINCONTROL.COM", 
            "NS74.DOMAINCONTROL.COM"
        ], 
        "ExpirationDate": "2019-10-10T04:00:00Z", 
        "DNS": [], 
        "Organization": "Domains By Proxy, LLC", 
        "CreationDate": "1995-10-10T04:00:00Z", 
        "Registrant": {
            "Phone": "14806242599", 
            "Country": "UNITED STATES", 
            "Email": "ENRON.COM@domainsbyproxy.com", 
            "Name": "Registration Private"
        }, 
        "WHOIS": {
            "Admin": {
                "Phone": "14806242599",
                "Email": "ENRON.COM@domainsbyproxy.com",
                "Name": "Registration Private"
            }, 
            "DomainStatus": [
                "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited"
            ], 
            "NameServers": [
                "NS73.DOMAINCONTROL.COM", 
                "NS74.DOMAINCONTROL.COM"
            ], 
            "UpdatedDate": "2015-07-29T16:20:56Z", 
            "Registrar": {
                "AbuseEmail": null, 
                "AbusePhone": null, 
                "Name": "GoDaddy.com, LLC"
            }, 
            "ExpirationDate": "2019-10-10T04:00:00Z", 
            "CreationDate": "1995-10-10T04:00:00Z", 
            "Registrant": {
                "Phone": "14806242599", 
                "Email": "ENRON.COM@domainsbyproxy.com", 
                "Name": "Registration Private"
            }
        }
    }, 
    "Expanse.Domain": {
        "LastSubdomainMetadata": null, 
        "WHOIS": {
            "Admin": {
                "Phone": "14806242599", 
                "Email": "ENRON.COM@domainsbyproxy.com", 
                "Name": "Registration Private"
            }, 
            "DomainStatus": [
                "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited"
            ], 
            "NameServers": [
                "NS73.DOMAINCONTROL.COM", 
                "NS74.DOMAINCONTROL.COM"
            ], 
            "UpdatedDate": "2015-07-29T16:20:56Z", 
            "Registrar": {
                "AbuseEmail": null, 
                "AbusePhone": null, 
                "Name": "GoDaddy.com, LLC"
            }, 
            "ExpirationDate": "2019-10-10T04:00:00Z", 
            "CreationDate": "1995-10-10T04:00:00Z", 
            "Registrant": {
                "Phone": "14806242599", 
                "Email": "ENRON.COM@domainsbyproxy.com", 
                "Name": "Registration Private"
            }
        }, 
        "DNSSEC": null, 
        "DomainStatus": [
            "HAS_DNS_RESOLUTION"
        ], 
        "HasLinkedCloudResources": false, 
        "SourceDomain": "enron.com", 
        "LastObserved": "2020-01-02T09:30:00.374Z", 
        "ExpirationDate": "2019-10-10T04:00:00Z", 
        "CloudResources": [], 
        "Tenant": "VanDelay Industries", 
        "Name": "atlas.enron.com", 
        "Admin": {
            "Phone": "14806242599", 
            "Country": "UNITED STATES", 
            "Email": "ENRON.COM@domainsbyproxy.com", 
            "Name": "Registration Private"
        }, 
        "LastSampledIP": "192.64.147.150", 
        "BusinessUnits": [
            "VanDelay Industries"
        ], 
        "DNS": [], 
        "RecentIPs": [], 
        "Organization": "Domains By Proxy, LLC", 
        "DateAdded": "2020-01-04T04:57:48.580Z", 
        "NameServers": [
            "NS73.DOMAINCONTROL.COM", 
            "NS74.DOMAINCONTROL.COM"
        ], 
        "FirstObserved": "2020-01-02T09:30:00.374Z", 
        "ServiceStatus": [
            "NO_ACTIVE_SERVICE", 
            "NO_ACTIVE_CLOUD_SERVICE", 
            "NO_ACTIVE_ON_PREM_SERVICE"
        ], 
        "CreationDate": "1995-10-10T04:00:00Z", 
        "Registrant": {
            "Phone": "14806242599", 
            "Country": "UNITED STATES", 
            "Email": "ENRON.COM@domainsbyproxy.com", 
            "Name": "Registration Private"
        }
    }, 
    "DBotScore": {
        "Vendor": "Expanse", 
        "Indicator": "atlas.enron.com", 
        "Score": 0, 
        "Type": "url"
    }
}
Human Readable Output

Domain information for: atlas.enron.com

Admin BusinessUnits CloudResources CreationDate DNS DNSSEC DateAdded DomainStatus ExpirationDate FirstObserved HasLinkedCloudResources LastObserved LastSampledIP LastSubdomainMetadata Name NameServers Organization RecentIPs Registrant ServiceStatus SourceDomain Tenant WHOIS
Country: UNITED STATES
Email: ENRON.COM@domainsbyproxy.com
Name: Registration Private
Phone: 14806242599		 VanDelay Industries   1995-10-10T04:00:00Z     2020-01-04T04:57:48.580Z HAS_DNS_RESOLUTION 2019-10-10T04:00:00Z 2020-01-02T09:30:00.374Z false 2020-01-02T09:30:00.374Z 192.64.147.150   atlas.enron.com NS73.DOMAINCONTROL.COM,
NS74.DOMAINCONTROL.COM		 Domains By Proxy, LLC   Country: UNITED STATES
Email: ENRON.COM@domainsbyproxy.com
Name: Registration Private
Phone: 14806242599		 NO_ACTIVE_SERVICE,
NO_ACTIVE_CLOUD_SERVICE,
NO_ACTIVE_ON_PREM_SERVICE		 enron.com VanDelay Industries DomainStatus: clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited
NameServers: NS73.DOMAINCONTROL.COM,
NS74.DOMAINCONTROL.COM
CreationDate: 1995-10-10T04:00:00Z
UpdatedDate: 2015-07-29T16:20:56Z
ExpirationDate: 2019-10-10T04:00:00Z
Registrant: {“Email”: “ENRON.COM@domainsbyproxy.com”, “Name”: “Registration Private”, “Phone”: “14806242599”}
Registrar: {“Name”: “GoDaddy.com, LLC”, “AbuseEmail”: null, “AbusePhone”: null}
Admin: {“Name”: “Registration Private”, “Email”: “ENRON.COM@domainsbyproxy.com”, “Phone”: “14806242599”}

3. expanse-get-certificate

expanse-get-certificate command

Required Permissions

none

Base Command

expanse-get-certificate

Input
Argument Name Description Required
common_name domain to search Required
Context Output
Path Type Description
Expanse.Certificate.SearchTerm string The common name searched for
Expanse.Certificate.CommonName string The certificate common name
Expanse.Certificate.FirstObserved date Certificate first observation date
Expanse.Certificate.LastObserved date Certificate last observation date
Expanse.Certificate.DateAdded date Date certificate was added to Expanse
Expanse.Certificate.Provider string The certificate provider
Expanse.Certificate.NotValidBefore date Certificate not-valid-before date
Expanse.Certificate.NotValidAfter date Certificate not-valid-after date
Expanse.Certificate.Properties string Certificate properties
Expanse.Certificate.MD5Hash string Certificate MD5 Hash
Expanse.Certificate.PublicKeyAlgorithm string Certificate public key algorithm used
Expanse.Certificate.PublicKeyBits number Public key size
Expanse.Certificate.BusinessUnits string Business Unit for certificate
Expanse.Certificate.CertificateAdvertisementStatus string Is Certificate advertised
Expanse.Certificate.ServiceStatus string Any detected services for the certificate
Expanse.Certificate.RecentIPs string Any recent IPs the certificate was detected on
Expanse.Certificate.CloudResources string Any cloud resources returning the certificate
Expanse.Certificate.PemSha1 string SHA1 hash of the certificate PEM
Expanse.Certificate.PemSha256 string SHA256 hash of the certificate PEM
Expanse.Certificate.Issuer.Name string Certificate Issuer name
Expanse.Certificate.Issuer.Email string Certificate Issuer email
Expanse.Certificate.Issuer.Country string Certificate Issuer country
Expanse.Certificate.Issuer.Org string Certificate Issuer Org
Expanse.Certificate.Issuer.Unit string Certificate Issuer Unit
Expanse.Certificate.Issuer.AltNames string Certificate Issuer alternative names
Expanse.Certificate.Issuer.Raw string Certificate Issuer raw details
Expanse.Certificate.Subject.Name string Certificate Subject name
Expanse.Certificate.Subject.Email string Certificate Subject email
Expanse.Certificate.Subject.Country string Certificate Subject country
Expanse.Certificate.Subject.Org string Certificate Subject Org
Expanse.Certificate.Subject.Unit string Certificate Subject Unit
Expanse.Certificate.Subject.AltNames string Certificate Subject alternative names
Expanse.Certificate.Subject.Raw string Certificate Subject raw details
Command Example

!expanse-get-certificate common_name=atlas.enron.com

Context Example
{
    "Expanse.Certificate": {
        "BusinessUnits": "VanDelay Industries",
        "CertificateAdvertisementStatus": "NO_CERTIFICATE_ADVERTISEMENT",
        "CloudResources": "",
        "CommonName": "atlas.enron.com",
        "DateAdded": "2019-11-21T09:14:27.308679Z",
        "FirstObserved": "2019-11-21T09:14:27.308679Z",
        "Issuer": {
            "AltNames": "",
            "Country": "US",
            "Email": null,
            "Name": "Let's Encrypt Authority X3",
            "Org": "Let's Encrypt",
            "Raw": "C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3",
            "Unit": null
        },
        "LastObserved": ""2019-12-19T09:13:47.208679Z",
        "MD5Hash": "VEwAbJfmIFAVcZ_x4lm42g==",
        "NotValidAfter": "2019-03-31T00:27:46Z",
        "NotValidBefore": "2018-12-31T00:27:46Z",
        "PemSha1": "3LAYlmV3xtn4ONJ3C9JN_ogz0u8=",
        "PemSha256": "kyERnydF-dzOuCCpG4jDnkGr4fI2a--lBZQz2hyhb30=",
        "Properties": "EXPIRED",
        "Provider": "None",
        "PublicKeyAlgorithm": "RSA",
        "PublicKeyBits": 2048,
        "RecentIPs": "",
        "SearchTerm": "atlas.enron.com",
        "ServiceStatus": "NO_ACTIVE_SERVICE,NO_ACTIVE_ON_PREM_SERVICE,NO_ACTIVE_CLOUD_SERVICE",
        "Subject": {
            "AltNames": "atlas.enron.com",
            "Country": "US",
            "Email": "ENRON.COM@domainsbyproxy.com",
            "Name": "atlas.enron.com",
            "Org": "ENRON",
            "Raw": "CN=api-dev.radioshack.com",
            "Unit": null
        }
    }
}
Human Readable Output

Certificate information for: atlas.enron.com

BusinessUnits CertificateAdvertisementStatus CloudResources CommonName DateAdded FirstObserved Issuer LastObserved MD5Hash NotValidAfter NotValidBefore PemSha1 PemSha256 Properties Provider PublicKeyAlgorithm PublicKeyBits RecentIPs SearchTerm ServiceStatus Subject
VanDelay Industries NO_CERTIFICATE_ADVERTISEMENT   atlas.enron.com 2019-11-21T09:14:27.308679Z   Name: Let’s Encrypt Authority X3
Email: null
Country: US
Org: Let’s Encrypt
Unit: null
AltNames:
Raw: C=US,O=Let’s Encrypt,CN=Let’s Encrypt Authority X3		   VEwAbJfmIFAVcZ_x4lm42g== 2019-03-31T00:27:46Z 2018-12-31T00:27:46Z 3LAYlmV3xtn4ONJ3C9JN_ogz0u8= kyERnydF-dzOuCCpG4jDnkGr4fI2a–lBZQz2hyhb30= EXPIRED None RSA 2048   atlas.enron.com NO_ACTIVE_SERVICE,NO_ACTIVE_ON_PREM_SERVICE,NO_ACTIVE_CLOUD_SERVICE Name: atlas.enron.com
Email: ENRON.COM@domainsbyproxy.com
Country: US
Org: null
Unit: null
AltNames: atlas.enron.com
Raw: CN=atlas.enron.com

4. expanse-get-behavior

expanse-get-behavior command

Required Permissions

none

Base Command

expanse-get-behavior

Input
Argument Name Description Required
ip ip to search Required
start_time ISO-8601 UTC timestamp denoting the earliest behavior data to fetch Required
Context Output
Path Type Description
Expanse.Behavior.SearchTerm string IP used to search
Expanse.Behavior.InternalAddress string IP internal to Organization
Expanse.Behavior.InternalCountryCode string Internal IP Country Geolocation country
Expanse.Behavior.BusinessUnit string Buisness unit of IP
Expanse.Behavior.InternalDomains string Known domains associated with IP
Expanse.Behavior.InternalIPRanges string Known Internal IP ranges containing IP
Expanse.Behavior.InternalExposureTypes string Known Exposures for IP
Expanse.Behavior.ExternalAddresses string External IP addresses with known communication to IP
Expanse.Behavior.FlowSummaries string Summaries of most recents risky flows for IP
Expanse.Behavior.Flows string Array of Flow Objects
Expanse.Behavior.Flows.InternalAddress string Internal IP address for flow
Expanse.Behavior.Flows.InternalPort number Internal Port for flow
Expanse.Behavior.Flows.InternalCountryCode string Internal country code for flow
Expanse.Behavior.Flows.ExternalAddress string External IP address for flow
Expanse.Behavior.Flows.ExternalPort number External Port for flow
Expanse.Behavior.Flows.ExternalCountryCode string External country code for flow
Expanse.Behavior.Flows.Timestamp date Timestamp of flow
Expanse.Behavior.Flows.Protocol string Protocol of flow (UDP, TCP)
Expanse.Behavior.Flows.Direction string Direction of flow
Expanse.Behavior.Flows.RiskRule string Risk rule violated by flow
Command Example

!expanse-get-behavior ip=74.142.119.130 start_time=7

Context Example
{
    "BusinessUnit": "VanDelay Industries",
    "ExternalAddresses": "66.110.49.36,66.110.49.72",
    "FlowSummaries": "74.142.119.130:57475 (US) -\u003e 66.110.49.72:443 (CA) TCP violates Outbound Flows from Servers at 2020-04-05T21:18:56.889Z\n74.142.119.130:61694 (US) -\u003e 66.110.49.36:443 (CA) TCP violates Outbound Flows from Servers at 2020-04-05T21:03:50.867Z\n",
    "Flows": [
        {
            "Direction": "OUTBOUND",
            "ExternalAddress": "66.110.49.72",
            "ExternalCountryCode": "CA",
            "ExternalPort": 443,
            "InternalAddress": "74.142.119.130",
            "InternalCountryCode": "US",
            "InternalPort": 57475,
            "Protocol": "TCP",
            "RiskRule": "Outbound Flows from Servers",
            "Timestamp": "2020-04-05T21:18:56.889Z"
        },
        {
            "Direction": "OUTBOUND",
            "ExternalAddress": "66.110.49.36",
            "ExternalCountryCode": "CA",
            "ExternalPort": 443,
            "InternalAddress": "74.142.119.130",
            "InternalCountryCode": "US",
            "InternalPort": 61694,
            "Protocol": "TCP",
            "RiskRule": "Outbound Flows from Servers",
            "Timestamp": "2020-04-05T21:03:50.867Z"
        }
    ],
    "InternalAddress": "74.142.119.130",
    "InternalCountryCode": "US",
    "InternalDomains": "",
    "InternalExposureTypes": "HttpServer",
    "InternalIPRanges": "",
    "SearchTerm": "74.142.119.130"
}
Human Readable Output

Expanse Behavior information for: 74.142.119.130

BusinessUnit ExternalAddresses FlowSummaries InternalAddress InternalCountryCode InternalDomains InternalExposureTypes InternalIPRanges SearchTerm
VanDelay Industries 66.110.49.36,66.110.49.72 74.142.119.130:57475 (US) -> 66.110.49.72:443 (CA) TCP violates Outbound Flows from Servers at 2020-04-05T21:18:56.889Z
74.142.119.130:61694 (US) -> 66.110.49.36:443 (CA) TCP violates Outbound Flows from Servers at 2020-04-05T21:03:50.867Z		 74.142.119.130 US   HttpServer   74.142.119.130

4. expanse-get-exposures

expanse-get-exposures command

Required Permissions

none

Base Command

expanse-get-exposures

Input
Argument Name Description Required
ip ip to search Required
Context Output
Path Type Description
Expanse.Exposures.SearchTerm string IP used to search
Expanse.Exposures.TotalExposureCount number The total count of exposures for the IP
Expanse.Exposures.CriticalExposureCount number The total count of CRITICAL exposures for the IP
Expanse.Exposures.WarningExposureCount number The total count of WARNING exposures for the IP
Expanse.Exposures.RoutineExposureCount number The total count of ROUTINE exposures for the IP
Expanse.Exposures.UnknownExposureCount number The total count of UNKNOWN exposures for the IP
Expanse.Exposures.ExposureSummaries string Summaries of exposures for the IP address
Expanse.Exposures.Exposures unknown Array of Exposures for the IP address
Expanse.Exposures.Exposures.ExposureType string Exposure type of the Exposure
Expanse.Exposures.Exposures.BusinessUnit string Business Unit of the Exposure
Expanse.Exposures.Exposures.Ip string IP Address the Exposure was found on
Expanse.Exposures.Exposures.Port string Port the Exposure was found on
Expanse.Exposures.Exposures.Severity string Severity of the Exposure
Expanse.Exposures.Exposures.Certificate unknown Certificate details associated with Exposure
Expanse.Exposures.Exposures.FirstObservsation unknown First Observation of the Exposure
Expanse.Exposures.Exposures.LastObservsation unknown Last Observation of the Exposure
Expanse.Exposures.Exposures.Status unknown Status details of the Exposure
Expanse.Exposures.Exposures.Provider unknown Provider details of the Exposure
Command Example

!expanse-get-exposures ip=33.2.243.123

Context Example
{
    "CriticalExposureCount": 0,
    "ExposureSummaries": "NTP_SERVER exposure on 33.2.243.123:UDP123",
    "Exposures": [
        {
            "BusinessUnit": "VanDelay Industries",
            "Certificate": null,
            "ExposureType": "NTP_SERVER",
            "FirstObservsation": {
                "configuration": {
                    "certificate": null,
                    "response": {
                        "ntp": {
                            "delay": 0,
                            "dispersion": 65537,
                            "extentionData": null,
                            "keyIdentifier": null,
                            "leapIndicator": 3,
                            "messageDigest": null,
                            "mode": 4,
                            "originateTime": "2004-11-24T15:12:11.444Z",
                            "poll": 4,
                            "precision": -18,
                            "receiveTime": "2019-02-01T00:32:17.693Z",
                            "reference": {
                                "ref_str": {
                                    "reference": ""
                                }
                            },
                            "stratum": 0,
                            "transmitTime": "2019-02-01T00:32:17.693Z",
                            "updateTime": "2036-02-07T06:28:16Z",
                            "version": 4
                        }
                    }
                },
                "geolocation": {
                    "city": "VICTOR",
                    "countryCode": "US",
                    "latitude": 42.982,
                    "longitude": -77.4245,
                    "regionCode": "NY"
                },
                "hostname": null,
                "id": "2d349139-1111-3c92-a168-557d34729bf8",
                "ip": "33.2.243.123",
                "portNumber": 123,
                "portProtocol": "UDP",
                "qrispTaskId": 21716146,
                "scanned": "2019-02-01T00:19:16Z"
            },
            "Ip": "33.2.243.123",
            "LastObservsation": {
                "configuration": {
                    "certificate": null,
                    "response": {
                        "ntp": {
                            "delay": 0,
                            "dispersion": 65537,
                            "extentionData": null,
                            "keyIdentifier": null,
                            "leapIndicator": 3,
                            "messageDigest": null,
                            "mode": 4,
                            "originateTime": "2004-11-24T15:12:11.444Z",
                            "poll": 4,
                            "precision": -18,
                            "receiveTime": "2020-05-05T16:05:36.606Z",
                            "reference": {
                                "ref_str": {
                                    "reference": ""
                                }
                            },
                            "stratum": 0,
                            "transmitTime": "2020-05-05T16:05:36.606Z",
                            "updateTime": "2036-02-07T06:28:16Z",
                            "version": 4
                        }
                    }
                },
                "geolocation": {
                    "city": "VICTOR",
                    "countryCode": "US",
                    "latitude": 42.982,
                    "longitude": -77.4245,
                    "regionCode": "NY"
                },
                "hostname": null,
                "id": "69a0159b-facc-3c55-b71d-3e6b8ae9252b",
                "ip": "33.2.243.123",
                "portNumber": 123,
                "portProtocol": "UDP",
                "qrispTaskId": 41755001,
                "scanned": "2020-05-05T16:03:30Z"
            },
            "Port": "UDP123",
            "Provider": null,
            "Severity": "ROUTINE",
            "Status": {
                "remediation": [],
                "snooze": []
            }
        }
    ],
    "RoutineExposureCount": 1,
    "SearchTerm": "33.2.243.123",
    "TotalExposureCount": 1,
    "UnknownExposureCount": 0,
    "WarningExposureCount": 0
}
Human Readable Output

Expanse Exposure information for: 33.2.243.123

CriticalExposureCount ExposureSummaries RoutineExposureCount SearchTerm TotalExposureCount UnknownExposureCount WarningExposureCount
0 NTP_SERVER exposure on 33.2.243.123:UDP123 1 33.2.243.123 1 0 0

4. expanse-get-domains-for-certificate

expanse-get-domains-for-certificate command

Required Permissions

none

Base Command

expanse-get-domains-for-certificate

Input
Argument Name Description Required
common_name The certificate common name Required
Context Output
Path Type Description
Expanse.IPDomains.SearchTerm string The common name that was searched
Expanse.IPDomains.TotalDomainCount number The number of domains found matching the specified certificate
Expanse.IPDomains.FlatDomainList number An array of all domain names found. This is truncated at 50
Expanse.IPDomains.DomainList number An array of domain objects. This is truncated at 50
Command Example

!expanse-get-domains-for-certificate common_name="*.us.expanse.co"

Context Example
{
    "SearchTerm": "*.us.expanse.co",
    "TotalDomainCount": 2,
    "FlatDomainList": ["california.us.expanse.co", "dc.us.expanse.co"]
    "DomainList": [
        {
            "ip": "33.2.243.123",
            "domain": "california.us.expanse.co",
            "type": "DOMAIN_RESOLUTION",
            "assetType": "DOMAIN",
            "assetKey": "california.us.expanse.co",
            "provider": {
                "id": "AWS",
                "name": "Amazon Web Services"
            },
            "lastObserved": "2020-06-22T05:20:32.883Z",
            "tenant": {
                "id": "4b7efca7-c595-408e-b4d1-634080e48367",
                "name": "Palo Alto Networks",
                "tenantId": "4b7efca7-c595-408e-b4d1-634080e48367"
            },
            "businessUnits": [
                {
                    "id": "a1f0f39b-f358-3c8c-947b-926887871b88",
                    "name": "VanDelay Import-Export"
                    "tenantId": "a1f0f39b-f358-3c8c-947b-926887871b88"
                }
            ],
            "commonName": null
        },
        {
            "ip": "33.2.243.123",
            "domain": "dc.us.expanse.co",
            "type": "DOMAIN_RESOLUTION",
            "assetType": "DOMAIN",
            "assetKey": "dc.us.expanse.co",
            "provider": {
                "id": "AWS",
                "name": "Amazon Web Services"
            },
            "lastObserved": "2020-06-21T07:20:32.883Z",
            "tenant": {
                "id": "4b7efca7-c595-408e-b4d1-634080e48367",
                "name": "Palo Alto Networks",
                "tenantId": "4b7efca7-c595-408e-b4d1-634080e48367"
            },
            "businessUnits": [
                {
                    "id": "a1f0f39b-f358-3c8c-947b-926887871b88",
                    "name": "VanDelay Import-Export"
                    "tenantId": "a1f0f39b-f358-3c8c-947b-926887871b88"
                }
            ],
            "commonName": null
        }
    ]
}
Human Readable Output

Expanse Domains matching Certificate Common Name: *.us.expanse.co

FlatDomainList SearchTerm TotalDomainCount
california.us.expanse.co, dc.us.expanse.co *.us.expanse.co 2

Contact Details

For Product Support, please contact your Technical Account Manager or email help@expanseinc.com

Configuration parameters

  • api_key — API Key (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • behavior — Include Behavior data in incidents
  • page_limit — How many events to pull from Expander per run
  • first_run — How many days to pull past events on first run
  • minimum_severity — Minimum severity of Expanse Exposure to create an incident for

Commands (6)

  • domain

    Submits a domain to check.

  • expanse-get-behavior

    Returns Risky Flows for the specified IP address. The maximum number of results is 20.

  • expanse-get-certificate

    Returns information about the domain certificate.

  • expanse-get-domains-for-certificate

    Returns all domains which have been seen with the specified certificate.

  • expanse-get-exposures

    Deprecated command by Expanse. Returns exposure information about the ip.

  • ip

    Submits an IP address to check.

Source

Expanse.py Expanse_test.py Expanse.yml Expanse_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
fromversion: 5.0.0
deprecated: true
commonfields:
  id: Expanse
  version: -1
configuration:
- display: API Key
  name: api_key
  required: true
  type: 4
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Include Behavior data in incidents
  name: behavior
  type: 8
  required: false
- defaultvalue: '10'
  display: How many events to pull from Expander per run
  name: page_limit
  type: 0
  required: false
- defaultvalue: '7'
  display: How many days to pull past events on first run
  name: first_run
  type: 0
  required: false
- display: Minimum severity of Expanse Exposure to create an incident for
  name: minimum_severity
  type: 15
  defaultvalue: WARNING
  options:
  - ROUTINE
  - WARNING
  - CRITICAL
  required: false
description: Deprecated. Use the Expanse v2 integration instead. The Expanse App for Demisto leverages the Expander API to retrieve network exposures and risky flows to create incidents in Demisto.  This application also allows for IP, Domain, Certificate, Behavior, and Exposure enrichment, retrieving assets and exposures information drawn from Expanse’s unparalleled view of the Internet.
display: Expanse (Deprecated)
name: Expanse
script:
  commands:
  - arguments:
    - default: true
      description: The IP address to search.
      isArray: true
      name: ip
      required: true
    description: Submits an IP address to check.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Geo.Location
      description: 'The geolocation where the IP address is located, in the format: latitude:longitude.'
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.Description
      description: Additional information about the location.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Expanse.IP.Address
      description: The IP address.
      type: String
    - contextPath: Expanse.IP.Version
      description: The IP address version.
      type: String
    - contextPath: Expanse.IP.BusinessUnits
      description: Expanse Business Units this IP belongs to.
      type: String
    - contextPath: Expanse.IP.IPRange.StartAdress
      description: The first IP address in the IP network this IP address belongs to.
      type: String
    - contextPath: Expanse.IP.IPRange.EndAddress
      description: The last IP address in the IP network this IP address belongs to.
      type: String
    - contextPath: Expanse.IP.IPRange.RangeSize
      description: The number of IP addresses in the IP network this IP address belongs to.
      type: Number
    - contextPath: Expanse.IP.IPRange.ResponsiveIPCount
      description: Number of responsive IP addresses in IP network this IP address belongs to.
      type: Number
    - contextPath: Expanse.IP.IPRange.RangeIntroduced
      description: Date the IP network this IP address belongs to was introduced to Expanse.
      type: Date
    - contextPath: Expanse.IP.IPRange.AttributionReasons
      description: The reason why this IP belongs to the IP range.
      type: String
    - contextPath: Expanse.IP.Geo.Latitude
      description: 'The latitude of the IP address.'
      type: String
    - contextPath: Expanse.IP.Geo.Longitude
      description: 'The longitude of the IP address.'
      type: String
    - contextPath: Expanse.IP.Geo.City
      description: The city in which the IP address is located.
      type: String
    - contextPath: Expanse.IP.Geo.RegionCode
      description: The region code for this IP address.
      type: String
    - contextPath: Expanse.IP.Geo.CountryCode
      description: The country code for this IP address.
      type: String
    - contextPath: Expanse.IP.Annotations.Tags
      description: Customer defined Tags from Expanse related to this IP range.
      type: String
    - contextPath: Expanse.IP.Annotations.AdditionalNotes
      description: Customer defined Notes from Expanse related to this IP range.
      type: String
    - contextPath: Expanse.IP.Annotations.PointsOfContact
      description: Customer defined Points of Contact from Expanse related to this IP range.
      type: String
    - contextPath: Expanse.IP.SeverityCounts.CRITICAL
      description: The number of CRITICAL Events for this IP address.
      type: Number
    - contextPath: Expanse.IP.SeverityCounts.ROUTINE
      description: The number of ROUTINE Events for this IP address.
      type: Number
    - contextPath: Expanse.IP.SeverityCounts.WARNING
      description: The number of WARNING Events for this IP address
      type: Number
    - contextPath: Expanse.IP.Geo.Description
      description: Additional information about the location.
      type: String
    - contextPath: Expanse.IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
  - arguments:
    - default: true
      description: The domain to search.
      isArray: true
      name: domain
      required: true
    description: Submits a domain to check.
    name: domain
    outputs:
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com"'
      type: String
    - contextPath: Domain.DNS
      description: A list of IP objects resolved by DNS
      type: String
    - contextPath: Domain.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Domain.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.NameServers
      description: Name servers of the domain.
      type: String
    - contextPath: Domain.Organization
      description: The organization of the domain.
      type: String
    - contextPath: Domain.Admin.Country
      description: The country of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: String
    - contextPath: Domain.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.Registrant.Phone
      description: The phone number of the registrant.
      type: String
    - contextPath: Domain.WHOIS.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Domain.WHOIS.NameServers
      description: 'A list of name servers, for example: "ns1.bla.com, ns2.bla.com".'
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated.
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The date that the domain expires.
      type: Date
    - contextPath: Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: The phone of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Name
      description: 'The name of the registrar, for example: "GoDaddy".'
      type: String
    - contextPath: Domain.WHOIS.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: String
    - contextPath: Domain.WHOIS.Registrar.AbusePhone
      description: The phone number of contact for reporting abuse.
      type: String
    - contextPath: Domain.WHOIS.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Domain.WHOIS.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Domain.WHOIS.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Expanse.Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: Expanse.Domain.DateAdded
      description: The date the domain was added to Expanse.
      type: Date
    - contextPath: Expanse.Domain.FirstObserved
      description: The date that Expanse first observed the domain.
      type: Date
    - contextPath: Expanse.Domain.LastObserved
      description: Date that Expanse last observed the domain.
      type: Date
    - contextPath: Expanse.Domain.HasLinkedCloudResources
      description: Whether this domain has linked cloud resources.
      type: Boolean
    - contextPath: Expanse.Domain.SourceDomain
      description: Top-level domain.
      type: String
    - contextPath: Expanse.Domain.Tenant
      description: Customer defined Tenant from Expanse.
      type: String
    - contextPath: Expanse.Domain.BusinessUnits
      description: Customer defined Business Units from Expanse.
      type: String
    - contextPath: Expanse.Domain.DNSSEC
      description: DNSSEC information.
      type: String
    - contextPath: Expanse.Domain.RecentIPs
      description: Any recent IP addresses that Expanse has seen for this domain.
      type: String
    - contextPath: Expanse.Domain.CloudResources
      description: Any Cloud Resources that Expanse has seen for this domain.
      type: String
    - contextPath: Expanse.Domain.LastSubdomainMetadata
      description: Any recent subdomain metadata that Expanse has seen for this domain.
      type: String
    - contextPath: Expanse.Domain.ServiceStatus
      description: Service Status that Expanse sees for this domain.
      type: String
    - contextPath: Expanse.Domain.LastSampledIP
      description: Last seen IP address for this domain
      type: String
    - contextPath: Expanse.Domain.DNS
      description: A list of IP objects resolved by DNS
      type: String
    - contextPath: Expanse.Domain.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Expanse.Domain.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Expanse.Domain.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Expanse.Domain.NameServers
      description: Name servers of the domain.
      type: String
    - contextPath: Expanse.Domain.Organization
      description: The organization of the domain.
      type: String
    - contextPath: Expanse.Domain.Admin.Country
      description: The country of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.Registrant.Country
      description: The country of the registrant.
      type: String
    - contextPath: Expanse.Domain.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Expanse.Domain.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Expanse.Domain.Registrant.Phone
      description: The phone number for receiving abuse reports.
      type: String
    - contextPath: Expanse.Domain.WHOIS.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Expanse.Domain.WHOIS.NameServers
      description: 'A list of name servers, for example: "ns1.bla.com, ns2.bla.com".'
      type: String
    - contextPath: Expanse.Domain.WHOIS.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Expanse.Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated.
      type: Date
    - contextPath: Expanse.Domain.WHOIS.ExpirationDate
      description: The date that the domain expires.
      type: Date
    - contextPath: Expanse.Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Registrant.Phone
      description: The phone number of the registrant.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Registrar.Name
      description: 'The name of the registrar, for example: "GoDaddy".'
      type: String
    - contextPath: Expanse.Domain.WHOIS.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Registrar.AbusePhone
      description: The phone number of contact for reporting abuse.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Expanse.Domain.WHOIS.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
  - arguments:
    - default: true
      description: The domain to search.
      isArray: true
      name: common_name
      required: true
    description: Returns information about the domain certificate.
    name: expanse-get-certificate
    outputs:
    - contextPath: Expanse.Certificate.SearchTerm
      description: The domain that was searched.
      type: String
    - contextPath: Expanse.Certificate.CommonName
      description: The common name of the certificate.
      type: String
    - contextPath: Expanse.Certificate.FirstObserved
      description: The date that the certificate was first observed.
      type: Date
    - contextPath: Expanse.Certificate.LastObserved
      description: The date that the certificate was last observed.
      type: Date
    - contextPath: Expanse.Certificate.DateAdded
      description: Certificate data added to Expanse.
      type: Date
    - contextPath: Expanse.Certificate.Provider
      description: The certificate provider.
      type: String
    - contextPath: Expanse.Certificate.NotValidBefore
      description: The not-valid-before date of the certificate.
      type: Date
    - contextPath: Expanse.Certificate.NotValidAfter
      description: The not-valid-after date of the certificate.
      type: Date
    - contextPath: Expanse.Certificate.Properties
      description: Certificate properties (expired).
      type: String
    - contextPath: Expanse.Certificate.MD5Hash
      description: The MD5 hash of the certificate.
      type: String
    - contextPath: Expanse.Certificate.PublicKeyAlgorithm
      description: Public Key Algorithm used.
      type: String
    - contextPath: Expanse.Certificate.PublicKeyBits
      description: Public Key size.
      type: String
    - contextPath: Expanse.Certificate.BusinessUnits
      description: Expanse Business units for the certificate.
      type: String
    - contextPath: Expanse.Certificate.CertificateAdvertisementStatus
      description: Whether the certificate is advertised.
      type: String
    - contextPath: Expanse.Certificate.ServiceStatus
      description: Any detected services for the certificate.
      type: String
    - contextPath: Expanse.Certificate.RecentIPs
      description: Any IP addresses returning the certificate.
      type: String
    - contextPath: Expanse.Certificate.CloudResources
      description: Any Cloud Resources returning the certificate.
      type: String
    - contextPath: Expanse.Certificate.PemSha1
      description: The SHA1 hash of the certificate PEM.
      type: String
    - contextPath: Expanse.Certificate.PemSha256
      description: The SHA256 hash of the certifiacte PEM.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Name
      description: Name of the certificate issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Email
      description: Email address of the issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Country
      description: Country of the certificate issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Org
      description: Organization of the certificate issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Unit
      description: Organizational Unit of the certificate issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.AltNames
      description: Alternative names from the certificate issuer.
      type: String
    - contextPath: Expanse.Certificate.Issuer.Raw
      description: Raw issuer details.
      type: String
    - contextPath: Expanse.Certificate.Subject.Name
      description: Name of the subject.
      type: String
    - contextPath: Expanse.Certificate.Subject.Email
      description: Email address of the subject.
      type: String
    - contextPath: Expanse.Certificate.Subject.Country
      description: Country of the subject.
      type: String
    - contextPath: Expanse.Certificate.Subject.Org
      description: Organization of the subject.
      type: String
    - contextPath: Expanse.Certificate.Subject.Unit
      description: Organizational Unit of subject
      type: String
    - contextPath: Expanse.Certificate.Subject.AltNames
      description: Alternative names from the subject.
      type: String
    - contextPath: Expanse.Certificate.Subject.Raw
      description: Raw subject details.
      type: String
  - arguments:
    - default: true
      description: The IP address to search.
      isArray: true
      name: ip
      required: true
    - description: The timestamp denoting the earliest behavior data to fetch, in ISO-8601 UTC format.
      name: start_time
    description: Returns Risky Flows for the specified IP address. The maximum number of results is 20.
    name: expanse-get-behavior
    outputs:
    - contextPath: Expanse.Behavior.SearchTerm
      description: The IP that was searched.
      type: String
    - contextPath: Expanse.Behavior.InternalAddress
      description: The internal IP address.
      type: String
    - contextPath: Expanse.Behavior.InternalCountryCode
      description: The internal IP country geolocation.
      type: String
    - contextPath: Expanse.Behavior.BusinessUnit
      description: The buisness unit of the IP address.
      type: String
    - contextPath: Expanse.Behavior.InternalDomains
      description: Known domains associated with the IP address.
      type: String
    - contextPath: Expanse.Behavior.InternalIPRanges
      description: Known Internal IP ranges containing the IP address.
      type: String
    - contextPath: Expanse.Behavior.InternalExposureTypes
      description: Known exposures for the IP address.
      type: String
    - contextPath: Expanse.Behavior.ExternalAddresses
      description: External IP addresses with known communication to the IP address.
      type: String
    - contextPath: Expanse.Behavior.FlowSummaries
      description: Summaries of most recent risky flows for the IP address.
      type: String
    - contextPath: Expanse.Behavior.Flows
      description: Array of flow objects.
      type: Unknown
    - contextPath: Expanse.Behavior.Flows.InternalAddress
      description: Internal IP address for flow
      type: String
    - contextPath: Expanse.Behavior.Flows.InternalPort
      description: Internal port for the flow.
      type: Number
    - contextPath: Expanse.Behavior.Flows.InternalCountryCode
      description: Internal country code for the flow.
      type: String
    - contextPath: Expanse.Behavior.Flows.ExternalAddress
      description: External IP address for the flow.
      type: String
    - contextPath: Expanse.Behavior.Flows.ExternalPort
      description: External port for the flow.
      type: Number
    - contextPath: Expanse.Behavior.Flows.ExternalCountryCode
      description: External country code for the flow.
      type: String
    - contextPath: Expanse.Behavior.Flows.Timestamp
      description: Timestamp of the flow.
      type: Date
    - contextPath: Expanse.Behavior.Flows.Protocol
      description: Protocol of the flow (UDP, TCP).
      type: String
    - contextPath: Expanse.Behavior.Flows.Direction
      description: Direction of the flow.
      type: String
    - contextPath: Expanse.Behavior.Flows.RiskRule
      description: Risk rule violated by the flow.
      type: String
  - arguments:
    - default: true
      description: The ip to search.
      isArray: true
      name: ip
      required: true
    description: Deprecated command by Expanse. Returns exposure information about the ip.
    name: expanse-get-exposures
    outputs:
    - contextPath: Expanse.Exposures.SearchTerm
      description: The ip that was searched.
      type: String
    - contextPath: Expanse.Exposures.TotalExposureCount
      description: The total count of exposures for the IP
      type: Number
    - contextPath: Expanse.Exposures.CriticalExposureCount
      description: The total count of CRITICAL exposures for the IP
      type: Number
    - contextPath: Expanse.Exposures.WarningExposureCount
      description: The total count of WARNING exposures for the IP
      type: Number
    - contextPath: Expanse.Exposures.RoutineExposureCount
      description: The total count of ROUTINE exposures for the IP
      type: Number
    - contextPath: Expanse.Exposures.UnknownExposureCount
      description: The total count of UNKNOWN exposures for the IP
      type: Number
    - contextPath: Expanse.Exposures.ExposureSummaries
      description: Summaries of exposures for the IP address
      type: String
    - contextPath: Expanse.Exposures.Exposures
      description: Array of Exposures for the IP address
      type: Unknown
    - contextPath: Expanse.Exposures.Exposures.ExposureType
      description: Exposure type of the Exposure
      type: String
    - contextPath: Expanse.Exposures.Exposures.BusinessUnit
      description: Business Unit of the Exposure
      type: String
    - contextPath: Expanse.Exposures.Exposures.Ip
      description: IP Address the Exposure was found on
      type: String
    - contextPath: Expanse.Exposures.Exposures.Port
      description: Port the Exposure was found on
      type: String
    - contextPath: Expanse.Exposures.Exposures.Severity
      description: Severity of the Exposure
      type: String
    - contextPath: Expanse.Exposures.Exposures.Certificate
      description: Certificate details associated with Exposure
      type: Unknown
    - contextPath: Expanse.Exposures.Exposures.FirstObservsation
      description: First Observation of the Exposure
      type: Unknown
    - contextPath: Expanse.Exposures.Exposures.LastObservsation
      description: Last Observation of the Exposure
      type: Unknown
    - contextPath: Expanse.Exposures.Exposures.Status
      description: Status details of the Exposure
      type: Unknown
    - contextPath: Expanse.Exposures.Exposures.Provider
      description: Provider details of the Exposure
      type: Unknown
  - arguments:
    - default: true
      description: The certificate common name. Fuzzy matching is done on this name, however query times can grow quite large when searching for short strings. Ex. "*.myhost.com" is a better search term than "host"
      name: common_name
      required: true
    description: Returns all domains which have been seen with the specified certificate.
    name: expanse-get-domains-for-certificate
    outputs:
    - contextPath: Expanse.IPDomains.SearchTerm
      description: The common name that was searched.
      type: String
    - contextPath: Expanse.IPDomains.TotalDomainCount
      description: The number of domains found matching the specified certificate.
      type: Number
    - contextPath: Expanse.IPDomains.FlatDomainList
      description: An array of all domain names found. This is truncated at 50.
      type: Unknown
    - contextPath: Expanse.IPDomains.DomainList
      description: An array of domain objects. This is truncated at 50.
      type: Unknown
  dockerimage: demisto/python3:3.9.5.21272
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python