Google Safe Browsing v2

Search Safe Browsing, The Safe Browsing APIs (v4) let your client applications check URLs against Google's constantly updated lists of unsafe web resources.

Data Enrichment & Threat Intelligence · Google Safe Browsing

Details

IDGoogle Safe Browsing v2
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Search Safe Browsing v4

Configure GoogleSafeBrowsing in Cortex

Parameter Description Required
API Key   True
Client ID   True
Client Version   True
Base URL   True
Source Reliability Reliability of the source providing the intelligence data. True
Use system proxy settings   False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Check URL Reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url URL to check. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score int The actual score.
DBotScore.Reliability string Reliability of the source providing the intelligence data.
GoogleSafeBrowsing.URL.cacheDuration string The URL cache duration time.
GoogleSafeBrowsing.URL.threatType string The URL threat type.
GoogleSafeBrowsing.URL.threatEntryType string The URL threat entry type.
GoogleSafeBrowsing.URL.platformType string The URL platform type.
URL.Data string Bad URLs found
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason for the vendor to make the decision

Command Example

!url url="http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/"

Context Example

{
    "DBotScore": {
        "Indicator": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Reliability": "C - Fairly reliable",
        "Score": 3,
        "Type": "url",
        "Vendor": "GoogleSafeBrowsing"
    },
    "URL": {
        "Data": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Malicious": {
            "Description": "Match found: MALWARE/ANY_PLATFORM,MALWARE/WINDOWS,MALWARE/LINUX,MALWARE/ALL_PLATFORMS,MALWARE/OSX,MALWARE/CHROME",
            "Vendor": "GoogleSafeBrowsing"
        }
    }
}

Human Readable Output

Google Safe Browsing APIs - URL Query

Found matches for URL http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/

cacheDuration platformType threat threatEntryType threatType
300s ANY_PLATFORM {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s WINDOWS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s LINUX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s ALL_PLATFORMS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s OSX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s CHROME {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE

Configuration parameters

  • url — Your server URL (required)
  • client_id — The Client ID
  • client_version — The Client Version
  • api_key — API Key
  • api_creds — The Client ID
  • integrationReliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • url

    Searches for the specified URL on lists.

Source

GoogleSafeBrowsingV2.py GoogleSafeBrowsingV2_test.py GoogleSafeBrowsingV2.yml GoogleSafeBrowsingV2_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Google
commonfields:
  id: Google Safe Browsing v2
  version: -1
configuration:
- defaultvalue: https://safebrowsing.googleapis.com/v4/threatMatches:find
  display: Your server URL
  name: url
  required: true
  type: 0
- display: The Client ID
  name: client_id
  type: 0
  hidden: true
  required: false
- defaultvalue: '1.0'
  display: The Client Version
  name: client_version
  type: 0
  required: false
- additionalinfo: The API Key to use for connection
  display: API Key
  name: api_key
  required: false
  type: 4
  hidden: true
- display: The Client ID
  name: api_creds
  required: false
  type: 9
  displaypassword: API Key
- display: Source Reliability
  name: integrationReliability
  required: true
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8

  required: false
description: Search Safe Browsing, The Safe Browsing APIs (v4) let your client applications check URLs against Google's constantly updated lists of unsafe web resources.
display: Google Safe Browsing v2
name: Google Safe Browsing v2
script:
  commands:
  - arguments:
    - default: true
      description: url.
      isArray: true
      name: url
      required: true
    description: Searches for the specified URL on lists.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: GoogleSafeBrowsing.URL.threatType
      description: The URL threat type.
      type: string
    - contextPath: GoogleSafeBrowsing.URL.platformType
      description: The URL platform type.
      type: string
    - contextPath: GoogleSafeBrowsing.URL.cacheDuration
      description: The URL cache duration time.
      type: string
    - contextPath: GoogleSafeBrowsing.URL.threatEntryType
      description: The URL threat entry type.
      type: string
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Google Safe Browsing V2 Test
fromversion: 5.5.0