GoogleSafeBrowsing Deprecated

Deprecated. Use Google Safe Browsing v2 instead.

Data Enrichment & Threat Intelligence · Google Safe Browsing

Details

IDGoogleSafeBrowsing
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Supported ModulesAgentix XSIAM

README

Search Safe Browsing

Configure GoogleSafeBrowsing in Cortex

Parameter Description Required
API Key   True
Client ID   True
Client Version   True
Base URL   True
Source Reliability Reliability of the source providing the intelligence data. True
Use system proxy settings   False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Check URL Reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url URL to check. Required

Context Output

Path Type Description
URL.Data string Bad URLs found
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason for the vendor to make the decision
DBotScore.Indicator string The indicator we tested
DBotScore.Type string The type of the indicator
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score int The actual score
DBotScore.Reliability string Reliability of the source providing the intelligence data.

Command Example

!url url="http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/"

Context Example

{
    "DBotScore": {
        "Indicator": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Reliability": "C - Fairly reliable",
        "Score": 3,
        "Type": "url",
        "Vendor": "GoogleSafeBrowsing"
    },
    "URL": {
        "Data": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Malicious": {
            "Description": "Match found: MALWARE/ANY_PLATFORM,MALWARE/WINDOWS,MALWARE/LINUX,MALWARE/ALL_PLATFORMS,MALWARE/OSX,MALWARE/CHROME",
            "Vendor": "GoogleSafeBrowsing"
        }
    }
}

Human Readable Output

Google Safe Browsing APIs - URL Query

Found matches for URL http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/

cacheDuration platformType threat threatEntryType threatType
300s ANY_PLATFORM {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s WINDOWS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s LINUX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s ALL_PLATFORMS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s OSX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s CHROME {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE

Configuration parameters

  • apiKey — API Key (required)
  • clientId — Client ID (required)
  • clientVer — Client Version (required)
  • url — Base URL (required)
  • integrationReliability — Source Reliability (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (1)

  • url

    Check URL Reputation

Source

GoogleSafeBrowsing.js GoogleSafeBrowsing.yml GoogleSafeBrowsing_description.md
Download History Raw 
commonfields:
  id: GoogleSafeBrowsing
  version: -1
name: GoogleSafeBrowsing
display: Google Safe Browsing (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: Google
description: Deprecated. Use Google Safe Browsing v2 instead.
deprecated: true
configuration:
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  required: true
- display: Client ID
  name: clientId
  defaultvalue: Demisto
  type: 0
  required: true
- display: Client Version
  name: clientVer
  defaultvalue: "1.0"
  type: 0
  required: true
- display: Base URL
  name: url
  defaultvalue: https://safebrowsing.googleapis.com/v4/threatMatches:find
  type: 0
  required: true
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Use system proxy settings
  name: proxy
  defaultvalue: ""
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: ""
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: url
    arguments:
    - name: url
      required: true
      default: true
      description: URL to check
    outputs:
    - contextPath: URL.Data
      description: Bad URLs found
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason for the vendor to make the decision
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    description: Check URL Reputation
system: true
fromversion: 5.0.0