iboss

Manage block lists, manage allow lists, and perform domain, IP, and/or URL reputation and categorization lookups.

Data Enrichment & Threat Intelligence · iboss

Details

IDiboss
ProviderIboss
CategoryData Enrichment & Threat Intelligence
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Manage block lists, manage allow lists, and perform domain, IP, and/or URL reputation and categorization lookups.
This integration was integrated and tested with version 9.8.38.245 of iboss Zero Trust Secure Service Edge.

Configure iboss on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for iboss.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Username   True
    Password   True
    Account Settings ID   True
    Trust any certificate (not secure)   False
    Use system proxy settings   False
    Source Reliability Reliability of the source providing the intelligence data  
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iboss-add-entity-to-allow-list

Adds domains, IPs, and/or URLs to an allow list.

Base Command

iboss-add-entity-to-allow-list

Input

Argument Name Description Required
entity Domains, IPs, and/or URLs to add to an allow list. Required
current_policy_being_edited The group/policy number to update. Default is 1. Optional
allow_keyword Whether to enforce blocked keywords. Possible values are: 0, 1. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
global Whether to apply to all groups. Possible values are: 0, 1. Default is 0. Optional
is_regex Whether entity consists of a regex pattern. Possible values are: 0, 1. Default is 0. Optional
priority Priority of entry (higher number takes precedence) when conflicting entry in allow list. Default is 0. Optional
time_url_expires_in_minutes The expiration time in minutes for the entry (0 indicates an entry that does not expire). Default is 0. Optional
note Note added to the entry. Optional

Context Output

Path Type Description
iboss.AddEntityToAllowList.message String Operation result.

Command example

!iboss-add-entity-to-allow-list entity=iboss.com

Context Example

{
    "iboss": {
        "AddEntityToAllowList": {
            "message": "`iboss.com` successfully added to policy 1 allow list."
        }
    }
}

Human Readable Output

iboss.com successfully added to policy 1 allow list.

iboss-add-entity-to-block-list

Adds domains, IPs, and/or URLs to a block list.

Base Command

iboss-add-entity-to-block-list

Input

Argument Name Description Required
entity Domains, IPs, and/or URLs to add to the block list. Required
current_policy_being_edited The group/policy number to update. Default is 1. Optional
allow_keyword Whether to enforce blocked keywords. Possible values are: 0, 1. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
global Whether to apply to all groups. Possible values are: 0, 1. Default is 0. Optional
is_regex Whether entity consists of a regex pattern. Possible values are: 0, 1. Default is 0. Optional
priority Priority of entry (higher number takes precedence) when conflicting entry in the block list. Default is 0. Optional
time_url_expires_in_minutes The expiration time in minutes for the entry (0 indicates an entry that does not expire). Default is 0. Optional
note Note added to the entry. Optional

Context Output

Path Type Description
iboss.AddEntityToBlockList.message String Operation result.

Command example

!iboss-add-entity-to-block-list entity=iboss.com

Context Example

{
    "iboss": {
        "AddEntityToBlockList": {
            "message": "`iboss.com` successfully added to policy 1 block list."
        }
    }
}

Human Readable Output

iboss.com successfully added to policy 1 block list.

domain

Lookup reputation for domain names.

Base Command

domain

Input

Argument Name Description Required
domain Domain(s) to lookup. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
Domain.Malicious.Description String The indicator context description
Domain.Malicious.Vendor String The vendor that indicator context originated from.
Domain.Name String The domain.
iboss.Domain.isSafeUrl Number Whether entity is deemed safe
iboss.Domain.categories String The entity categories.
DBotScore.activeMalwareSubscription Number Whether active malware subscription is active
iboss.Domain.categorized Number Whether entity is categorized.
iboss.Domain.googleSafeBrowsingDescription String Google safe browsing description
iboss.Domain.message String Entity lookup message.
iboss.Domain.url String The entity to perforum URL check on.
iboss.Domain.googleSafeBrowsingEnabled Number Whether Google safe browsing is enabled.
iboss.Domain.googleSafeBrowsingIsSafeUrl Number Whether entity deemed safe by Google safe browsing.
iboss.Domain.googleSafeBrowsingSuccess Number Whether Google safe browsing check was successful.
iboss.Domain.googleSafeBrowsingSupport String Whether Google safe browsing is supported
iboss.Domain.malwareEngineAnalysisDescription String Malware engine analysis description
iboss.Domain.malwareEngineAnalysisEnabled Number Whether the malware engine analysis is enabled.
iboss.Domain.malwareEngineAnalysisSuccess Number Whether the malware engine analysis check was successful.
iboss.Domain.malwareEngineIsSafeUrl Number Whether the entity was deemed safe by the malware engine.
iboss.Domain.malwareEngineResultCode String The result code from the malware engine analysis
iboss.Domain.realtimeCloudLookupDomainIsGrey Number Whether realtime cloud lookup is grey.
iboss.Domain.realtimeCloudLookupDomainEnabled Number Whether realtime cloud lookup is enabled.
iboss.Domain.realtimeCloudLookupIsSafeUrl Number Whether realtime cloud lookup determined entity is safe.
iboss.Domain.realtimeCloudLookupRiskDescription String Realtime cloud lookup risk description.
iboss.Domain.realtimeCloudLookupSuccess Number Whether realtime cloud lookup chec was successful.
iboss.Domain.reputationDatabaseBotnetDetection Number Whether reputation database detected a botnet.
iboss.Domain.reputationDatabaseMalwareDetection Number Whether reputation database detected malware.
iboss.Domain.reputationDatabaseEnabled Number Whether reputation database check is enabled.
iboss.Domain.reputationDatabaseIsSafeUrl String Whether reputation database check determined entity is safe.
iboss.Domain.reputationDatabaseLookupSuccess Number Whether reputation database lookup was successful.
iboss.Domain.webRequestHeuristicBlockUnreachableSites Number Whether unreachable sites will be blocked.
iboss.Domain.webRequestHeuristicDescription String The web request heuristic description.
iboss.Domain.webRequestHeuristicIsSafeUrl Number Whether web request heuristics determined URL is safe.
iboss.Domain.webRequestHeuristicLevelHighScore String The web request heuristic score high threshold.
iboss.Domain.webRequestHeuristicLevelLowScore String The web request heuristic score low threshold.
iboss.Domain.webRequestHeuristicLevelMediumScore String The web request heuristic score low threshold.
iboss.Domain.webRequestHeuristicLevelNoneScore String The web request heuristic score none threshold.
iboss.Domain.webRequestHeuristicProtectionActionHigh Number The web request heuristic protection action high threshold.
iboss.Domain.webRequestHeuristicProtectionActionLow Number The web request heuristic protection action low threshold.
iboss.Domain.webRequestHeuristicProtectionActionMedium Number The web request heuristic protection action medium threshold.
iboss.Domain.webRequestHeuristicProtectionLevel String The web request heuristic protection level.
iboss.Domain.webRequestHeuristicSuccess Number Whether web request heuristic check was successful.
iboss.Domain.webRequestHeuristicSupport Number Whether web request heuristic support enabled.

Command example

!domain domain=iboss.com

Context Example

{
    "DBotScore": {
        "Indicator": "iboss.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "iboss"
    },
    "Domain": {
        "DetectionEngines": 5,
        "Name": "iboss.com",
        "PositiveDetections": 0
    },
    "iboss": {
        "Domain": {
            "activeMalwareSubscription": 1,
            "categories": [
                "Business",
                "Technology"
            ],
            "categorized": "true",
            "googleSafeBrowsingDescription": "",
            "googleSafeBrowsingEnabled": 1,
            "googleSafeBrowsingIsSafeUrl": 1,
            "googleSafeBrowsingSuccess": 1,
            "googleSafeBrowsingSupport": 1,
            "isSafeUrl": 1,
            "malwareEngineAnalysisDescription": "",
            "malwareEngineAnalysisEnabled": 1,
            "malwareEngineAnalysisSuccess": 1,
            "malwareEngineIsSafeUrl": 1,
            "malwareEngineResultCode": 0,
            "message": "Status: Url Known. Please see categories below.",
            "realtimeCloudLookupDomainIsGrey": 0,
            "realtimeCloudLookupEnabled": 1,
            "realtimeCloudLookupIsSafeUrl": 1,
            "realtimeCloudLookupRiskDescription": "",
            "realtimeCloudLookupSuccess": 1,
            "reputationDatabaseBotnetDetection": 0,
            "reputationDatabaseEnabled": 1,
            "reputationDatabaseIsSafeUrl": 1,
            "reputationDatabaseLookupSuccess": 1,
            "reputationDatabaseMalwareDetection": 0,
            "url": "iboss.com",
            "webRequestHeuristicBlockUnreachableSites": "1",
            "webRequestHeuristicDescription": "",
            "webRequestHeuristicIsSafeUrl": 1,
            "webRequestHeuristicLevelHighScore": "79",
            "webRequestHeuristicLevelLowScore": "10",
            "webRequestHeuristicLevelMediumScore": "60",
            "webRequestHeuristicLevelNoneScore": "0",
            "webRequestHeuristicProtectionActionHigh": "3",
            "webRequestHeuristicProtectionActionLow": "0",
            "webRequestHeuristicProtectionActionMedium": "3",
            "webRequestHeuristicProtectionLevel": "1",
            "webRequestHeuristicSuccess": 1,
            "webRequestHeuristicSupport": 1
        }
    }
}

Human Readable Output

iboss Result for domain iboss.com

message categories isSafeUrl malwareEngineAnalysisSuccess malwareEngineAnalysisDescription reputationDatabaseLookupSuccess reputationDatabaseMalwareDetection reputationDatabaseBotnetDetection webRequestHeuristicSuccess webRequestHeuristicProtectionLevel webRequestHeuristicDescription googleSafeBrowsingSuccess googleSafeBrowsingIsSafeUrl googleSafeBrowsingDescription realtimeCloudLookupSuccess realtimeCloudLookupDomainIsGrey realtimeCloudLookupRiskDescription
Status: Url Known. Please see categories below. Business,
Technology		 1 1   1 0 0 1 1   1 1   1 0  

ip

Lookup reputation data for IP addresses.

Base Command

ip

Input

Argument Name Description Required
ip IP(s) to lookup. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
IP.Malicious.Description String The indicator context description
IP.Malicious.Vendor String The vendor that indicator context originated from.
IP.Address String The IP address.
iboss.IP.isSafeUrl Number Whether entity is deemed safe
iboss.IP.categories String The entity categories.
DBotScore.activeMalwareSubscription Number Whether active malware subscription is active
iboss.IP.categorized Number Whether entity is categorized.
iboss.IP.googleSafeBrowsingDescription String Google safe browsing description
iboss.IP.message String Entity lookup message.
iboss.IP.url String The entity to perforum URL check on.
iboss.IP.googleSafeBrowsingEnabled Number Whether Google safe browsing is enabled.
iboss.IP.googleSafeBrowsingIsSafeUrl Number Whether entity deemed safe by Google safe browsing.
iboss.IP.googleSafeBrowsingSuccess Number Whether Google safe browsing check was successful.
iboss.IP.googleSafeBrowsingSupport String Whether Google safe browsing is supported
iboss.IP.malwareEngineAnalysisDescription String Malware engine analysis description
iboss.IP.malwareEngineAnalysisEnabled Number Whether the malware engine analysis is enabled.
iboss.IP.malwareEngineAnalysisSuccess Number Whether the malware engine analysis check was successful.
iboss.IP.malwareEngineIsSafeUrl Number Whether the entity was deemed safe by the malware engine.
iboss.IP.malwareEngineResultCode String The result code from the malware engine analysis
iboss.IP.realtimeCloudLookupDomainIsGrey Number Whether realtime cloud lookup is grey.
iboss.IP.realtimeCloudLookupDomainEnabled Number Whether realtime cloud lookup is enabled.
iboss.IP.realtimeCloudLookupIsSafeUrl Number Whether realtime cloud lookup determined entity is safe.
iboss.IP.realtimeCloudLookupRiskDescription String Realtime cloud lookup risk description.
iboss.IP.realtimeCloudLookupSuccess Number Whether realtime cloud lookup chec was successful.
iboss.IP.reputationDatabaseBotnetDetection Number Whether reputation database detected a botnet.
iboss.IP.reputationDatabaseMalwareDetection Number Whether reputation database detected malware.
iboss.IP.reputationDatabaseEnabled Number Whether reputation database check is enabled.
iboss.IP.reputationDatabaseIsSafeUrl String Whether reputation database check determined entity is safe.
iboss.IP.reputationDatabaseLookupSuccess Number Whether reputation database lookup was successful.
iboss.IP.webRequestHeuristicBlockUnreachableSites Number Whether unreachable sites will be blocked.
iboss.IP.webRequestHeuristicDescription String The web request heuristic description.
iboss.IP.webRequestHeuristicIsSafeUrl Number Whether web request heuristics determined URL is safe.
iboss.IP.webRequestHeuristicLevelHighScore String The web request heuristic score high threshold.
iboss.IP.webRequestHeuristicLevelLowScore String The web request heuristic score low threshold.
iboss.IP.webRequestHeuristicLevelMediumScore String The web request heuristic score low threshold.
iboss.IP.webRequestHeuristicLevelNoneScore String The web request heuristic score none threshold.
iboss.IP.webRequestHeuristicProtectionActionHigh Number The web request heuristic protection action high threshold.
iboss.IP.webRequestHeuristicProtectionActionLow Number The web request heuristic protection action low threshold.
iboss.IP.webRequestHeuristicProtectionActionMedium Number The web request heuristic protection action medium threshold.
iboss.IP.webRequestHeuristicProtectionLevel String The web request heuristic protection level.
iboss.IP.webRequestHeuristicSuccess Number Whether web request heuristic check was successful.
iboss.IP.webRequestHeuristicSupport Number Whether web request heuristic support enabled.

Command example

!ip ip=1.1.1.1

Context Example

{
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 2,
        "Type": "ip",
        "Vendor": "iboss"
    },
    "IP": {
        "Address": "1.1.1.1",
        "DetectionEngines": 5,
        "PositiveDetections": 1
    },
    "iboss": {
        "IP": {
            "activeMalwareSubscription": 1,
            "categories": [
                "Technology"
            ],
            "categorized": "true",
            "googleSafeBrowsingDescription": "",
            "googleSafeBrowsingEnabled": 1,
            "googleSafeBrowsingIsSafeUrl": 1,
            "googleSafeBrowsingSuccess": 1,
            "googleSafeBrowsingSupport": 1,
            "isSafeUrl": 0,
            "malwareEngineAnalysisDescription": "Redirect - Redirects to: https://1.1.1.1/",
            "malwareEngineAnalysisEnabled": 1,
            "malwareEngineAnalysisSuccess": 1,
            "malwareEngineIsSafeUrl": 1,
            "malwareEngineResultCode": 3,
            "message": "Status: Url Known. Please see categories below.",
            "realtimeCloudLookupDomainIsGrey": 0,
            "realtimeCloudLookupEnabled": 1,
            "realtimeCloudLookupIsSafeUrl": 1,
            "realtimeCloudLookupRiskDescription": "",
            "realtimeCloudLookupSuccess": 1,
            "reputationDatabaseBotnetDetection": 0,
            "reputationDatabaseEnabled": 1,
            "reputationDatabaseIsSafeUrl": 1,
            "reputationDatabaseLookupSuccess": 1,
            "reputationDatabaseMalwareDetection": 0,
            "url": "1.1.1.1",
            "webRequestHeuristicBlockUnreachableSites": "1",
            "webRequestHeuristicDescription": "Heuristic Engine Detection",
            "webRequestHeuristicIsSafeUrl": 0,
            "webRequestHeuristicLevelHighScore": "79",
            "webRequestHeuristicLevelLowScore": "10",
            "webRequestHeuristicLevelMediumScore": "60",
            "webRequestHeuristicLevelNoneScore": "0",
            "webRequestHeuristicProtectionActionHigh": "3",
            "webRequestHeuristicProtectionActionLow": "0",
            "webRequestHeuristicProtectionActionMedium": "3",
            "webRequestHeuristicProtectionLevel": "1",
            "webRequestHeuristicSuccess": 1,
            "webRequestHeuristicSupport": 1
        }
    }
}

Human Readable Output

iboss Result for IP 1.1.1.1

message categories isSafeUrl malwareEngineAnalysisSuccess malwareEngineAnalysisDescription reputationDatabaseLookupSuccess reputationDatabaseMalwareDetection reputationDatabaseBotnetDetection webRequestHeuristicSuccess webRequestHeuristicProtectionLevel webRequestHeuristicDescription googleSafeBrowsingSuccess googleSafeBrowsingIsSafeUrl googleSafeBrowsingDescription realtimeCloudLookupSuccess realtimeCloudLookupDomainIsGrey realtimeCloudLookupRiskDescription
Status: Url Known. Please see categories below. Technology 0 1 Redirect - Redirects to: https://1.1.1.1/ 1 0 0 1 1 Heuristic Engine Detection 1 1   1 0  

iboss-remove-entity-from-allow-list

Removes domains, IPs, and/or URLs from an allow list

Base Command

iboss-remove-entity-from-allow-list

Input

Argument Name Description Required
entity Domains, IPs, and/or URLs to remove from an allow list. Required
current_policy_being_edited The group/policy number to update. Default is 1. Optional
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional

Context Output

Path Type Description
iboss.RemoveEntityFromAllowList.message String Operation result.

Command example

!iboss-remove-entity-from-allow-list entity=iboss.com

Context Example

{
    "iboss": {
        "RemoveEntityFromAllowList": {
            "message": "`iboss.com` removed from policy 1 allow list."
        }
    }
}

Human Readable Output

iboss.com removed from policy 1 allow list.

iboss-remove-entity-from-block-list

Removes domains, IPs, and/or URLs to a block list.

Base Command

iboss-remove-entity-from-block-list

Input

Argument Name Description Required
entity Domains, IPs, and/or URLs to remove from a block list. Required
current_policy_being_edited The group/policy number to update. Default is 1. Optional
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional

Context Output

Path Type Description
iboss.RemoveEntityFromBlockList.message String Operation result.

Command example

!iboss-remove-entity-from-block-list entity=iboss.com

Context Example

{
    "iboss": {
        "RemoveEntityFromBlockList": {
            "message": "`iboss.com` removed from policy 1 block list."
        }
    }
}

Human Readable Output

iboss.com removed from policy 1 block list.

url

Lookup reputation data for URLs.

Base Command

url

Input

Argument Name Description Required
url URL(s) to lookup. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
URL.Malicious.Description String The indicator context description
URL.Malicious.Vendor String The vendor that indicator context originated from.
URL.Data String The URL.
iboss.URL.isSafeUrl Number Whether entity is deemed safe
iboss.URL.categories String The entity categories.
DBotScore.activeMalwareSubscription Number Whether active malware subscription is active
iboss.URL.categorized Number Whether entity is categorized.
iboss.URL.googleSafeBrowsingDescription String Google safe browsing description
iboss.URL.message String Entity lookup message.
iboss.URL.url String The entity to perforum URL check on.
iboss.URL.googleSafeBrowsingEnabled Number Whether Google safe browsing is enabled.
iboss.URL.googleSafeBrowsingIsSafeUrl Number Whether entity deemed safe by Google safe browsing.
iboss.URL.googleSafeBrowsingSuccess Number Whether Google safe browsing check was successful.
iboss.URL.googleSafeBrowsingSupport String Whether Google safe browsing is supported
iboss.URL.malwareEngineAnalysisDescription String Malware engine analysis description
iboss.URL.malwareEngineAnalysisEnabled Number Whether the malware engine analysis is enabled.
iboss.URL.malwareEngineAnalysisSuccess Number Whether the malware engine analysis check was successful.
iboss.URL.malwareEngineIsSafeUrl Number Whether the entity was deemed safe by the malware engine.
iboss.URL.malwareEngineResultCode String The result code from the malware engine analysis
iboss.URL.realtimeCloudLookupDomainIsGrey Number Whether realtime cloud lookup is grey.
iboss.URL.realtimeCloudLookupDomainEnabled Number Whether realtime cloud lookup is enabled.
iboss.URL.realtimeCloudLookupIsSafeUrl Number Whether realtime cloud lookup determined entity is safe.
iboss.URL.realtimeCloudLookupRiskDescription String Realtime cloud lookup risk description.
iboss.URL.realtimeCloudLookupSuccess Number Whether realtime cloud lookup chec was successful.
iboss.URL.reputationDatabaseBotnetDetection Number Whether reputation database detected a botnet.
iboss.URL.reputationDatabaseMalwareDetection Number Whether reputation database detected malware.
iboss.URL.reputationDatabaseEnabled Number Whether reputation database check is enabled.
iboss.URL.reputationDatabaseIsSafeUrl String Whether reputation database check determined entity is safe.
iboss.URL.reputationDatabaseLookupSuccess Number Whether reputation database lookup was successful.
iboss.URL.webRequestHeuristicBlockUnreachableSites Number Whether unreachable sites will be blocked.
iboss.URL.webRequestHeuristicDescription String The web request heuristic description.
iboss.URL.webRequestHeuristicIsSafeUrl Number Whether web request heuristics determined URL is safe.
iboss.URL.webRequestHeuristicLevelHighScore String The web request heuristic score high threshold.
iboss.URL.webRequestHeuristicLevelLowScore String The web request heuristic score low threshold.
iboss.URL.webRequestHeuristicLevelMediumScore String The web request heuristic score low threshold.
iboss.URL.webRequestHeuristicLevelNoneScore String The web request heuristic score none threshold.
iboss.URL.webRequestHeuristicProtectionActionHigh Number The web request heuristic protection action high threshold.
iboss.URL.webRequestHeuristicProtectionActionLow Number The web request heuristic protection action low threshold.
iboss.URL.webRequestHeuristicProtectionActionMedium Number The web request heuristic protection action medium threshold.
iboss.URL.webRequestHeuristicProtectionLevel String The web request heuristic protection level.
iboss.URL.webRequestHeuristicSuccess Number Whether web request heuristic check was successful.
iboss.URL.webRequestHeuristicSupport Number Whether web request heuristic support enabled.

Command example

!url url=https://www.iboss.com

Context Example

{
    "DBotScore": {
        "Indicator": "https://www.iboss.com",
        "Score": 1,
        "Type": "url",
        "Vendor": "iboss"
    },
    "URL": {
        "Data": "https://www.iboss.com",
        "DetectionEngines": 5,
        "PositiveDetections": 0
    },
    "iboss": {
        "URL": {
            "activeMalwareSubscription": 1,
            "categories": [
                "Business",
                "Technology"
            ],
            "categorized": "true",
            "googleSafeBrowsingDescription": "",
            "googleSafeBrowsingEnabled": 1,
            "googleSafeBrowsingIsSafeUrl": 1,
            "googleSafeBrowsingSuccess": 1,
            "googleSafeBrowsingSupport": 1,
            "isSafeUrl": 1,
            "malwareEngineAnalysisDescription": "",
            "malwareEngineAnalysisEnabled": 1,
            "malwareEngineAnalysisSuccess": 1,
            "malwareEngineIsSafeUrl": 1,
            "malwareEngineResultCode": 0,
            "message": "Status: Url Known. Please see categories below.",
            "realtimeCloudLookupDomainIsGrey": 0,
            "realtimeCloudLookupEnabled": 1,
            "realtimeCloudLookupIsSafeUrl": 1,
            "realtimeCloudLookupRiskDescription": "",
            "realtimeCloudLookupSuccess": 1,
            "reputationDatabaseBotnetDetection": 0,
            "reputationDatabaseEnabled": 1,
            "reputationDatabaseIsSafeUrl": 1,
            "reputationDatabaseLookupSuccess": 1,
            "reputationDatabaseMalwareDetection": 0,
            "url": "https://www.iboss.com",
            "webRequestHeuristicBlockUnreachableSites": "1",
            "webRequestHeuristicDescription": "",
            "webRequestHeuristicIsSafeUrl": 1,
            "webRequestHeuristicLevelHighScore": "79",
            "webRequestHeuristicLevelLowScore": "10",
            "webRequestHeuristicLevelMediumScore": "60",
            "webRequestHeuristicLevelNoneScore": "0",
            "webRequestHeuristicProtectionActionHigh": "3",
            "webRequestHeuristicProtectionActionLow": "0",
            "webRequestHeuristicProtectionActionMedium": "3",
            "webRequestHeuristicProtectionLevel": "1",
            "webRequestHeuristicSuccess": 1,
            "webRequestHeuristicSupport": 1
        }
    }
}

Human Readable Output

iboss Result for URL https://www.iboss.com

message categories isSafeUrl malwareEngineAnalysisSuccess malwareEngineAnalysisDescription reputationDatabaseLookupSuccess reputationDatabaseMalwareDetection reputationDatabaseBotnetDetection webRequestHeuristicSuccess webRequestHeuristicProtectionLevel webRequestHeuristicDescription googleSafeBrowsingSuccess googleSafeBrowsingIsSafeUrl googleSafeBrowsingDescription realtimeCloudLookupSuccess realtimeCloudLookupDomainIsGrey realtimeCloudLookupRiskDescription
Status: Url Known. Please see categories below. Business,
Technology		 1 1   1 0 0 1 1   1 1   1 0  

iboss-add-entity-to-policy-layer-list

Add entity to policy layer list.

Base Command

iboss-add-entity-to-policy-layer-list

Input

Argument Name Description Required
policy_layer_name Policy layer name to lookup. Required
entity Entity to add to policy layer list. Required
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional
do_dlp_scan Whether to perform DLP scanning. Possible values are: 0, 1. Default is 1. Optional
do_malware_scan Whether to perform malware scanning. Possible values are: 0, 1. Default is 1. Optional
priority Priority of entry (higher number takes precedence) when conflicting entry in the block list. Default is 0. Optional
time_url_expires_in_seconds The expiration time in seconds for the entry (0 indicates an entry that does not expire). Default is 0. Optional
note Note added to the entry. Optional
is_regex Whether entity consists of a regex pattern. Possible values are: 0, 1. Default is 0. Optional
upsert Update entity if it already exists. Possible values are: 0, 1. Default is 0. Optional

Context Output

Path Type Description
iboss.AddEntityToPolicyLayerList.message String Operation result.

Command example

!iboss-add-entity-to-policy-layer-list entity=iboss.com policy_layer_name="Test Policy Layer - Allow List"

Context Example

{
    "iboss": {
        "AddEntityToPolicyLayerList": {
            "message": "Successfully added URL to list."
        }
    }
}

Human Readable Output

Successfully added URL to list.

iboss-remove-entity-from-policy-layer-list

Remove entity from policy layer list.

Base Command

iboss-remove-entity-from-policy-layer-list

Input

Argument Name Description Required
policy_layer_name Policy layer name to lookup. Required
entity Entity to add to policy layer list. Required
start_port Which start port(s) to match; 0 indicates all ports. Default is 0. Optional
end_port Which end port(s) to match; 0 indicates all ports. Default is 0. Optional
direction Which direction(s) to match. Possible values are: 0, 1, 2. Default is 2. Optional
do_dlp_scan Whether to perform DLP scanning. Possible values are: 0, 1. Default is 1. Optional
do_malware_scan Whether to perform malware scanning. Possible values are: 0, 1. Default is 1. Optional
priority Priority of entry (higher number takes precedence) when conflicting entry in the block list. Default is 0. Optional
time_url_expires_in_seconds The expiration time in seconds for the entry (0 indicates an entry that does not expire). Default is 0. Optional
note Note added to the entry. Optional
is_regex Whether entity consists of a regex pattern. Possible values are: 0, 1. Default is 0. Optional

Context Output

Path Type Description
iboss.RemoveEntityFromPolicyLayerList.message String Operation result.

Command example

!iboss-remove-entity-from-policy-layer-list entity=iboss.com policy_layer_name="Test Policy Layer - Allow List"

Context Example

{
    "iboss": {
        "RemoveEntityFromPolicyLayerList": {
            "message": "iboss.com removed from policy layer `Test Policy Layer - Allow List`."
        }
    }
}

Human Readable Output

iboss.com removed from policy layer Test Policy Layer - Allow List.

Configuration parameters

  • auth — Username (required)
  • account_settings_id — Account Settings ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • reliability — Source Reliability

Commands (9)

  • domain

    Lookup reputation for domain names.

  • iboss-add-entity-to-allow-list

    Adds domains, IPs, and/or URLs to an allow list.

  • iboss-add-entity-to-block-list

    Adds domains, IPs, and/or URLs to a block list.

  • iboss-add-entity-to-policy-layer-list

    Add entity to policy layer list.

  • iboss-remove-entity-from-allow-list

    Removes domains, IPs, and/or URLs from an allow list

  • iboss-remove-entity-from-block-list

    Removes domains, IPs, and/or URLs to a block list.

  • iboss-remove-entity-from-policy-layer-list

    Remove entity from policy layer list.

  • ip

    Lookup reputation data for IP addresses.

  • url

    Lookup reputation data for URLs.

Source

Iboss.py Iboss_test.py Iboss.yml Iboss_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Iboss
description: Manage block lists, manage allow lists, and perform domain, IP, and/or URL reputation and categorization lookups.
commonfields:
  id: iboss
  version: -1
name: iboss
display: iboss
configuration:
- display: Username
  name: auth
  type: 9
  required: true
- display: Account Settings ID
  name: account_settings_id
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: 'false'
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: 'false'
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
script:
  commands:
  - description: Adds domains, IPs, and/or URLs to an allow list.
    name: iboss-add-entity-to-allow-list
    arguments:
    - name: entity
      isArray: true
      description: Domains, IPs, and/or URLs to add to an allow list.
      required: true
      default: true
    - name: current_policy_being_edited
      description: The group/policy number to update.
      defaultValue: '1'
    - name: allow_keyword
      description: Whether to enforce blocked keywords.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
      auto: PREDEFINED
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: global
      description: Whether to apply to all groups.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: is_regex
      description: Whether entity consists of a regex pattern.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: priority
      description: Priority of entry (higher number takes precedence) when conflicting entry in allow list.
      defaultValue: '0'
    - name: time_url_expires_in_minutes
      description: The expiration time in minutes for the entry (0 indicates an entry that does not expire).
      defaultValue: '0'
    - name: note
      description: Note added to the entry.
    outputs:
    - contextPath: iboss.AddEntityToAllowList.message
      description: Operation result.
      type: String
  - description: Adds domains, IPs, and/or URLs to a block list.
    name: iboss-add-entity-to-block-list
    arguments:
    - name: entity
      isArray: true
      description: Domains, IPs, and/or URLs to add to the block list.
      required: true
      default: true
    - name: current_policy_being_edited
      description: The group/policy number to update.
      defaultValue: '1'
    - name: allow_keyword
      description: Whether to enforce blocked keywords.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
      auto: PREDEFINED
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: global
      description: Whether to apply to all groups.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: is_regex
      description: Whether entity consists of a regex pattern.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
      auto: PREDEFINED
    - name: priority
      description: Priority of entry (higher number takes precedence) when conflicting entry in the block list.
      defaultValue: '0'
    - name: time_url_expires_in_minutes
      description: The expiration time in minutes for the entry (0 indicates an entry that does not expire).
      defaultValue: '0'
    - name: note
      description: Note added to the entry.
    outputs:
    - contextPath: iboss.AddEntityToBlockList.message
      description: Operation result.
      type: String
  - description: Lookup reputation for domain names.
    name: domain
    arguments:
    - name: domain
      isArray: true
      description: Domain(s) to lookup.
      required: true
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Malicious.Description
      description: The indicator context description.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor that indicator context originated from.
      type: String
    - contextPath: Domain.Name
      description: The domain.
      type: String
    - contextPath: iboss.Domain.isSafeUrl
      description: Whether entity is deemed safe.
      type: Number
    - contextPath: iboss.Domain.categories
      description: The entity categories.
      type: String
    - contextPath: DBotScore.activeMalwareSubscription
      description: Whether active malware subscription is active.
      type: Number
    - contextPath: iboss.Domain.categorized
      description: Whether entity is categorized.
      type: Number
    - contextPath: iboss.Domain.googleSafeBrowsingDescription
      description: Google safe browsing description.
      type: String
    - contextPath: iboss.Domain.message
      description: Entity lookup message.
      type: String
    - contextPath: iboss.Domain.url
      description: The entity to perforum URL check on.
      type: String
    - contextPath: iboss.Domain.googleSafeBrowsingEnabled
      description: Whether Google safe browsing is enabled.
      type: Number
    - contextPath: iboss.Domain.googleSafeBrowsingIsSafeUrl
      description: Whether entity deemed safe by Google safe browsing.
      type: Number
    - contextPath: iboss.Domain.googleSafeBrowsingSuccess
      description: Whether Google safe browsing check was successful.
      type: Number
    - contextPath: iboss.Domain.googleSafeBrowsingSupport
      description: Whether Google safe browsing is supported.
      type: String
    - contextPath: iboss.Domain.malwareEngineAnalysisDescription
      description: Malware engine analysis description.
      type: String
    - contextPath: iboss.Domain.malwareEngineAnalysisEnabled
      description: Whether the malware engine analysis is enabled.
      type: Number
    - contextPath: iboss.Domain.malwareEngineAnalysisSuccess
      description: Whether the malware engine analysis check was successful.
      type: Number
    - contextPath: iboss.Domain.malwareEngineIsSafeUrl
      description: Whether the entity was deemed safe by the malware engine.
      type: Number
    - contextPath: iboss.Domain.malwareEngineResultCode
      description: The result code from the malware engine analysis.
      type: String
    - contextPath: iboss.Domain.realtimeCloudLookupDomainIsGrey
      description: Whether realtime cloud lookup is grey.
      type: Number
    - contextPath: iboss.Domain.realtimeCloudLookupDomainEnabled
      description: Whether realtime cloud lookup is enabled.
      type: Number
    - contextPath: iboss.Domain.realtimeCloudLookupIsSafeUrl
      description: Whether realtime cloud lookup determined entity is safe.
      type: Number
    - contextPath: iboss.Domain.realtimeCloudLookupRiskDescription
      description: Realtime cloud lookup risk description.
      type: String
    - contextPath: iboss.Domain.realtimeCloudLookupSuccess
      description: Whether realtime cloud lookup chec was successful.
      type: Number
    - contextPath: iboss.Domain.reputationDatabaseBotnetDetection
      description: Whether reputation database detected a botnet.
      type: Number
    - contextPath: iboss.Domain.reputationDatabaseMalwareDetection
      description: Whether reputation database detected malware.
      type: Number
    - contextPath: iboss.Domain.reputationDatabaseEnabled
      description: Whether reputation database check is enabled.
      type: Number
    - contextPath: iboss.Domain.reputationDatabaseIsSafeUrl
      description: Whether reputation database check determined entity is safe.
      type: String
    - contextPath: iboss.Domain.reputationDatabaseLookupSuccess
      description: Whether reputation database lookup was successful.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicBlockUnreachableSites
      description: Whether unreachable sites will be blocked.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicDescription
      description: The web request heuristic description.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicIsSafeUrl
      description: Whether web request heuristics determined URL is safe.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicLevelHighScore
      description: The web request heuristic score high threshold.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicLevelLowScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicLevelMediumScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicLevelNoneScore
      description: The web request heuristic score none threshold.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicProtectionActionHigh
      description: The web request heuristic protection action high threshold.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicProtectionActionLow
      description: The web request heuristic protection action low threshold.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicProtectionActionMedium
      description: The web request heuristic protection action medium threshold.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicProtectionLevel
      description: The web request heuristic protection level.
      type: String
    - contextPath: iboss.Domain.webRequestHeuristicSuccess
      description: Whether web request heuristic check was successful.
      type: Number
    - contextPath: iboss.Domain.webRequestHeuristicSupport
      description: Whether web request heuristic support enabled.
      type: Number
  - description: Lookup reputation data for IP addresses.
    name: ip
    arguments:
    - name: ip
      isArray: true
      description: IP(s) to lookup.
      required: true
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: IP.Malicious.Description
      description: The indicator context description.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor that indicator context originated from.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: iboss.IP.isSafeUrl
      description: Whether entity is deemed safe.
      type: Number
    - contextPath: iboss.IP.categories
      description: The entity categories.
      type: String
    - contextPath: DBotScore.activeMalwareSubscription
      description: Whether active malware subscription is active.
      type: Number
    - contextPath: iboss.IP.categorized
      description: Whether entity is categorized.
      type: Number
    - contextPath: iboss.IP.googleSafeBrowsingDescription
      description: Google safe browsing description.
      type: String
    - contextPath: iboss.IP.message
      description: Entity lookup message.
      type: String
    - contextPath: iboss.IP.url
      description: The entity to perforum URL check on.
      type: String
    - contextPath: iboss.IP.googleSafeBrowsingEnabled
      description: Whether Google safe browsing is enabled.
      type: Number
    - contextPath: iboss.IP.googleSafeBrowsingIsSafeUrl
      description: Whether entity deemed safe by Google safe browsing.
      type: Number
    - contextPath: iboss.IP.googleSafeBrowsingSuccess
      description: Whether Google safe browsing check was successful.
      type: Number
    - contextPath: iboss.IP.googleSafeBrowsingSupport
      description: Whether Google safe browsing is supported.
      type: String
    - contextPath: iboss.IP.malwareEngineAnalysisDescription
      description: Malware engine analysis description.
      type: String
    - contextPath: iboss.IP.malwareEngineAnalysisEnabled
      description: Whether the malware engine analysis is enabled.
      type: Number
    - contextPath: iboss.IP.malwareEngineAnalysisSuccess
      description: Whether the malware engine analysis check was successful.
      type: Number
    - contextPath: iboss.IP.malwareEngineIsSafeUrl
      description: Whether the entity was deemed safe by the malware engine.
      type: Number
    - contextPath: iboss.IP.malwareEngineResultCode
      description: The result code from the malware engine analysis.
      type: String
    - contextPath: iboss.IP.realtimeCloudLookupDomainIsGrey
      description: Whether realtime cloud lookup is grey.
      type: Number
    - contextPath: iboss.IP.realtimeCloudLookupDomainEnabled
      description: Whether realtime cloud lookup is enabled.
      type: Number
    - contextPath: iboss.IP.realtimeCloudLookupIsSafeUrl
      description: Whether realtime cloud lookup determined entity is safe.
      type: Number
    - contextPath: iboss.IP.realtimeCloudLookupRiskDescription
      description: Realtime cloud lookup risk description.
      type: String
    - contextPath: iboss.IP.realtimeCloudLookupSuccess
      description: Whether realtime cloud lookup chec was successful.
      type: Number
    - contextPath: iboss.IP.reputationDatabaseBotnetDetection
      description: Whether reputation database detected a botnet.
      type: Number
    - contextPath: iboss.IP.reputationDatabaseMalwareDetection
      description: Whether reputation database detected malware.
      type: Number
    - contextPath: iboss.IP.reputationDatabaseEnabled
      description: Whether reputation database check is enabled.
      type: Number
    - contextPath: iboss.IP.reputationDatabaseIsSafeUrl
      description: Whether reputation database check determined entity is safe.
      type: String
    - contextPath: iboss.IP.reputationDatabaseLookupSuccess
      description: Whether reputation database lookup was successful.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicBlockUnreachableSites
      description: Whether unreachable sites will be blocked.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicDescription
      description: The web request heuristic description.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicIsSafeUrl
      description: Whether web request heuristics determined URL is safe.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicLevelHighScore
      description: The web request heuristic score high threshold.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicLevelLowScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicLevelMediumScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicLevelNoneScore
      description: The web request heuristic score none threshold.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicProtectionActionHigh
      description: The web request heuristic protection action high threshold.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicProtectionActionLow
      description: The web request heuristic protection action low threshold.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicProtectionActionMedium
      description: The web request heuristic protection action medium threshold.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicProtectionLevel
      description: The web request heuristic protection level.
      type: String
    - contextPath: iboss.IP.webRequestHeuristicSuccess
      description: Whether web request heuristic check was successful.
      type: Number
    - contextPath: iboss.IP.webRequestHeuristicSupport
      description: Whether web request heuristic support enabled.
      type: Number
  - description: Removes domains, IPs, and/or URLs from an allow list
    name: iboss-remove-entity-from-allow-list
    arguments:
    - name: entity
      isArray: true
      description: Domains, IPs, and/or URLs to remove from an allow list.
      required: true
      default: true
    - name: current_policy_being_edited
      description: The group/policy number to update.
      defaultValue: '1'
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
    outputs:
    - contextPath: iboss.RemoveEntityFromAllowList.message
      description: Operation result.
      type: String
  - description: Removes domains, IPs, and/or URLs to a block list.
    name: iboss-remove-entity-from-block-list
    arguments:
    - name: entity
      isArray: true
      description: Domains, IPs, and/or URLs to remove from a block list.
      required: true
      default: true
    - name: current_policy_being_edited
      description: The group/policy number to update.
      defaultValue: '1'
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
    outputs:
    - contextPath: iboss.RemoveEntityFromBlockList.message
      description: Operation result.
      type: String
  - description: Lookup reputation data for URLs.
    name: url
    arguments:
    - name: url
      isArray: true
      description: URL(s) to lookup.
      required: true
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: URL.Malicious.Description
      description: The indicator context description.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor that indicator context originated from.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: iboss.URL.isSafeUrl
      description: Whether entity is deemed safe.
      type: Number
    - contextPath: iboss.URL.categories
      description: The entity categories.
      type: String
    - contextPath: DBotScore.activeMalwareSubscription
      description: Whether active malware subscription is active.
      type: Number
    - contextPath: iboss.URL.categorized
      description: Whether entity is categorized.
      type: Number
    - contextPath: iboss.URL.googleSafeBrowsingDescription
      description: Google safe browsing description.
      type: String
    - contextPath: iboss.URL.message
      description: Entity lookup message.
      type: String
    - contextPath: iboss.URL.url
      description: The entity to perforum URL check on.
      type: String
    - contextPath: iboss.URL.googleSafeBrowsingEnabled
      description: Whether Google safe browsing is enabled.
      type: Number
    - contextPath: iboss.URL.googleSafeBrowsingIsSafeUrl
      description: Whether entity deemed safe by Google safe browsing.
      type: Number
    - contextPath: iboss.URL.googleSafeBrowsingSuccess
      description: Whether Google safe browsing check was successful.
      type: Number
    - contextPath: iboss.URL.googleSafeBrowsingSupport
      description: Whether Google safe browsing is supported.
      type: String
    - contextPath: iboss.URL.malwareEngineAnalysisDescription
      description: Malware engine analysis description.
      type: String
    - contextPath: iboss.URL.malwareEngineAnalysisEnabled
      description: Whether the malware engine analysis is enabled.
      type: Number
    - contextPath: iboss.URL.malwareEngineAnalysisSuccess
      description: Whether the malware engine analysis check was successful.
      type: Number
    - contextPath: iboss.URL.malwareEngineIsSafeUrl
      description: Whether the entity was deemed safe by the malware engine.
      type: Number
    - contextPath: iboss.URL.malwareEngineResultCode
      description: The result code from the malware engine analysis.
      type: String
    - contextPath: iboss.URL.realtimeCloudLookupDomainIsGrey
      description: Whether realtime cloud lookup is grey.
      type: Number
    - contextPath: iboss.URL.realtimeCloudLookupDomainEnabled
      description: Whether realtime cloud lookup is enabled.
      type: Number
    - contextPath: iboss.URL.realtimeCloudLookupIsSafeUrl
      description: Whether realtime cloud lookup determined entity is safe.
      type: Number
    - contextPath: iboss.URL.realtimeCloudLookupRiskDescription
      description: Realtime cloud lookup risk description.
      type: String
    - contextPath: iboss.URL.realtimeCloudLookupSuccess
      description: Whether realtime cloud lookup chec was successful.
      type: Number
    - contextPath: iboss.URL.reputationDatabaseBotnetDetection
      description: Whether reputation database detected a botnet.
      type: Number
    - contextPath: iboss.URL.reputationDatabaseMalwareDetection
      description: Whether reputation database detected malware.
      type: Number
    - contextPath: iboss.URL.reputationDatabaseEnabled
      description: Whether reputation database check is enabled.
      type: Number
    - contextPath: iboss.URL.reputationDatabaseIsSafeUrl
      description: Whether reputation database check determined entity is safe.
      type: String
    - contextPath: iboss.URL.reputationDatabaseLookupSuccess
      description: Whether reputation database lookup was successful.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicBlockUnreachableSites
      description: Whether unreachable sites will be blocked.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicDescription
      description: The web request heuristic description.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicIsSafeUrl
      description: Whether web request heuristics determined URL is safe.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicLevelHighScore
      description: The web request heuristic score high threshold.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicLevelLowScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicLevelMediumScore
      description: The web request heuristic score low threshold.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicLevelNoneScore
      description: The web request heuristic score none threshold.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicProtectionActionHigh
      description: The web request heuristic protection action high threshold.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicProtectionActionLow
      description: The web request heuristic protection action low threshold.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicProtectionActionMedium
      description: The web request heuristic protection action medium threshold.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicProtectionLevel
      description: The web request heuristic protection level.
      type: String
    - contextPath: iboss.URL.webRequestHeuristicSuccess
      description: Whether web request heuristic check was successful.
      type: Number
    - contextPath: iboss.URL.webRequestHeuristicSupport
      description: Whether web request heuristic support enabled.
      type: Number
  - description: Add entity to policy layer list.
    name: iboss-add-entity-to-policy-layer-list
    arguments:
    - name: policy_layer_name
      description: Policy layer name to lookup.
      required: true
    - name: entity
      isArray: true
      description: Entity to add to policy layer list.
      required: true
      default: true
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
    - name: do_dlp_scan
      description: Whether to perform DLP scanning.
      defaultValue: '1'
      predefined:
      - '0'
      - '1'
    - name: do_malware_scan
      description: Whether to perform malware scanning.
      defaultValue: '1'
      predefined:
      - '0'
      - '1'
    - name: priority
      description: Priority of entry (higher number takes precedence) when conflicting entry in the block list.
      defaultValue: '0'
    - name: time_url_expires_in_seconds
      description: The expiration time in seconds for the entry (0 indicates an entry that does not expire).
      defaultValue: '0'
    - name: note
      description: Note added to the entry.
    - name: is_regex
      description: Whether entity consists of a regex pattern.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
    - name: upsert
      description: Update entity if it already exists.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
    outputs:
    - contextPath: iboss.AddEntityToPolicyLayerList.message
      description: Operation result.
      type: String

  - description: Remove entity from policy layer list.
    name: iboss-remove-entity-from-policy-layer-list
    arguments:
    - name: policy_layer_name
      description: Policy layer name to lookup.
      required: true
    - name: entity
      isArray: true
      description: Entity to add to policy layer list.
      required: true
      default: true
    - name: start_port
      description: Which start port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: end_port
      description: Which end port(s) to match; 0 indicates all ports.
      defaultValue: '0'
    - name: direction
      description: Which direction(s) to match.
      defaultValue: '2'
      predefined:
      - '0'
      - '1'
      - '2'
    - name: do_dlp_scan
      description: Whether to perform DLP scanning.
      defaultValue: '1'
      predefined:
      - '0'
      - '1'
    - name: do_malware_scan
      description: Whether to perform malware scanning.
      defaultValue: '1'
      predefined:
      - '0'
      - '1'
    - name: priority
      description: Priority of entry (higher number takes precedence) when conflicting entry in the block list.
      defaultValue: '0'
    - name: time_url_expires_in_seconds
      description: The expiration time in seconds for the entry (0 indicates an entry that does not expire).
      defaultValue: '0'
    - name: note
      description: Note added to the entry.
    - name: is_regex
      description: Whether entity consists of a regex pattern.
      defaultValue: '0'
      predefined:
      - '0'
      - '1'
    outputs:
    - contextPath: iboss.RemoveEntityFromPolicyLayerList.message
      description: Operation result.
      type: String
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
fromversion: 6.2.0
tests:
- No tests