InfobloxThreatIntelligenceFeed

The Infoblox Threat Intelligence Feed retrieves the discovered indicators from the Infoblox platform based on user-specified filters.

Data Enrichment & Threat Intelligence · Infoblox Threat Intelligence Feed · Feed

Details

IDInfobloxThreatIntelligenceFeed
ProviderInfoblox
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

The Infoblox Threat Intelligence Feed retrieves the discovered indicators from the Infoblox platform based on user-specified filters.
This integration was integrated and tested with version 1.0.0 of InfobloxThreatIntelligenceFeed.

Configure Infoblox Threat Intelligence Feed in Cortex

Parameter Description Required
Service API Key Service API key for Infoblox TIDE API authentication True
Fetch indicators   False
Indicator Types The type of indicators to be retrieved. False
First Fetch Time The date or relative timestamp from where to start fetching indicators.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z

Note: The maximum allowed relative time is 4 hours or 240 minutes.		 False
Max Indicators Per Fetch The maximum number of indicators to fetch in each run.

Note: The maximum allowed value is 50000.		 False
DGA Threat Filter the indicators having threats originated from dynamically generated algorithms. False
Threat Classes Filters the indicators according to the selected threat classes. False
Data Providers Filter indicators by data provider profiles. False
Indicator Reputation Indicators from this integration instance will be marked with this reputation. False
Source Reliability Reliability of the source providing the intelligence data. True
Traffic Light Protocol Color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. False
Tags Supports CSV values. False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
Indicator Expiration Method   False
Feed Fetch Interval Time interval for fetching indicators.

Note: The maximum allowed interval is 4 hours or 240 minutes.		 False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

infoblox-cloud-get-indicators

Fetches a given limit of indicators from the Infoblox platform and displays them in human-readable format in the war room.

Base Command

infoblox-cloud-get-indicators

Input

Argument Name Description Required
limit The maximum number of indicators to retrieve.

Note: The maximum allowed value is 50000. Default is 50.		 Optional
indicator_types The type of indicators to be retrieved. Supports comma-separated values. Possible values are: IP, HOST, URL, EMAIL, HASH. Optional
from_date The date or relative timestamp from which indicator retrieval begins.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z.		 Optional
to_date The date or relative timestamp up to which indicator retrieval ends.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

For example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z.		 Optional
dga_threat Filter the indicators having threats originated from dynamically generated algorithms. Possible values are: Yes, No. Optional
threat_classes Filters the indicators according to the provided threat classes. Supports comma-separated values. Possible values are: APT, Bot, CompromisedDomain, CompromisedHost, Cryptocurrency, DDoS, DNSTunnel, ExploitKit, ICS, IllegalContent, InternetInfrastructure, IntrusionAttempt, LimitedDistro, Malicious, MaliciousNameserver, MalwareC2, MalwareC2DGA, MalwareDownload, Parked, Phishing, Policy, PolicyViolation, Proxy, Scam, Sinkhole, Spambot, Suspicious, UncategorizedThreat, Undefined, UnwantedContent, WebAppAttack, Whitelist. Optional
data_provider_profiles Filters the indicators according to the given data providers. Supports comma-separated values. Possible values are: IID, AISCOMM. Optional

Context Output

Path Type Description
Infoblox.FeedIndicator.id String Unique identifier of the indicator.
Infoblox.FeedIndicator.type String Type of the indicator (HOST, IP, URL, EMAIL, HASH).
Infoblox.FeedIndicator.host String Hostname of the indicator.
Infoblox.FeedIndicator.domain String Domain of the indicator.
Infoblox.FeedIndicator.ip String IP address of the indicator.
Infoblox.FeedIndicator.email String Email address of the indicator.
Infoblox.FeedIndicator.hash String Hash of the indicator.
Infoblox.FeedIndicator.hash_type String Hash type of the indicator.
Infoblox.FeedIndicator.url String URL of the indicator.
Infoblox.FeedIndicator.value String The indicator value.
Infoblox.FeedIndicator.tld String Top-level domain of the indicator.
Infoblox.FeedIndicator.threat_level Number Threat level of the indicator (0-100).
Infoblox.FeedIndicator.threat_label String Threat label of the indicator.
Infoblox.FeedIndicator.confidence Number Confidence level of the indicator (0-100).
Infoblox.FeedIndicator.threat_class String Threat class of the indicator.
Infoblox.FeedIndicator.property String Property of the indicator.
Infoblox.FeedIndicator.profile String Profile of the indicator.
Infoblox.FeedIndicator.detected Date Detection timestamp.
Infoblox.FeedIndicator.received Date Reception timestamp.
Infoblox.FeedIndicator.expiration Date Expiration timestamp.
Infoblox.FeedIndicator.up String Status of the indicator.
Infoblox.FeedIndicator.dga String Domain generation algorithm.
Infoblox.FeedIndicator.batch_id String Batch ID of the indicator.
Infoblox.FeedIndicator.threat_score Number Threat score of the indicator.
Infoblox.FeedIndicator.threat_score_rating String Threat score rating of the indicator.
Infoblox.FeedIndicator.threat_score_vector String Threat score vector of the indicator.
Infoblox.FeedIndicator.confidence_score Number Confidence score of the indicator.
Infoblox.FeedIndicator.confidence_score_rating String Confidence score rating of the indicator.
Infoblox.FeedIndicator.confidence_score_vector String Confidence score vector of the indicator.
Infoblox.FeedIndicator.extended.notes String Notes for the indicator.
Infoblox.FeedIndicator.extended.comments String Comments for the indicator.
Infoblox.FeedIndicator.extended.cyberint_guid String GUID of the indicator.
Infoblox.FeedIndicator.extended.protocol String Protocol of the indicator.
Infoblox.FeedIndicator.extended.references String References of the indicator.
Infoblox.FeedIndicator.extended.original_profile String Original profile of the indicator.
Infoblox.FeedIndicator.extended.attack_chain String Attack chain of the indicator.
Infoblox.FeedIndicator.extended.sample_sha256 String SHA256 of the sample.

Command example

!infoblox-cloud-get-indicators limit="5" indicator_types="EMAIL,IP,HOST,HASH,URL" from_date="2023-01-01T00:00:00.000Z" to_date="2024-12-31T23:59:59.999Z"

Context Example

{
    "Infoblox": {
        "FeedIndicator": [
            {
                "id": "00000000-0000-0000-0000-000000000001",
                "type": "EMAIL",
                "host": "example.com",
                "email": "test@example.com",
                "domain": "example.com",
                "tld": "com",
                "profile": "IID",
                "property": "APT_testC2",
                "threat_class": "APT",
                "threat_level": 80,
                "expiration": "2043-01-06T00:41:57.421Z",
                "detected": "2023-01-11T00:41:57.421Z",
                "received": "2023-01-11T00:46:38.969Z",
                "imported": "2023-01-11T00:46:38.969Z",
                "up": "true",
                "confidence": 100,
                "batch_id": "00000000-0000-0000-0000-000000000001",
                "threat_score": 9.1,
                "threat_score_rating": "Critical",
                "threat_score_vector": "TSIS:1.0/AV:N/AC:L/PR:L/UI:N/EX:H/MOD:L/AVL:L/CI:N/ASN:N/TLD:N/DOP:N/P:T",
                "risk_score": 9.9,
                "risk_score_rating": "Critical",
                "risk_score_vector": "RSIS:1.0/TSS:C/TLD:N/CVSS:C/EX:H/MOD:L/AVL:L/T:H/DT:H",
                "confidence_score": 8.1,
                "confidence_score_rating": "High",
                "confidence_score_vector": "COSIS:1.0/SR:H/POP:N/TLD:N/CP:T",
                "extended": {
                    "cyberint_guid": "00000000000000000000000000000001",
                    "notes": "The email address is part of a cluster of test domains."
                }
            },
            {
                "id": "00000000-0000-0000-0000-000000000002",
                "type": "IP",
                "ip": "0.0.0.0",
                "profile": "IID",
                "property": "APT_testC2",
                "threat_class": "APT",
                "threat_level": 100,
                "expiration": "2042-11-01T09:29:18.721Z",
                "detected": "2022-11-01T09:29:18.721Z",
                "received": "2022-11-01T09:31:39.329Z",
                "imported": "2022-11-01T09:31:39.329Z",
                "up": "true",
                "confidence": 100,
                "batch_id": "00000000-0000-0000-0000-000000000002",
                "threat_score": 10,
                "threat_score_rating": "Critical",
                "threat_score_vector": "TSIS:1.0/AV:N/AC:L/PR:L/UI:N/EX:H/MOD:H/AVL:L/CI:N/ASN:N/TLD:N/DOP:N/P:T",
                "risk_score": 9.9,
                "risk_score_rating": "Critical",
                "risk_score_vector": "RSIS:1.0/TSS:C/TLD:N/CVSS:C/EX:H/MOD:H/AVL:L/T:H/DT:H",
                "confidence_score": 0.1,
                "confidence_score_rating": "Unconfirmed",
                "confidence_score_vector": "COSIS:1.0/SR:N/POP:N/TLD:N/CP:T",
                "extended": {
                    "cyberint_guid": "00000000000000000000000000000002",
                    "notes": "test notes for APT testC2."
                }
            },
            {
                "id": "00000000-0000-0000-0000-000000000003",
                "type": "HOST",
                "host": "test.net",
                "domain": "test.net",
                "tld": "net",
                "profile": "IID",
                "property": "MalwareC2_testRAT",
                "threat_class": "MalwareC2",
                "threat_level": 100,
                "threat_label": "LowProfileC2Beacon",
                "expiration": "2026-04-15T23:54:58.665Z",
                "detected": "2024-04-15T23:54:58.665Z",
                "received": "2024-04-17T16:14:57.694Z",
                "imported": "2024-04-17T16:14:57.694Z",
                "dga": "false",
                "up": "true",
                "confidence": 100,
                "batch_id": "00000000-0000-0000-0000-000000000003",
                "threat_score": 10,
                "threat_score_rating": "Critical",
                "threat_score_vector": "TSIS:1.0/AV:N/AC:L/PR:L/UI:N/EX:H/MOD:H/AVL:L/CI:N/ASN:N/TLD:N/DOP:N/P:T",
                "risk_score": 9.7,
                "risk_score_rating": "Critical",
                "risk_score_vector": "RSIS:1.0/TSS:C/TLD:N/CVSS:M/EX:H/MOD:H/AVL:L/T:H/DT:M",
                "confidence_score": 8.1,
                "confidence_score_rating": "High",
                "confidence_score_vector": "COSIS:1.0/SR:H/POP:N/TLD:N/CP:T",
                "extended": {
                    "cyberint_guid": "00000000000000000000000000000003",
                    "notes": "These domains appear to be set up for the DECOY DOG toolkit identified by Infoblox targeting enterprise infrastructure."
                }
            },
            {
                "id": "00000000-0000-0000-0000-000000000004",
                "type": "HASH",
                "hash": "000000000000000000000000000000000000000000000000000000000000001",
                "hash_type": "SHA256",
                "profile": "IID",
                "property": "MalwareC2_Azorult",
                "threat_class": "MalwareC2",
                "threat_level": 100,
                "expiration": "2025-08-25T20:00:34.12Z",
                "detected": "2024-08-25T20:00:34.12Z",
                "received": "2024-08-25T20:01:35.75Z",
                "imported": "2024-08-25T20:01:35.75Z",
                "up": "true",
                "confidence": 100,
                "batch_id": "00000000-0000-0000-0000-000000000005",
                "extended": {
                    "cyberint_guid": "00000000000000000000000000000005",
                    "notes": "The file uses Living off the Land (LotL) methods, a malicious technique that involves abusing pre-built software on the victim's machine to execute attacks. This binary matches the threat signature",
                    "sample_sha256": "000000000000000000000000000000000000000000000000000000000000001"
                }
            },
            {
                "id": "00000000-0000-0000-0000-000000000005",
                "type": "URL",
                "ip": "0.0.0.0",
                "url": "http://0.0.0.0/example",
                "profile": "IID",
                "property": "MalwareC2_Generic",
                "threat_class": "MalwareC2",
                "threat_level": 100,
                "expiration": "2025-10-01T10:32:58.891Z",
                "detected": "2025-06-03T10:32:58.891Z",
                "received": "2025-06-03T10:36:37.283Z",
                "imported": "2025-06-03T10:36:37.283Z",
                "up": "true",
                "confidence": 100,
                "batch_id": "00000000-0000-0000-0000-000000000005",
                "extended": {
                    "attack_chain": "ACIS",
                    "cyberint_guid": "00000000000000000000000000000005",
                    "notes": "Exfiltration target of Cuckoo Stealer for MacOS (SHA256: 00000000000000000000000000000005)",
                    "protocol": "http",
                    "references": "https://www.example.com/gui/file/00000000000000000000000000000005"
                }
            }
        ]
    }
}

Human Readable Output

Infoblox TIDE Indicators: Found 5 indicators between 2023-01-01T00:00:00.000Z and 2024-12-31T23:59:59.999Z

Type Value Threat Class Confidence Threat Level Expiration Property Profile
Email test@example.com APT 100 80 2043-01-06T00:41:57.421Z APT_testC2 IID
IP 0.0.0.0 APT 100 100 2042-11-01T09:29:18.721Z APT_testC2 IID
Domain test.net MalwareC2 100 100 2026-04-15T23:54:58.665Z MalwareC2_testRAT IID
File 000000000000000000000000000000000000000000000000000000000000001 MalwareC2 100 100 2025-08-25T20:00:34.12Z MalwareC2_Azorult IID
URL http://0.0.0.0/example MalwareC2 100 100 2025-10-01T10:32:58.891Z MalwareC2_Generic IID

Configuration parameters

  • api_key — (required)
  • feed — Fetch indicators
  • indicator_types — Indicator Types
  • first_fetch — First Fetch Time
  • max_fetch — Max Indicators Per Fetch
  • dga_threat — DGA Threat
  • threat_classes — Threat Classes
  • data_provider_profiles — Data Providers
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedTags — Tags
  • feedBypassExclusionList — Bypass exclusion list
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedIncremental — Incremental Feed
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • infoblox-cloud-get-indicators

    Fetches a given limit of indicators from the Infoblox platform and displays them in human-readable format in the war room.

Source

FeedInfobloxThreatIntelligence.py FeedInfobloxThreatIntelligence_test.py FeedInfobloxThreatIntelligence.yml FeedInfobloxThreatIntelligence_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Infoblox
sectionorder:
- Connect
- Collect
commonfields:
  id: InfobloxThreatIntelligenceFeed
  version: -1
configuration:
- section: Connect
  display: ""
  displaypassword: Service API Key
  name: api_key
  type: 9
  required: true
  hiddenusername: true
  additionalinfo: 'Service API key for Infoblox TIDE API authentication'
- section: Collect
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  defaultvalue: "true"
- section: Collect
  display: Indicator Types
  name: indicator_types
  type: 16
  required: false
  options:
  - IP
  - HOST
  - URL
  - EMAIL
  - HASH
  defaultvalue: IP,HOST,URL,EMAIL,HASH
  additionalinfo: The type of indicators to be retrieved.
- section: Collect
  display: First Fetch Time
  name: first_fetch
  type: 0
  required: false
  defaultvalue: "1 hour"
  additionalinfo: "The date or relative timestamp from where to start fetching indicators.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ\n\nFor example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z\n\nNote: The maximum allowed relative time is 4 hours or 240 minutes."
- section: Collect
  display: Max Indicators Per Fetch
  name: max_fetch
  type: 0
  required: false
  defaultvalue: "1000"
  additionalinfo: "The maximum number of indicators to fetch in each run.\n\nNote: The maximum allowed value is 50000."
- section: Collect
  display: DGA Threat
  name: dga_threat
  type: 15
  required: false
  options:
  - 'Yes'
  - 'No'
  additionalinfo: Filter the indicators having threats originated from dynamically generated algorithms.
- section: Collect
  display: Threat Classes
  name: threat_classes
  type: 16
  required: false
  options:
  - APT
  - Bot
  - CompromisedDomain
  - CompromisedHost
  - Cryptocurrency
  - DDoS
  - DNSTunnel
  - ExploitKit
  - ICS
  - IllegalContent
  - InternetInfrastructure
  - IntrusionAttempt
  - LimitedDistro
  - Malicious
  - MaliciousNameserver
  - MalwareC2
  - MalwareC2DGA
  - MalwareDownload
  - Parked
  - Phishing
  - Policy
  - PolicyViolation
  - Proxy
  - Scam
  - Sinkhole
  - Spambot
  - Suspicious
  - UncategorizedThreat
  - Undefined
  - UnwantedContent
  - WebAppAttack
  - Whitelist
  additionalinfo: Filters the indicators according to the selected threat classes.
- section: Collect
  display: Data Providers
  name: data_provider_profiles
  type: 16
  required: false
  options:
  - IID
  - AISCOMM
  additionalinfo: Filter indicators by data provider profiles.
- section: Collect
  display: Indicator Reputation
  name: feedReputation
  type: 18
  required: false
  options:
  - None
  - Good
  - Suspicious
  - Bad
  defaultvalue: Suspicious
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
- section: Collect
  display: Source Reliability
  name: feedReliability
  defaultvalue: B - Usually reliable
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
- section: Collect
  display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  required: false
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: AMBER
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
- section: Collect
  display: Tags
  name: feedTags
  type: 0
  required: false
  additionalinfo: Supports CSV values.
- section: Collect
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- section: Collect
  display: ""
  name: feedExpirationPolicy
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
- section: Collect
  display: ""
  name: feedExpirationInterval
  defaultvalue: '20160'
  type: 1
  required: false
- section: Collect
  display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '60'
  type: 19
  required: false
  additionalinfo: "Time interval for fetching indicators.\n\nNote: The maximum allowed interval is 4 hours or 240 minutes."
- section: Collect
  display: Incremental Feed
  name: feedIncremental
  type: 8
  required: false
  defaultvalue: 'true'
  hidden: true
- section: Connect
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
name: InfobloxThreatIntelligenceFeed
display: 'Infoblox Threat Intelligence Feed'
description: The Infoblox Threat Intelligence Feed retrieves the discovered indicators from the Infoblox platform based on user-specified filters.
script:
  commands:
  - name: infoblox-cloud-get-indicators
    arguments:
    - name: limit
      description: "The maximum number of indicators to retrieve.\n\nNote: The maximum allowed value is 50000."
      defaultValue: "50"
      required: false
    - name: indicator_types
      description: The type of indicators to be retrieved. Supports comma-separated values.
      auto: PREDEFINED
      predefined:
      - IP
      - HOST
      - URL
      - EMAIL
      - HASH
      required: false
    - name: from_date
      description: "The date or relative timestamp from which indicator retrieval begins.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ\n\nFor example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z."
      required: false
    - name: to_date
      description: "The date or relative timestamp up to which indicator retrieval ends.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ\n\nFor example: 01 Mar 2025, 01 Mar 2025 04:45:33, 2025-05-17T04:45:33Z."
      required: false
    - name: dga_threat
      description: Filter the indicators having threats originated from dynamically generated algorithms.
      auto: PREDEFINED
      predefined:
      - "Yes"
      - "No"
      required: false
    - name: threat_classes
      description: Filters the indicators according to the provided threat classes. Supports comma-separated values.
      auto: PREDEFINED
      predefined:
      - APT
      - Bot
      - CompromisedDomain
      - CompromisedHost
      - Cryptocurrency
      - DDoS
      - DNSTunnel
      - ExploitKit
      - ICS
      - IllegalContent
      - InternetInfrastructure
      - IntrusionAttempt
      - LimitedDistro
      - Malicious
      - MaliciousNameserver
      - MalwareC2
      - MalwareC2DGA
      - MalwareDownload
      - Parked
      - Phishing
      - Policy
      - PolicyViolation
      - Proxy
      - Scam
      - Sinkhole
      - Spambot
      - Suspicious
      - UncategorizedThreat
      - Undefined
      - UnwantedContent
      - WebAppAttack
      - Whitelist
      required: false
      isArray: true
    - name: data_provider_profiles
      description: Filters the indicators according to the given data providers. Supports comma-separated values.
      auto: PREDEFINED
      predefined:
      - IID
      - AISCOMM
      required: false
      isArray: true
    description: Fetches a given limit of indicators from the Infoblox platform and displays them in human-readable format in the war room.
    outputs:
    - contextPath: Infoblox.FeedIndicator.id
      description: Unique identifier of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.type
      description: Type of the indicator (HOST, IP, URL, EMAIL, HASH).
      type: String
    - contextPath: Infoblox.FeedIndicator.host
      description: Hostname of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.domain
      description: Domain of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.ip
      description: IP address of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.email
      description: Email address of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.hash
      description: Hash of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.hash_type
      description: Hash type of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.url
      description: URL of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.value
      description: The indicator value.
      type: String
    - contextPath: Infoblox.FeedIndicator.tld
      description: Top-level domain of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.threat_level
      description: Threat level of the indicator (0-100).
      type: Number
    - contextPath: Infoblox.FeedIndicator.threat_label
      description: Threat label of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.confidence
      description: Confidence level of the indicator (0-100).
      type: Number
    - contextPath: Infoblox.FeedIndicator.threat_class
      description: Threat class of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.property
      description: Property of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.profile
      description: Profile of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.detected
      description: Detection timestamp.
      type: Date
    - contextPath: Infoblox.FeedIndicator.received
      description: Reception timestamp.
      type: Date
    - contextPath: Infoblox.FeedIndicator.expiration
      description: Expiration timestamp.
      type: Date
    - contextPath: Infoblox.FeedIndicator.up
      description: Status of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.dga
      description: Domain generation algorithm.
      type: String      
    - contextPath: Infoblox.FeedIndicator.batch_id
      description: Batch ID of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.threat_score
      description: Threat score of the indicator.
      type: Number
    - contextPath: Infoblox.FeedIndicator.threat_score_rating
      description: Threat score rating of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.threat_score_vector
      description: Threat score vector of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.confidence_score
      description: Confidence score of the indicator.
      type: Number
    - contextPath: Infoblox.FeedIndicator.confidence_score_rating
      description: Confidence score rating of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.confidence_score_vector
      description: Confidence score vector of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.notes
      description: Notes for the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.comments
      description: Comments for the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.cyberint_guid
      description: GUID of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.protocol
      description: Protocol of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.references
      description: References of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.original_profile
      description: Original profile of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.attack_chain
      description: Attack chain of the indicator.
      type: String
    - contextPath: Infoblox.FeedIndicator.extended.sample_sha256
      description: SHA256 of the sample.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  isfetch: false
  longRunning: false
  longRunningPort: false
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)