Ignite

Use the Ignite integration to reduce business risk. Ignite allows users to ingest alerts and compromised credentials as incident alerts and executes commands such as search intelligence report, ip, url, get events, and more.

Data Enrichment & Threat Intelligence · Flashpoint

Details

IDIgnite
ProviderFlashpoint
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.11879924
Supported ModulesAgentix XSIAM

README

Use the Flashpoint Ignite integration to reduce business risk. Ignite allows users to ingest alerts and compromised credentials as incident alerts and executes commands such as search intelligence report, ip, url, get events, and more.
This integration was integrated and tested with API v1 of Ignite.

Auto Extract Indicator

Both incident types Ignite Alert and Flashpoint Compromised Credentials support the auto extraction feature by default. This feature extracts indicators and enriches their reputations using commands and scripts defined for the indicator type (Refer to Indicator extraction (Cortex XSOAR 6.13) or Indicator extraction (Cortex XSOAR 8 Cloud) or Indicator extraction (Cortex XSOAR 8.7 On-prem) for more details).

If you are upgrading from a Flashpoint integration, please refer to the Migration Guide for guidance.

Configure Flashpoint Ignite on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Flashpoint Ignite.
  3. Click Add instance to create and configure a new integration instance.
  4. To fetch Ignite alerts, refer to the section “Configuration for fetching Ignite Alerts as a Cortex XSOAR Incident”.
  5. To fetch Ignite compromised credentials, refer to the section “Configuration for fetching Ignite Compromised Credentials as a Cortex XSOAR Incident”.
Parameter Description Required
Fetch incidents   False
Incidents Fetch Interval   False
Incident type   False
Server URL Server URL to connect to Ignite. True
API Key API key used for secure communication with the Ignite platform. True
Maximum number of incidents per fetch The maximum limit is 200 for alerts and compromised credentials. False
First fetch time Date or relative timestamp to start fetching the incidents from. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.). False
Fetch Type Whether to fetch the Ignite alerts or the compromised credentials. Defaults to “Compromised Credentials” if nothing selected. False
Severity for Incidents Set the default severity for the incidents using this instance. False
Alert Status Filters the incoming alerts with the provided alert status. False
Alert Origin Filters the incoming alerts with the origin of the alert. False
Alert Sources Filters the incoming alerts with the source of the alert. False
Fetch fresh compromised credentials alerts Adds the ‘is_fresh’ flag to compromised credential queries so it only ingests username/password combinations if they haven’t been seen before. False
Fetch compromised credentials alerts having lowercase in password Filters the incoming compromised credentials alerts with passwords having lowercase letters. False
Fetch compromised credentials alerts having uppercase in password Filters the incoming compromised credentials alerts with passwords having uppercase letters. False
Fetch compromised credentials alerts having numbers in password Filters the incoming compromised credentials alerts with passwords having numbers. False
Fetch compromised credentials alerts having symbol in password Filters the incoming compromised credentials alerts with passwords having symbols. False
Fetch compromised credentials alerts having minimum length of password Filters the incoming compromised credentials alerts with passwords has minimum length. False
Source Reliability Reliability of the source providing the intelligence data. False
Enable Exact Match for IOC Enrichment Whether to use exact matching for indicator values by default in enrichment commands (ip, domain, file, and url). This behavior can be overridden for individual commands using the exact_match argument. False
Reputation commands context limit Maximum number of entries stored per reputation command result for both relationships (e.g. related IPs) and enrichments (e.g. domains, emails, CVEs). Lowering this value improves performance and reduces context size, but may omit some details. Raising it preserves more details at the cost of larger context payloads and potential performance degradation. Default is 50. False
Create relationships Create relationships between indicators as part of enrichment. False
Community search message max length The maximum number of characters retained from the message field of a community search result returned by the ip command. Lowering this value reduces context payload size, while raising it preserves more of the original content. False
Trust any certificate (not secure)   False
Use system proxy settings   False
  1. Click Test to validate the URLs, token, and connection.

Configuration for fetching Ignite Alerts as a Cortex XSOAR Incident

  1. Select Fetches incidents.
  2. Under Classifier, select “N/A”.
  3. Under Incident type, select “Ignite Alert”.
  4. Under Mapper (incoming), select “Ignite Alert - Incoming Mapper” for default mapping.
  5. Enter the connection parameters (Server URL, API key).
  6. Under the Fetch Type, select “Alerts”.
  7. Select “Alert Status” based on your requirement to filter the alerts. By default, it will fetch all status of alerts.
  8. Select “Alert Origin” based on your requirement to filter the alerts. By default, it will fetch all origins of alerts.
  9. Select “Alert Sources” based on your requirement to filter the alerts. By default, it will fetch all sources of alerts.
  10. Select “Severity for Incidents” based on your requirement to set the default severity for the incidents. By default, it will set the Unknown severity for all incidents.
  11. Update “First fetch time” and “Max Fetch Count” based on your requirements.

Configuration for fetching Ignite Compromised Credentials as a Cortex XSOAR Incident

  1. Select Fetches incidents.
  2. Under Classifier, select “N/A”.
  3. Under Incident type, select “Flashpoint Compromised Credentials”.
  4. Under Mapper (incoming), select “Flashpoint Compromised Credentials - Incoming Mapper” for default mapping.
  5. Enter the connection parameters (Server URL, API key).
  6. Under the Fetch Type, select “Compromised Credentials”.
  7. Select “Fetch fresh compromised credentials alerts” so that it only ingests username/password combinations if they haven’t been seen before.
  8. Select “Fetch compromised credentials alerts having lowercase in password” so that it filters the incoming compromised credentials alerts with passwords having lowercase letters.
  9. Select “Fetch compromised credentials alerts having uppercase in password” so that it filters the incoming compromised credentials alerts with passwords having uppercase letters.
  10. Select “Fetch compromised credentials alerts having numbers in password” so that it filters the incoming compromised credentials alerts with passwords having numbers.
  11. Select “Fetch compromised credentials alerts having symbol in password” so that it filters the incoming compromised credentials alerts with passwords having symbols.
  12. Select “Fetch compromised credentials alerts having minimum length of password” so that it filters the incoming compromised credentials alerts with passwords has minimum length.
  13. Update “First fetch time” and “Max Fetch Count” based on your requirements.

Troubleshooting

Error: The maximum records to fetch for the given first fetch can not exceed 10,000

  • The maximum number of records that can be fetched using the first fetch time is limited to 10,000 by the API.
  • To resolve this issue, you can reduce the first fetch time to a shorter time period, ensuring that the total number of records fetched during the specified time falls within the 10,000 limit.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

flashpoint-ignite-intelligence-report-search

Search for the Intelligence Reports using a keyword.

Base Command

flashpoint-ignite-intelligence-report-search

Input

Argument Name Description Required
report_search Search report using keyword or text. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.

Command example

!flashpoint-ignite-intelligence-report-search report_search=ChatGpt

Context Example

{
    "Ignite": {
        "Report": [
            {
                "NotifiedAt": "2024-04-17T19:23:51.870+00:00",
                "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000001",
                "PostedAt": "2024-04-17T19:23:51.870+00:00",
                "ReportId": "00000000000000000001",
                "Summary": "This report covers evolving events that impact the advancement of AI technology and highlights notable developments that impact safety for users and organizations.",
                "Title": "Artificial Intelligence Threat Landscape",
                "UpdatedAt": "2024-04-17T19:23:51.870+00:00"
            }
        ]
    }
}

Human Readable Output

Ignite Intelligence reports related to search: ChatGpt

Top 5 reports:

1) Artificial Intelligence Threat Landscape
Summary: This report covers evolving events that impact the advancement of AI technology and highlights notable developments that impact safety for users and organizations.

Link to Report-search on Ignite platform: https://app.flashpoint.io/cti/intelligence/search?query=ChatGpt

flashpoint-ignite-compromised-credentials-list

Retrieves the compromised credentials based on the filter values provided in the command arguments.

Base Command

flashpoint-ignite-compromised-credentials-list

Input

Argument Name Description Required
start_date Filters the data based on the start date of the breach (UTC). Note: Will consider current time as default for end_date if start_date is initialized.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.		 Optional
end_date Filters the data based on the end date of the breach (UTC). Note: Requires start_date along with the given argument.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.		 Optional
filter_date Filters the compromised credential’s breach data by either created or first observed date.
Note: Requires the argument value for at least ‘start_date’ and ‘end_date’. Possible values are: created_at, first_observed_at.		 Optional
page_size The maximum number of result objects to return per page. Note: The maximum value is 1,000. Default is 50. Optional
page_number Specify a page number to retrieve the compromised credentials. Note: The multiplication of page_size and page_number parameters cannot exceed 10,000. Default is 1. Optional
sort_date Sort the compromised credential’s breach data by either created or first observed date. Note: Will consider ascending as default for sort_order if sort_date is initialized. Possible values are: created_at, first_observed_at. Optional
sort_order Specify the order to sort the data in. Note: Requires sort_date along with the given argument. Possible values are: asc, desc. Optional
is_fresh Whether to fetch the fresh compromised credentials or not. Possible values are: true, false. Optional

Context Output

Path Type Description
Ignite.CompromisedCredential._id String ID of the IoC.
Ignite.CompromisedCredential._source.affected_domain String Affected domain of the IoC.
Ignite.CompromisedCredential._source.basetypes Unknown The array contains the underlying type of the credentials object, in this case [“credential-sighting”].
Ignite.CompromisedCredential._source.body.raw String This is the raw content captured from the breach Flashpoint discovered.
Ignite.CompromisedCredential._source.breach._header String This is the breach header object.
Ignite.CompromisedCredential._source.breach.basetypes Unknown Array containing the underlying base type of the breach object, i.e., [“breach”].
Ignite.CompromisedCredential._source.breach.breach_type String Constant for future use.
Ignite.CompromisedCredential._source.breach.created_at.date-time Date The datetime when the source breach was created, formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.breach.created_at.timestamp Number The UNIX timestamp when the source breach was created.
Ignite.CompromisedCredential._source.breach.first_observed_at.date-time Date Datetime when the source breach was first observed, formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.breach.first_observed_at.timestamp Number The UNIX timestamp when the source breach was first observed.
Ignite.CompromisedCredential._source.breach.fpid String Flashpoint ID of the breach.
Ignite.CompromisedCredential._source.breach.source String Data source of breach (i.e., Analyst Research, CredentialStealer, etc.).
Ignite.CompromisedCredential._source.breach.source_type String Type of source of the breach.
Ignite.CompromisedCredential._source.breach.title String Title of the breach.
Ignite.CompromisedCredential._source.breach.victim String Victim of the breach.
Ignite.CompromisedCredential._source.credential_record_fpid String The Flashpoint ID of the associated record object. Used to retrieve sightings for a credential.
Ignite.CompromisedCredential._source.customer_id String Customer ID of the IoC.
Ignite.CompromisedCredential._source.domain String The domain object extracted off of the email address.
Ignite.CompromisedCredential._source.email String The email address for the compromised credential.
Ignite.CompromisedCredential._source.username String The username for the compromised credential.
Ignite.CompromisedCredential._source.extraction_id String Extraction ID of the IoC.
Ignite.CompromisedCredential._source.extraction_record_id String Extraction record ID of the IoC.
Ignite.CompromisedCredential._source.fpid String The Flashpoint ID of this credentials object.
Ignite.CompromisedCredential.source.header.indexed_at String Timestamp for when this document was indexed into the Flashpoint database.
Ignite.CompromisedCredential.source.header.pipeline_duration String Pipeline duration header information of the IoC.
Ignite.CompromisedCredential._source.is_fresh Boolean “true” if the credential has not been seen before, and it hasn’t been marked “not fresh” by an analyst. (Historical breaches are not “fresh”.).
Ignite.CompromisedCredential._source.last_observed_at.date-time Date If exists, time object for when the credential was previously observed. Datetime object formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.last_observed_at.timestamp Number The UNIX timestamp when the source breach was first observed.
Ignite.CompromisedCredential._source.password String The password for the credential (in plain text, if possible).
Ignite.CompromisedCredential._source.password_complexity.has_lowercase Boolean Whether lowercase letters are present.
Ignite.CompromisedCredential._source.password_complexity.has_number Boolean Whether numbers are present.
Ignite.CompromisedCredential._source.password_complexity.has_symbol Boolean Whether symbols are present.
Ignite.CompromisedCredential._source.password_complexity.has_uppercase Boolean Whether uppercase letters are present.
Ignite.CompromisedCredential._source.password_complexity.length Number Integer value that represents the number of characters in the password.
Ignite.CompromisedCredential._source.password_complexity.probable_hash_algorithms Unknown List of possible hash algorithms suspected based on the text pattern of the password. (May include values like “MD5”, “SHA-1”, “SHA-256”, “bcrypt”, etc.)
Ignite.CompromisedCredential._source.times_seen Number Integer representing the number of times the credential has been seen at Flashpoint.
Ignite.CompromisedCredential._type String Type of the IoC.
Ignite.CompromisedCredential.matched_queries Unknown Matching queries of the IoC.
Ignite.CompromisedCredential.sort Unknown Sort value of the IoC.

Command example

!flashpoint-ignite-compromised-credentials-list start_date="2 weeks" end_date="1 days" filter_date=created_at is_fresh=true page_number=2 page_size=1 sort_date=created_at sort_order=asc

Context Example

{
    "Ignite": {
        "CompromisedCredential": {
            "_id": "sample_id",
            "_source": {
                "affected_domain": "example",
                "affected_url": "https://dummy_url",
                "basetypes": [
                    "credential-sighting"
                ],
                "body": {
                    "raw": "URL: https://dummy_url\r\nUsername: someone@example.com\r\nPassword: pass_123\r\nApplication: Microsoft_[Edge]_Default"
                },
                "breach": {
                    "basetypes": [
                        "breach"
                    ],
                    "breach_type": "credential",
                    "created_at": {
                        "date-time": "2024-05-10T16:13:33Z",
                        "timestamp": 1715789613
                    },
                    "first_observed_at": {
                        "date-time": "2024-05-10T16:13:34Z",
                        "timestamp": 1715789614
                    },
                    "fpid": "sample_fpid",
                    "source": "Analyst Research",
                    "source_type": "Credential Stealer",
                    "title": "Compromised Users from Redline Stealer Malware \"logs_05_10_2024-160709.zip\" May152024"
                },
                "credential_record_fpid": "sample_credential_record_fpid",
                "customer_id": "sample_customer_id",
                "domain": "example.com",
                "email": "someone@example.com",
                "extraction_id": "sample_extraction_id",
                "extraction_record_id": "sample_extraction_record_id",
                "fpid": "sample_fpid",
                "header_": {
                    "indexed_at": 1715793565,
                    "pipeline_duration": 63883012765
                },
                "is_fresh": true,
                "last_observed_at": {
                    "date-time": "2024-05-10T16:13:34Z",
                    "timestamp": 1715789614
                },
                "password": "pass_123",
                "password_complexity": {
                    "has_lowercase": true,
                    "has_number": true,
                    "has_symbol": true,
                    "has_uppercase": true,
                    "length": 9
                },
                "times_seen": 1,
                "username": "someone@example.com"
            },
            "_type": "_doc",
            "matched_queries": [
                "data.example"
            ],
            "sort": [
                1715789613000
            ]
        }
    }
}

Human Readable Output

Total number of records found: 150

Compromised Credential(s)

FPID Email Username Breach Source Breach Source Type Password Created Date (UTC) First Observed Date (UTC)
sample_fpid someone@example.com someone@example.com Analyst Research Credential Stealer pass_123 May 10, 2024 16:13 May 10, 2024 16:13

flashpoint-ignite-event-list

Searches for events within the specified time period, the Flashpoint report ID, or attack IDs.

Base Command

flashpoint-ignite-event-list

Input

Argument Name Description Required
time_period The time period for the search. Optional
report_fpid The Flashpoint report ID. To retrieve the Flashpoint report ID, run the flashpoint-ignite-intelligence-related-report-list command. Optional
limit The maximum number of records. Default is 10. Optional
attack_ids A comma-separated list of attack IDs for which to search. Attack IDs can be found in event information or on the Ignite platform by filtering events by attack IDs. Optional

Context Output

Path Type Description
Ignite.Event.EventCreatorEmail string The email of the event creator.
Ignite.Event.EventId string The ID of the event.
Ignite.Event.UUID string The UUID of the event.
Ignite.Event.Href string The hyperlink of the event.
Ignite.Event.MalwareDescription string The description of the malware.
Ignite.Event.Name string The name of the event.
Ignite.Event.ObservedTime string The date that the event was triggered.
Ignite.Event.Tags string The tags of the event.

Command example

!flashpoint-ignite-event-list limit="2" attack_ids=T1001

Context Example

{
    "Ignite": {
        "Event": [
            {
                "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000001\" [2024-05-31 03:49:12]",
                "Tags": "mitre:T1001",
                "EventCreatorEmail": "info@flashpoint-intel.com",
                "EventId": "0000000000000000000001",
                "UUID": "00000000-0000-0000-0000-0001",
                "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000001",
                "ObservedTime": "May 31, 2024  04:03",
                "MalwareDescription": "This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack."
            },
            {
                "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000002\" [2024-05-31 00:01:14]",
                "Tags": "mitre:T1001",
                "EventCreatorEmail": "info@flashpoint-intel.com",
                "EventId": "0000000000000000000002",
                "UUID": "00000000-0000-0000-0000-0002",
                "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000002",
                "ObservedTime": "May 31, 2024  01:00",
                "MalwareDescription": "Strike became popular among threat actors as an initial access payload, as well as a second-stage tool threat actors use once access is achieved."
            }
        ]
    }
}

Human Readable Output

Ignite Events

Below are the detail found

Observed time (UTC) Name Tags Malware Description
May 31, 2024 04:03 Observation: strike “0000000000000000000000000000000000000000000000000000000000000001” [2024-05-31 03:49:12] mitre:T1001 This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack.
May 31, 2024 01:00 Observation: strike “0000000000000000000000000000000000000000000000000000000000000002” [2024-05-31 00:01:14] mitre:T1001 Strike became popular among threat actors as an initial access payload, as well as a second-stage tool threat actors use once access is achieved.

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs

flashpoint-ignite-event-get

Retrieves the details of a single event using event FPID or UUID.

Base Command

flashpoint-ignite-event-get

Input

Argument Name Description Required
event_id The FPID or UUID that identifies a particular event. The event ID can be fetched from the output context path (Ignite.Event.EventId) of the flashpoint-ignite-event-list command, or the indicator reputation command response or some other investigation. Required

Context Output

Path Type Description
Ignite.Event.EventCreatorEmail string The email of the event creator.
Ignite.Event.EventId string The ID of the event.
Ignite.Event.UUID string The UUID of the event.
Ignite.Event.Href string The hyperlink of the event.
Ignite.Event.MalwareDescription string The description of the malware.
Ignite.Event.Name string The name of the event.
Ignite.Event.ObservedTime string The date that the event was triggered.
Ignite.Event.Tags string The tags of the event.

Command example

!flashpoint-ignite-event-get event_id=0000000000000000000001

Context Example

{
    "Ignite": {
        "Event": {
            "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000001\" [2024-05-31 03:49:12]",
            "Tags": "mitre:T1001",
            "EventCreatorEmail": "info@flashpoint-intel.com",
            "EventId": "0000000000000000000001",
            "UUID": "00000000-0000-0000-0000-0001",
            "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000001",
            "ObservedTime": "May 31, 2024  04:03",
            "MalwareDescription": "This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack."
        }
    }
}

Human Readable Output

Ignite Event details

Below are the detail found

Observed time (UTC) Name Tags Malware Description
May 31, 2024 04:03 Observation: strike “0000000000000000000000000000000000000000000000000000000000000001” [2024-05-31 03:49:12] mitre:T1001 This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack.

flashpoint-ignite-intelligence-report-get

Get single report details using the report id.

Base Command

flashpoint-ignite-intelligence-report-get

Input

Argument Name Description Required
report_id The ID of the report for which the details are to be fetched. The report ID can be retrieved from the output context path (Ignite.Report.ReportId) of the flashpoint-ignite-intelligence-report-search command or some other investigation. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of the report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.
Ignite.Report.Tags string Tags of the report.

Command example

!flashpoint-ignite-intelligence-report-get report_id=00000000000000000001

Context Example

{
    "Ignite": {
        "Report": {
            "NotifiedAt": "2022-02-10T22:25:51.190+00:00",
            "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000001",
            "PostedAt": "2022-02-10T22:25:51.190+00:00",
            "ReportId": "00000000000000000001",
            "Summary": "A weekly update on major developments in XYZ.",
            "Title": "Key Developments: XYZ (February 3-10, 2022)",
            "UpdatedAt": "2022-02-10T22:25:51.190+00:00",
            "Tags": "Energy, Government & Policymakers, XYZ, Law Enforcement & Military, Intelligence Report, Technology & Internet, Right-Wing Extremist, Media & Telecom, Protests, Cyber Threats, Physical Threats, Government, Technology, Right-wing extremism, Media, Direct action and protests, Key Developments: XYZ "
        }
    }
}

Human Readable Output

Ignite Intelligence Report details

Below are the details found

Title Date Published (UTC) Summary Tags
Key Developments: XYZ (February 3-10, 2022) Feb 10, 2022 22:25 A weekly update on major developments in XYZ. Energy, Government & Policymakers, XYZ, Law Enforcement & Military, Intelligence Report, Technology & Internet, Right-Wing Extremist, Media & Telecom, Protests, Cyber Threats, Physical Threats, Government, Technology, Right-wing extremism, Media, Direct action and protests, Key Developments: XYZ

flashpoint-ignite-intelligence-related-report-list

List related reports for a particular report using the report ID.

Base Command

flashpoint-ignite-intelligence-related-report-list

Input

Argument Name Description Required
report_id The report-id of the report of which the related reports are to be fetched. The report id can be known from output context path (Ignite.Report.ReportId) of flashpoint-ignite-intelligence-report-search command or some other investigation. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.

Command example

!flashpoint-ignite-intelligence-related-report-list report_id=00000000000000000003

Context Example

{
    "Ignite": {
        "Report": [
            {
                "NotifiedAt": "2023-04-13T21:18:35.557+00:00",
                "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000003",
                "PostedAt": "2023-04-13T21:18:35.557+00:00",
                "ReportId": "00000000000000000003",
                "Summary": "A weekly report on the major developments in XYZ.              ",
                "Title": "Key Developments: XYZ (April 7-13, 2023)",
                "UpdatedAt": "2023-04-13T21:18:35.557+00:00"
            }
        ]
    }
}

Human Readable Output

Ignite Intelligence related reports

Top 5 related reports:

1) Key Developments: XYZ (April 7-13, 2023)
Summary: A weekly report on the major developments in XYZ.

Link to the given Report on Ignite platform: https://app.flashpoint.io/cti/intelligence/report/00000000000000000001#detail

flashpoint-ignite-alert-list

Retrieves a list of alerts based on the filter values provided in the command arguments.

Base Command

flashpoint-ignite-alert-list

Input

Argument Name Description Required
size The number of alerts to return. Default is 10. Optional
created_after Returns alerts that occurred after the specified date. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc). Optional
created_before Returns alerts that occurred before the specified date. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc). Optional
cursor The cursor to retrieve next page data. Used for pagination only. The value of the cursor can be found from the output context path (Ignite.PageToken.Alert.cursor) or the HR output of the flashpoint-ignite-alert-list command. Optional
status Filter alerts by status. Possible values are: Archived, Starred, Sent, None. Optional
origin Filter alerts by origin. Possible values are: Searches, Assets. Optional
sources Filter alerts by source. Possible values are: Github, Gitlab, Bitbucket, Communities, Images, Marketplaces, Reports, Vulnerabilities. Optional
tags A comma-separated list of alerts filtered by tags. Optional
asset_type Filter alerts by asset type. Optional
asset_ip Filter alerts by asset IP. Optional
asset_ids A comma-separated list of alerts filtered by asset IDs. Optional
query_ids A comma-separated list of alerts filtered by search IDs. Optional

Context Output

Path Type Description
Ignite.Alert.id String The unique identifier for the alert.
Ignite.Alert.resource.id String The identifier for the resource associated with the alert.
Ignite.Alert.resource.basetypes String Base types of the resource related to the alert.
Ignite.Alert.resource.container.container.name String The name of the nested container within the resource that holds the alert.
Ignite.Alert.resource.container.container.native_id String The native identifier for the nested container within the resource.
Ignite.Alert.resource.container.container.title String The title of the nested container within the resource.
Ignite.Alert.resource.container.name String The name of the container that holds the resource associated with the alert.
Ignite.Alert.resource.container.native_id String The native identifier for the container that holds the resource.
Ignite.Alert.resource.container.title String The title of the container that holds the resource associated with the alert.
Ignite.Alert.resource.created_at.date-time String The date and time when the resource associated with the alert was created in ISO 8601 format.
Ignite.Alert.resource.created_at.raw Date The raw timestamp or other date-time representation when the resource was created.
Ignite.Alert.resource.created_at.timestamp Number The UNIX timestamp representing when the resource associated with the alert was created.
Ignite.Alert.resource.media_v2.sha1 String The SHA1 hash of the media file related to the alert.
Ignite.Alert.resource.media_v2.phash String The perceptual hash (pHash) of the media file, used to find visually similar images.
Ignite.Alert.resource.media_v2.media_type String The type of media (e.g., image, video) associated with the alert.
Ignite.Alert.resource.media_v2.mime_type String The MIME type of the media file associated with the alert.
Ignite.Alert.resource.media_v2.storage_uri String The storage URI where the media file related to the alert is located.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.racy Number A score indicating the likelihood that the image contains racy content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.spoof Number A score indicating the likelihood that the image contains spoofed content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.medical Number A score indicating the likelihood that the image contains medical content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.adult Number A score indicating the likelihood that the image contains sexual content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.adult Number A score indicating the likelihood that the image contains adult content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.violence Number A score indicating the likelihood that the image contains violent content.
Ignite.Alert.resource.title String The title of the resource associated with the alert.
Ignite.Alert.resource.section String The section of the platform or service where the resource is categorized or located.
Ignite.Alert.resource.repo String Repository of the resource related to the alert.
Ignite.Alert.resource.snippet String Snippet of the resource related to the alert.
Ignite.Alert.resource.source String Source of the resource related to the alert.
Ignite.Alert.resource.url String URL of the resource related to the alert.
Ignite.Alert.resource.owner String Owner of the resource related to the alert.
Ignite.Alert.resource.file String File associated with the resource related to the alert.
Ignite.Alert.resource.parent_basetypes String The parent base types that categorize the resource.
Ignite.Alert.resource.site_actor.names.handle String The username or handle of the site actor related to the resource.
Ignite.Alert.resource.site_actor.native_id String The native identifier for the site actor associated with the resource.
Ignite.Alert.resource.sort_date Date The date and time used for sorting the resource, typically the creation or publication date.
Ignite.Alert.resource.site.title String The title of the site or platform associated with the resource.
Ignite.Alert.resource.shodan_host.asn String The ASN (Autonomous System Number) of the Shodan host.
Ignite.Alert.resource.shodan_host.country String The country of the Shodan host.
Ignite.Alert.resource.shodan_host.org String The organization of the Shodan host.
Ignite.Alert.resource.shodan_host.shodan_url String The Shodan URL of the Shodan host.
Ignite.Alert.resource.shodan_host.vulns Unknown The vulnerabilities related to the Shodan host.
Ignite.Alert.reason.id String ID of the reason for the alert.
Ignite.Alert.reason.name String Name of the reason for the alert.
Ignite.Alert.reason.text String Text related to the reason for the alert.
Ignite.Alert.reason.origin String Origin of the reason for the alert.
Ignite.Alert.reason.details.sources String Sources related to the reason for the alert.
Ignite.Alert.reason.details.params Unknown Parameters related to the reason for the alert.
Ignite.Alert.reason.details.params.include.date.end String The end date for the included date range in the alert’s reason details.
Ignite.Alert.reason.details.params.include.date.label String The label describing the included date range in the alert’s reason details.
Ignite.Alert.reason.details.params.include.date.start String The start date for the included date range in the alert’s reason details.
Ignite.Alert.reason.details.type String The type of details related to the reason for the alert.
Ignite.Alert.reason.entity.id String ID of the entity related to the reason for the alert.
Ignite.Alert.reason.entity.name String Name of the entity related to the reason for the alert.
Ignite.Alert.reason.entity.type String Type of the entity related to the reason for the alert.
Ignite.Alert.status String Status of the alert.
Ignite.Alert.generated_at Date Date when the alert was generated.
Ignite.Alert.created_at Date Date when the alert was created.
Ignite.Alert.tags Unknown Tags associated with the alert.
Ignite.Alert.highlights.media_v2.image_enrichment.enrichments.v1.image-analysis.text.value String The text value extracted from the image analysis in the alert’s highlights.
Ignite.Alert.highlights.ports String The highlighted ports related to the alert.
Ignite.Alert.highlights.services String The highlighted services related to the alert.
Ignite.Alert.highlight_text String The highlighted text associated with the alert.
Ignite.Alert.data_type String Data type of the alert.
Ignite.Alert.parent_data_type String Parent data type of the alert.
Ignite.Alert.source String Source of the alert.
Ignite.Alert.is_read Boolean Indicates if the alert has been read.
Ignite.Alert.highlights.body.text/plain String The plain text extracted from the body of the content highlighted in the alert.
Ignite.Alert.reason.details.params.include.ships_from String The shipping origin included in the alert’s reason details.
Ignite.Alert.highlights.snippet String A snippet or excerpt highlighted in the alert.
Ignite.PageToken.Alert.created_after Date Date for filtering alerts created after a specific time.
Ignite.PageToken.Alert.created_before Date Date for filtering alerts created before a specific time.
Ignite.PageToken.Alert.size String Size of the page for pagination.
Ignite.PageToken.Alert.cursor Date Cursor for pagination to retrieve the next set of alerts.
Ignite.PageToken.Alert.name String The name of the command.

Command example

!flashpoint-ignite-alert-list created_after="2024-06-11T05:54:25Z" created_before="2024-06-12T05:54:27Z" size=1

Context Example

{
    "Ignite": {
        "Alert": {
            "id": "00000000-0000-0000-0000-000000000001",
            "resource": {
                "id": "00000000-0000-0000-0000-000000000001",
                "basetypes": [
                    "code",
                    "file",
                    "github",
                    "repository"
                ],
                "file": "2024/06/17/My First Blog/index.html",
                "url": "https://dummyurl.com/naive-gabrie-white",
                "owner": "naive-gabrie-white",
                "source": "github",
                "repo": "naive-gabrie-white.github.io",
                "snippet": "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"facebook,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:..."
            },
            "reason": {
                "id": "00000000-0000-0000-0000-000000000001",
                "name": "fb",
                "text": "facebook",
                "origin": "searches",
                "details": {
                    "sources": [
                        "data_exposure__github",
                        "data_exposure__gitlab",
                        "data_exposure__bitbucket"
                    ]
                },
                "entity": {
                    "id": "000000000000000001",
                    "name": "Crest Data Systems",
                    "type": "organization"
                }
            },
            "generated_at": "2024-06-17T05:54:19Z",
            "created_at": "2024-06-17T05:54:22.158905Z",
            "highlights": {
                "snippet": [
                    "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:..."
                ]
            },
            "highlight_text": "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:...",
            "data_type": "github",
            "source": "data_exposure__github",
            "is_read": false
        },
        {
            "id": "00000000-0000-0000-0000-000000000005",
            "resource": {
                "id": "00000000000000000005",
                "basetypes": [
                    "infrastructure",
                    "internet",
                    "shodan"
                ],
                "source": "shodan",
                "shodan_host": {
                    "asn": "AS0001",
                    "country": "United States",
                    "org": "Company LLC",
                    "shodan_url": "https://www.shodan.io/host/0.0.0.1"
                }
            },
            "reason": {
                "id": "00000000000000000005",
                "name": "Company IP",
                "text": "0.0.0.1",
                "origin": "assets",
                "details": {
                    "type": "ipv4s"
                },
                "entity": {
                    "id": "000000000000000001",
                    "name": "Crest Data Systems",
                    "type": "organization"
                }
            },
            "generated_at": "2024-07-02T16:43:17Z",
            "created_at": "2024-07-02T16:43:37.476237Z",
            "highlights": {
                "ports": [
                    "<x-fp-highlight>53</x-fp-highlight>",
                    "<x-fp-highlight>443</x-fp-highlight>"
                ],
                "services": [
                    "<x-fp-highlight>Unknown Service (Port 01)</x-fp-highlight>",
                    "<x-fp-highlight>Unknown Service (Port 02)</x-fp-highlight>"
                ]
            },
            "highlight_text": "<x-fp-highlight>53</x-fp-highlight>",
            "data_type": "unknown",
            "is_read": false
        },
        "PageToken": {
            "Alert": {
                "created_after": "2024-06-14T05:54:25Z",
                "created_before": "2024-06-17T05:54:25Z",
                "cursor": "1718603662.158905",
                "name": "flashpoint-ignite-alert-list",
                "size": "1"
            }
        }
    }
}

Human Readable Output

Alerts

ID Created at (UTC) Query Source Resource URL Site Title Shodan Host Repository Owner Origin Ports Services Highlight Text
00000000-0000-0000-0000-000000000001 Jun 17, 2024 05:54 facebook data_exposure__github https://dummyurl.com/naive-gabrie-white     naive-gabrie-white.github.io naive-gabrie-white searches     data-image=”https://i.dummyurl.net/2021/02/24/000000000000001.png” data-sites=”<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq”><link rel=”stylesheet” href=”https:…>
00000000-0000-0000-0000-000000000005 Jul 02, 2024 16:43 0.0.0.1       asn: AS0001
country: United States
org: Company LLC
shodan_url: https://www.shodan.io/host/0.0.0.1		     assets 53, 443 Unknown Service (Port 01), Unknown Service (Port 02) <x-fp-highlight>53</x-fp-highlight>

To retrieve the next set of result use

created_after = 2024-06-14T05:54:25Z
created_before = 2024-06-17T05:54:25Z
size = 1
cursor = 1718603662.158905

email

Looks up the “Email” type indicator details. The reputation of Email is considered malicious if there’s at least one IoC event in the Ignite database matching the Email indicator.

Base Command

email

Input

Argument Name Description Required
email A comma-separated list of emails. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Email.Event.Href string A list of reference links of the indicator.
Ignite.Email.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Email.Event.Category string The category of the indicator.
Ignite.Email.Event.Fpid string The Flashpoint ID of the indicator.
Ignite.Email.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Email.Event.Type string The indicator type.
Ignite.Email.Event.Uuid string The UUID of the indicator.
Ignite.Email.Event.Comment string The comment that was provided when the indicator was observed.
Account.Description string The description of the indicator.
Account.Email.Name string Name of indicator.

Command Example

!email email="dummy@dummy.com"

Context Example

{
  "DBotScore": {
    "Indicator": "dummy@dummy.com",
    "Type": "email",
    "Vendor": "Ignite",
    "Score": 3
  },
  "Account": {
    "Description": "Found in malicious indicators dataset"
    "Email": {
        "Address": "dummy@dummy.com"
    },
  },
  "Ignite.Email.Event": [
    {
      "EventDetails": {
        "RelatedEvent": [],
        "Tags": ["sample_tags"],
        "attack_ids": [],
        "event_uuid": "dummy_uuid",
        "fpid": "dummy_fpid",
        "href": "https://mock_dummy.com/technical-intelligence/v1/event/00000001",
        "info": "sample info", "reports": [], "timestamp": "00001"
      },
      "Category": "sample_category",
      "Fpid": "dummy_fpid",
      "Href": "https://mock_dummy.com/technical-intelligence/v1/attribute/0000001",
      "Timestamp": "00001",
      "Type": "email",
      "Uuid": "dummy_uuid",
      "Comment": "sample comment"
    }
  ]
}

Human Readable Output

Ignite Email reputation for dummy@dummy.com

Reputation: Malicious

Events in which this IOC observed
Date Observed (UTC) Name Tags
Jan 01, 1970 00:00 sample info sample_tags

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs?sort_date=All%20Time&types=email-dst,email-src,email-src-display-name,email-subject,email&query=%22dummy%40dummy.com%22

filename

Looks up the “Filename” type indicator details. The reputation of Filename is considered malicious if there’s at least one IoC event in the Ignite database matching the Filename indicator.

Base Command

filename

Input

Argument Name Description Required
filename A comma-separated list of filenames. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Filename.Event.Href string A list of reference links of the indicator.
Ignite.Filename.Event.Filename string Filename of the indicator.
Ignite.Filename.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Filename.Event.Category string The category of the indicator.
Ignite.Filename.Event.Fpid string The Ignite ID of the indicator.
Ignite.Filename.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Filename.Event.Type string The indicator type.
Ignite.Filename.Event.Uuid string The UUID of the indicator.
Ignite.Filename.Event.Comment string The comment that was provided when the indicator was observed.
Filename.Malicious.Description string The description of the malicious indicator.
Filename.Malicious.Vendor string Vendor of the malicious filename.
Filename.Name string The filename.
Filename.Description string The description of the indicator.

Command Example

!filename filename="dummy.log"

Context Example

{
  "DBotScore": {
    "Indicator": "dummy.log",
    "Type": "filename",
    "Vendor": "Ignite",
    "Score": 3
  },
  "Filename": {
    "Name": "dummy.log",
    "Malicious": {
      "Vendor": "Ignite",
      "Description": "Found in malicious indicators dataset"
    }
  },
  "Ignite.Filename.Event": [
    {
      "Filename": "dummy.log",
      "Category": "test category",
      "Fpid": "dummy_fpid",
      "Href": "https://mock_dummy.com/technical-intelligence/v1/attribute/00001",
      "Timestamp": "0000000001",
      "Type": "filename",
      "Uuid": "dummy_uuid",
      "EventDetails": {
        "RelatedEvent": [],
        "Tags": [
          "sample_tags"
        ],
        "attack_ids": [],
        "event_uuid": "dummy_uuid",
        "fpid": "dummy_fpid",
        "href": "https://mock_dummy.com/technical-intelligence/v1/event/0001",
        "info": "test info",
        "reports": [],
        "timestamp": "0000000001"
      },
      "Comment": ""
    }
  ]
}

Human Readable Output

Ignite Filename reputation for dummy.log

Reputation: Malicious

Events in which this IOC observed
Date Observed (UTC) Name Tags
Jan 01, 1970 00:00 test info sample_tags

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs?sort_date=All%20Time&types=filename&query=%22dummy.log%22

ip

Looks up the “IP” type indicator details. The reputation of the IP address is decided from the indicator score if it is found in the Ignite IOC database. Alternatively, the IP address is considered suspicious if it matches any one of the community’s peer IP addresses.

Base Command

ip

Input

Argument Name Description Required
ip A comma-separated list of IP addresses. Required
exact_match Whether to perform an exact match on the IP address value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
Ignite.IP.Event.Href string A list of reference links of the indicator.
Ignite.IP.Event.Address string The IP address of the indicator.
Ignite.IP.Event.EventDetails string The event details in which the indicator was observed.
Ignite.IP.Event.Category string The category of the indicator.
Ignite.IP.Event.Fpid string The Ignite ID of the indicator.
Ignite.IP.Event.Timestamp string The time and date that the indicator was observed.
Ignite.IP.Event.Type string The indicator type.
Ignite.IP.Event.Uuid string The UUID of the indicator.
Ignite.IP.Event.Comment string The comment that was provided when the indicator was observed.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.author String The author of the document.
Ignite.IP.author_id String The ID of the author of the document.
Ignite.IP.date Date The date associated with the document.
Ignite.IP.container_id String Unique identifier of the container.
Ignite.IP.container_title String Title of the container.
Ignite.IP.enrichments.bins Number Number of bins associated with the document.
Ignite.IP.enrichments.bitcoin_addresses String Bitcoin addresses associated with the document.
Ignite.IP.enrichments.cve_ids String CVE IDs associated with the document.
Ignite.IP.enrichments.email_addresses String Email addresses associated with the document.
Ignite.IP.enrichments.ethereum_addresses String Ethereum addresses associated with the document.
Ignite.IP.enrichments.ip_addresses String IP addresses associated with the document.
Ignite.IP.enrichments.location.country_code String Country code of the location associated with the document.
Ignite.IP.enrichments.location.name String Name of the location associated with the document.
Ignite.IP.enrichments.location.lat Number Latitude of the location associated with the document.
Ignite.IP.enrichments.location.long Number Longitude of the location associated with the document.
Ignite.IP.enrichments.monero_addresses String Monero addresses associated with the document.
Ignite.IP.enrichments.social_media_handles String Social media handles associated with the document.
Ignite.IP.enrichments.social_media_sites String Social media sites associated with the document.
Ignite.IP.enrichments.translation.language String Language of the translation associated with the document.
Ignite.IP.enrichments.translation.message String Translation message associated with the document.
Ignite.IP.enrichments.url_domains String URL domains associated with the document.
Ignite.IP.first_observed_at Date The first observed date of the document.
Ignite.IP.last_observed_at Date The last observed date of the document.
Ignite.IP.media.id String Unique identifier of the media.
Ignite.IP.media.file_name String File name of the media.
Ignite.IP.media.mime_type String MIME type of the media.
Ignite.IP.media.phash String Perceptual hash of the media.
Ignite.IP.media.safe_search String Safe search value of the media.
Ignite.IP.media.size Number Size of the media.
Ignite.IP.media.sort_date Date Date used for sorting the media.
Ignite.IP.media.storage_uri String Storage URI of the media.
Ignite.IP.media.type String Type of the media.
Ignite.IP.message String Message associated with the document.
Ignite.IP.message_id String ID of the message associated with the document.
Ignite.IP.native_id String Native ID of the document.
Ignite.IP.message_hash String Hash of the message associated with the document.
Ignite.IP.parent_container_title String Title of the parent container.
Ignite.IP.section String Section of the document.
Ignite.IP.section_id String ID of the section.
Ignite.IP.site String The site associated with the document.
Ignite.IP.site_actor_handle String Actor handle of the site associated with the document.
Ignite.IP.site_actor_alias String Actor alias of the site associated with the document.
Ignite.IP.site_actor_url String Actor URL of the site associated with the document.
Ignite.IP.site_actor_username String Actor username of the site associated with the document.
Ignite.IP.site_source_uri String Source URI of the site associated with the document.
Ignite.IP.site_title String Title of the site associated with the document.
Ignite.IP.sort_date Date Date used for sorting the document.
Ignite.IP.source_uri String Source URI of the document.
Ignite.IP.title String Title of the document.
Ignite.IP.title_id String ID of the title.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored at of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string The modified at of IP.
Ignite.IP.created_at string The created at of IP.
Ignite.IP.last_seen_at string The last seen at of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at of IP latest sighting.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.

Command example

!ip ip=0.0.0.1

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.1",
        "Reliability": "B - Usually reliable",
        "Score": 3,
        "Type": "ip",
        "Vendor": "Ignite"
    },
    "IP": {
        "Address": "0.0.0.1",
        "Malicious": {
            "Description": "Found in malicious indicators dataset",
            "Vendor": "Ignite"
        },
        "Relationships": [
            {
                "Relationship": "related-to",
                "EntityA": "0.0.0.1",
                "EntityAType": "IP",
                "EntityB": "dummy_latest_sighting_related_ioc_value_1",
                "EntityBType": "File"
            },
            {
                "Relationship": "related-to",
                "EntityA": "0.0.0.1",
                "EntityAType": "IP",
                "EntityB": "dummy_related_ioc_value_1.com",
                "EntityBType": "Domain"
            }
        ]
    },
    "Ignite": {
        "IP": {
            "id": " dummy_id_123",
            "type": "ipv4",
            "value": "0.0.0.1",
            "href": "https://dummy.href.com",
            "entity_type": "indicator",
            "score": {
                "value": "malicious",
                "last_scored_at": "2025-04-21T06:44:37.633000",
                "raw_score": null
            },
            "modified_at": "2025-04-21T06:44:37.633000",
            "created_at": "2025-04-14T15:28:26.371000",
            "last_seen_at": "2025-04-21T06:34:55.617000",
            "sort_date": "2025-04-21T06:34:55.617000",
            "platform_urls": {
                "ignite": "https://dummy.ignite.com"
            },
            "apt_description": "N/A",
            "external_references": [],
            "hashes": null,
            "malware_description": "dummy_malware_description",
            "mitre_attack_ids": [
                {
                    "id": "dummy_attack_id_123",
                    "name": "dummy_attack_name",
                    "tactics": [
                        "Discovery"
                    ]
                }
            ],
            "relationships": {
                "iocs": [
                    {
                        "id": "dummy_ioc_id_1",
                        "type": "dummy_ioc_type_1",
                        "value": "dummy_ioc_value_1",
                        "href": "https://dummy.ioc.href.com/1"
                    }
                ]
            },
            "sightings": [
                {
                    "source": "dummy_source",
                    "sighted_at": "2025-04-21T06:34:55.617000",
                    "tags": [
                        "dummy_tag_1",
                        "dummy_tag_2",
                        "dummy_tag_3"
                    ],
                    "related_iocs": [
                        {
                            "id": "dummy_related_ioc_id_1",
                            "type": "domain",
                            "value": "dummy_related_ioc_value_1.com",
                            "href": "https://dummy.related_ioc.href.com/1"
                        }
                    ]
                }
            ],
            "latest_sighting": {
                "source": "dummy_latest_sighting_source",
                "sighted_at": "2025-04-21T06:34:55.617000",
                "tags": [
                    "dummy_latest_sighting_tag_1",
                    "dummy_latest_sighting_tag_2",
                    "dummy_latest_sighting_tag_3"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_latest_sighting_related_ioc_id_1",
                        "type": "file",
                        "value": "dummy_latest_sighting_related_ioc_value_1",
                        "href": "https://dummy.latest_sighting.related_ioc.href.com/1"
                    }
                ]
            },
            "total_sightings": 11
        }
    }
}

Human Readable Output

Ignite IP Address reputation for 0.0.0.1

Reputation: Malicious

ID IP Type Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id_123 0.0.0.1 ipv4 dummy_malware_description dummy_latest_sighting_tag_1,
dummy_latest_sighting_tag_2,
dummy_latest_sighting_tag_3,
dummy_tag_1,
dummy_tag_2,
dummy_tag_3		 - type: file
value: dummy_latest_sighting_related_ioc_value_1
- type: domain
value: dummy_related_ioc_value_1.com		 - id: dummy_attack_id_123
name: dummy_attack_name
tactics:
values: Discovery		 Apr 14, 2025 15:28 Apr 21, 2025 06:44 Apr 21, 2025 06:34

Platform Link(ignite): https://dummy.ignite.com

flashpoint-ignite-common-lookup

Looks up details for indicators of types: “URL”, “Domain”, “File Hash”, and “IP”. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

flashpoint-ignite-common-lookup

Input

Argument Name Description Required
indicator List of indicators. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.id string The ID of file.
Ignite.File.type String Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA512 string SHA512 type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type String Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type String Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored time of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string Last time when IP was modified.
Ignite.IP.created_at string The creation time of IP.
Ignite.IP.last_seen_at string The last seen time of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at time of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at time of latest sighting of IP.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.

Command example

!flashpoint-ignite-common-lookup indicator="00000000000000000000000000000001"

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "00000000000000000000000000000001",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "flashpoint_detection",
            "sighted_at": "2025-01-02T01:00:00.000000",
            "tags": [
                "malware:pony",
                "os:windows",
                "source:flashpoint_detection",
                "type:stealer"
            ],
            "related_iocs": [
                {
                    "id": "dummy_id",
                    "type": "file",
                    "value": "00000000000000000000000000000002",
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Type Hashes Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id file md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

flashpoint-ignite-indicator-get

Looks up details for indicators of types “URL”, “Domain”, “File Hash”, and “IP” using their ID. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

flashpoint-ignite-indicator-get

Input

Argument Name Description Required
indicator_id ID of the indicator. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.id string The ID of file.
Ignite.File.type String Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA512 string SHA512 type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.File.historical_tags string The tags of File.
Ignite.File.reports.html string Platform url to access the report of the indicator.
Ignite.File.reports.json string API url of the report of the indicator.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type String Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.Domain.historical_tags string The tags of Domain.
Ignite.Domain.reports.html string Platform url to access the report of the indicator.
Ignite.Domain.reports.json string API url of the report of the indicator.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type String Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.
Ignite.URL.historical_tags string The tags of URL.
Ignite.URL.reports.html string Platform url to access the report of the indicator.
Ignite.URL.reports.json string API url of the report of the indicator.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored time of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string Last time when IP was modified.
Ignite.IP.created_at string The creation time of IP.
Ignite.IP.last_seen_at string The last seen time of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at time of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at time of latest sighting of IP.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.
Ignite.IP.historical_tags string The tags of IP.
Ignite.IP.reports.html string Platform url to access the report of the indicator.
Ignite.IP.reports.json string API url of the report of the indicator.

Command example

!flashpoint-ignite-indicator-get indicator_id=dummy_id

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "dummy_id",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000002",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            },
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "historical_tags": [
            "malware:pony",
            "os:windows",
            "source:flashpoint_detection",
            "type:stealer"
        ],
        "reports": [
            {
                "html": "https://mock_dummy.com/cti/intelligence/report/report_1",
                "json": "https://mock_dummy.com/finished-intelligence/v1/reports/report_1"
            },
            {
                "html": "https://mock_dummy.com/cti/intelligence/report/report_2",
                "json": "https://mock_dummy.com/finished-intelligence/v1/reports/report_2"
            }
        ]
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Type Hashes Malware Description Tags Related IOCs Hashes Mitre Attack IDs Reports Created At Modified At Last Seen At
dummy_id file md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 - html: https://mock_dummy.com/cti/intelligence/report/report_1
json: https://mock_dummy.com/finished-intelligence/v1/reports/report_1
- html: https://mock_dummy.com/cti/intelligence/report/report_2
json: https://mock_dummy.com/finished-intelligence/v1/reports/report_2		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00  

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

url

Looks up the “URL” type indicator details. The reputation of the URL is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

url

Input

Argument Name Description Required
url A comma-separated list of URLs. Required
exact_match Whether to perform an exact match on the URL value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Url.Event.Href string A list of reference links of the indicator.
Ignite.Url.Event.Url string URL of the indicator.
Ignite.Url.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Url.Event.Category string The category of the indicator.
Ignite.Url.Event.Fpid string The Flashpoint ID of the indicator.
Ignite.Url.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Url.Event.Type string The indicator type.
Ignite.Url.Event.Uuid string The UUID of the indicator.
Ignite.Url.Event.Comment string The comment that was provided when the indicator was observed.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type string Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.

Command Example

!url url="http://dummy.com"

Context Example

{
    "URL": [
        {
            "Data": "http://dummy.com",
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "http://dummy.com",
                    "EntityAType": "URL",
                    "EntityB": "http://dummyurl.com",
                    "EntityBType": "URL"
                },
                {
                    "Relationship": "related-to",
                    "EntityA": "http://dummy.com",
                    "EntityAType": "URL",
                    "EntityB": "0.0.0.1",
                    "EntityBType": "IP"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "http://dummy.com",
            "Reliability": "B - Usually reliable",
            "Type": "url",
            "Vendor": "Ignite",
            "Score": 2
        }
    ],
    "Ignite.URL": {
        "id": " dummy-id-123",
        "type": "url",
        "value": "http://dummy.com",
        "href": "https://dummy-api.com/dummy-endpoint",
        "entity_type": "indicator",
        "score": {
            "value": "suspicious",
            "last_scored_at": "2025-04-01T00:00:00"
        },
        "modified_at": "2025-04-01T00:00:00",
        "created_at": "2025-04-01T00:00:00",
        "last_seen_at": "2025-04-01T00:00:00",
        "sort_date": "2025-04-01T00:00:00",
        "platform_urls": {
            "ignite": "https://dummy-platform.com/dummy-url"
        },
        "apt_description": "Dummy APT description",
        "malware_description": "Dummy malware description",
        "sightings": [
            {
                "source": "dummy-source",
                "sighted_at": "2025-04-01T00:00:00",
                "tags": [
                    "dummy-tag-1",
                    "dummy-tag-2"
                ],
                "related_iocs": [
                    {
                        "id": "dummy-id-1",
                        "type": "ipv4",
                        "value": "0.0.0.1",
                        "href": "https://dummy-api.com/dummy-endpoint-1"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "dummy-source",
            "sighted_at": "2025-04-01T00:00:00",
            "tags": [
                "dummy_latest_sighting_tag_1",
                "dummy_latest_sighting_tag_2"
            ],
            "related_iocs": [
                {
                    "id": "dummy-id-1",
                    "type": "url",
                    "value": "http://dummyurl.com",
                    "href": "https://dummy-api.com/dummy-endpoint-2"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite URL reputation for http://dummy.com

Reputation: Suspicious

ID URL Malware Description Tags Related IOCs Created At Modified At Last Seen At
dummy-id-123 http://dummy.com Dummy malware description dummy_latest_sighting_tag_1,
dummy_latest_sighting_tag_2,
dummy-tag-1,
dummy-tag-2		 - type: url
value: http://dummyurl.com
- type: ipv4
value: 0.0.0.1		 Apr 01, 2025 00:00 Apr 01, 2025 00:00 Apr 01, 2025 00:00

Platform Link(ignite): https://dummy-platform.com/dummy-url

domain

Looks up the “Domain” type indicator details. The reputation of the domain is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

domain

Input

Argument Name Description Required
domain A comma-separated list of domains. Required
exact_match Whether to perform an exact match on the domain value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Domain.Event.Href string A list of reference links of the indicator.
Ignite.Domain.Event.Domain string The domain of the indicator.
Ignite.Domain.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Domain.Event.Category string The category of the indicator.
Ignite.Domain.Event.Fpid string The Ignite ID of the indicator.
Ignite.Domain.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Domain.Event.Type string The indicator type.
Ignite.Domain.Event.Uuid string The UUID of the indicator.
Ignite.Domain.Event.Comment string The comment that was provided when the indicator was observed.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type string Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.

Command example

!domain domain="dummy_domain.com"

Context Example

{
    "DBotScore": [
        {
            "Indicator": "dummy.com",
            "Type": "domain",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Domain": [
        {
            "Name": "dummy.com",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "dummy.com",
                    "EntityAType": "IP",
                    "EntityB": "dummy_value",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "Ignite.Domain": {
        "apt_description": "N/A",
        "created_at": "2025-01-01T01:00:00.000000",
        "entity_type": "indicator",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "id": "dummy_id",
        "last_seen_at": "2025-04-22T11:17:37.981000",
        "latest_sighting": {
            "related_iocs": [
                {
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id_2",
                    "id": "dummy_id_2",
                    "type": "file",
                    "value": "dummy_value"
                }
            ],
            "sighted_at": "2025-01-01T01:00:00.000000",
            "source": "flashpoint_extraction",
            "tags": [
                "extracted_config:true",
                "malware:xworm",
                "source:flashpoint_extraction"
            ]
        },
        "malware_description": "<p>This is dummy description.</p>",
        "modified_at": "2025-01-02T01:00:00.000000",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "score": {
            "last_scored_at": "2025-04-22T11:23:21.569000",
            "value": "malicious"
        },
        "sightings": [
            {
                "related_iocs": [
                    {
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id_3",
                        "id": "dummy_id_3",
                        "type": "file",
                        "value": "dummy_value"
                    }
                ],
                "sighted_at": "2025-04-22T11:17:37.981000",
                "source": "flashpoint_extraction",
                "tags": [
                    "extracted_config:true",
                    "malware:xworm",
                    "source:flashpoint_extraction"
                ]
            }
        ],
        "sort_date": "2025-01-01T01:00:00.000000",
        "total_sightings": 1,
        "type": "domain",
        "value": "dummy_domain.com"
    }
}

Human Readable Output

Ignite Domain reputation for dummy_domain.com

Reputation: Malicious

ID Domain Malware Description Tags Related IOCs Created At Modified At Last Seen At
dummy_id dummy_domain.com This is dummy description. extracted_config:true,
malware:xworm,
source:flashpoint_extraction		 - type: file
value: dummy_value		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

file

Looks up the “File” type indicator details. The reputation of the file is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

file

Input

Argument Name Description Required
file List of files. Required
exact_match Whether to perform an exact match on the file hash value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.Event.Href string A list of reference links of the indicator.
Ignite.File.Event.MD5 string MD5 file hash of the indicator.
Ignite.File.Event.SHA1 string SHA1 file hash of the indicator.
Ignite.File.Event.SHA256 string SHA256 file hash of the indicator.
Ignite.File.Event.SHA512 string SHA512 file hash of the indicator.
Ignite.File.Event.SSDeep string SSDeep file hash of the indicator.
Ignite.File.Event.EventDetails string The event details in which the indicator was observed.
Ignite.File.Event.Category string The category of the indicator.
Ignite.File.Event.Fpid string The Ignite ID of the indicator.
Ignite.File.Event.Timestamp string The time and date that the indicator was observed.
Ignite.File.Event.Type string The indicator type.
Ignite.File.Event.Uuid string The UUID of the indicator.
Ignite.File.Event.Comment string The comment that was provided when the indicator was observed.
Ignite.File.id string The ID of file.
Ignite.File.type string Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA256 string SHA256 type file.
File.SHA512 string SHA512 type file.
File.SSDeep string SSDeep type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.

Command Example

!file file="00000000000000000000000000000001"

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "00000000000000000000000000000001",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "flashpoint_detection",
            "sighted_at": "2025-01-02T01:00:00.000000",
            "tags": [
                "malware:pony",
                "os:windows",
                "source:flashpoint_detection",
                "type:stealer"
            ],
            "related_iocs": [
                {
                    "id": "dummy_id",
                    "type": "file",
                    "value": "00000000000000000000000000000001",
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Hash Type Hashes Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id md5 md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

flashpoint-ignite-vulnerability-get

Retrieves detailed information about a specific vulnerability by its Flashpoint ID.

Base Command

flashpoint-ignite-vulnerability-get

Input

Argument Name Description Required
id The Flashpoint ID of the vulnerability to retrieve. Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE, for example: CVE-2015-1653.
CVE.CVSS String The CVSS of the CVE, for example: 10.0.
CVE.Version String The version of the CVE, for example: 3.0.
CVE.Vector String The vector of the CVE, for example: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N.
CVE.Table String The table of the CVE.
CVE.Published Date The timestamp of when the CVE was published.
CVE.Modified Date The timestamp of when the CVE was last modified.
CVE.Description String A description of the CVE.
CVE.Tags String The tags of the CVE.
CVE.VulnerableProducts String The vulnerable products of the CVE.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.timelines.vendor_response_time String The time taken for vendor response.
Ignite.Vulnerability.timelines.time_to_patch String The time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_patch String The total time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.time_unpatched String The time the vulnerability remained unpatched.
Ignite.Vulnerability.timelines.time_to_exploit String The time taken to exploit the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_exploit String The total time taken to exploit the vulnerability.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.cve_id String The CVE ID associated with the social risk score.
Ignite.Vulnerability.scores.social_risk_scores.numeric_score Number A numeric social risk score.
Ignite.Vulnerability.scores.social_risk_scores.categorical_score String A categorical social risk score.
Ignite.Vulnerability.scores.social_risk_scores.score_date Date The date when the social risk score was calculated.
Ignite.Vulnerability.scores.social_risk_scores.todays_tweets Number The number of tweets today about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.total_tweets Number The total number of tweets about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.unique_users Number The number of unique users discussing the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.alternate_vulndb_id String An alternate VulnDB ID.
Ignite.Vulnerability.changelog.created_at Date The date when the changelog entry was created.
Ignite.Vulnerability.changelog.description String The description of the changelog entry.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.nvd_additional_information.cve_id String The CVE ID from NVD.
Ignite.Vulnerability.nvd_additional_information.summary String The summary from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.cwe_id String The CWE identifier from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.name String The name of the CWE from NVD.
Ignite.Vulnerability.nvd_additional_information.references.name String The name of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.references.url String The URL of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_vector String The CVSS v2 access vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_complexity String The CVSS v2 access complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.authentication String The CVSS v2 authentication from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.integrity_impact String The CVSS v2 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.availability_impact Number The CVSS v2 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_vector String The CVSS v3 attack vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_complexity String The CVSS v3 attack complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.privileges_required String The CVSS v3 privileges required from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.user_interaction String The CVSS v3 user interaction from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.scope String The CVSS v3 scope from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.integrity_impact String The CVSS v3 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.availability_impact String The CVSS v3 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.score Number The CVSS v3 score from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.vector_string String The CVSS v3 vector string from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.version String The CVSS v3 version from NVD.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.creditees.name String The name of the individual or organization credited.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score String The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.
Ignite.Vulnerability.products.id Number The ID of the affected product.
Ignite.Vulnerability.products.name String The name of the affected product.
Ignite.Vulnerability.products.vendor_id Number The vendor ID of the affected product.
Ignite.Vulnerability.products.vendor String The vendor name of the affected product.
Ignite.Vulnerability.products.versions.id Number The ID of the product version.
Ignite.Vulnerability.products.versions.vulndb_version_id Number The VulnDB version ID.
Ignite.Vulnerability.products.versions.name String The name of the product version.
Ignite.Vulnerability.products.versions.affected String A string indicating whether the product version is affected.
Ignite.Vulnerability.products.versions.all_prior_versions_affected Boolean A boolean indicating whether all prior versions are affected.
Ignite.Vulnerability.products.versions.cpes.name String The CPE (Common Platform Enumeration) name.
Ignite.Vulnerability.products.versions.cpes.source String The source of the CPE.

Command Example

!flashpoint-ignite-vulnerability-get id="123456"

Context Example

{
    "CVE": [
        {
            "CVSS": {
                "Score": 9.2,
                "Table": [
                    {
                        "metrics": "score",
                        "value": 9.2
                    },
                    {
                        "metrics": "threat_score",
                        "value": 8.5
                    },
                    {
                        "metrics": "source",
                        "value": "http://nvd.nist.gov"
                    },
                    {
                        "metrics": "generated_at",
                        "value": "2024-01-15T00:00:00Z"
                    },
                    {
                        "metrics": "updated_at",
                        "value": "2024-06-15T10:30:00Z"
                    },
                    {
                        "metrics": "cve_id",
                        "value": "CVE-2024-0001"
                    },
                    {
                        "metrics": "vector_string",
                        "value": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                    },
                    {
                        "metrics": "version",
                        "value": "4.0"
                    },
                    {
                        "metrics": "attack_vector",
                        "value": "NETWORK"
                    },
                    {
                        "metrics": "attack_complexity",
                        "value": "LOW"
                    },
                    {
                        "metrics": "attack_requirements",
                        "value": "NONE"
                    },
                    {
                        "metrics": "privileges_required",
                        "value": "NONE"
                    },
                    {
                        "metrics": "user_interaction",
                        "value": "NONE"
                    },
                    {
                        "metrics": "exploit_maturity",
                        "value": "PROOF_OF_CONCEPT"
                    },
                    {
                        "metrics": "vulnerable_system_confidentiality_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_integrity_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_availability_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "subsequent_system_confidentiality_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_integrity_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_availability_impact",
                        "value": "NONE"
                    }
                ],
                "Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "Version": "4.0"
            },
            "Description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "ID": "CVE-2024-0002",
            "Modified": "2024-06-15T10:30:00Z",
            "Published": "2024-01-01T00:00:00Z",
            "Tags": [
                "test",
                "dummy",
                "critical"
            ],
            "VulnerableProducts": [
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*"
                },
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2024-0002",
            "Score": 0,
            "Type": "cve",
            "Vendor": "Ignite"
        }
    ],
    "Ignite": {
        "Vulnerability": {
            "id": 123456,
            "cve_ids": [
                "CVE-2024-0001",
                "CVE-2024-0002"
            ],
            "title": "Dummy Vulnerability Title for Testing",
            "keywords": "test, dummy, vulnerability",
            "description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "solution": "Apply the latest security patch or upgrade to version 2.0 or higher.",
            "technical_description": "Technical details about the dummy vulnerability for testing.",
            "timelines": {
                "published_at": "2024-01-01T00:00:00Z",
                "last_modified_at": "2024-06-15T10:30:00Z",
                "exploit_published_at": "2024-02-10T00:00:00Z",
                "discovered_at": "2023-12-15T00:00:00Z",
                "disclosed_at": "2024-01-05T00:00:00Z",
                "vendor_informed_at": "2023-12-20T00:00:00Z",
                "vendor_acknowledged_at": "2023-12-22T00:00:00Z",
                "solution_provided_at": "2024-01-30T00:00:00Z",
                "exploited_in_the_wild_at": "2024-03-01T00:00:00Z",
                "vendor_response_time": "2 days",
                "time_to_patch": "25 days",
                "total_time_to_patch": "46 days",
                "time_unpatched": "30 days, 0:00:00",
                "time_to_exploit": "40 days, 0:00:00",
                "total_time_to_exploit": "75 days"
            },
            "scores": {
                "epss_score": 0.75,
                "epss_v1_score": 0.68,
                "ransomware_score": 0.45,
                "severity": "Critical",
                "social_risk_scores": [
                    {
                        "cve_id": "CVE-2024-0001",
                        "numeric_score": 8.5,
                        "categorical_score": "High",
                        "score_date": "2024-06-15T10:30:00Z",
                        "todays_tweets": 25,
                        "total_tweets": 150,
                        "unique_users": 75
                    }
                ]
            },
            "vuln_status": "Active",
            "changelog": [
                {
                    "created_at": "2024-06-15T10:30:00Z",
                    "description": "Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to \"Affected\""
                },
                {
                    "created_at": "2024-05-20T14:20:00Z",
                    "description": "Initial vulnerability entry created"
                }
            ],
            "cwes": [
                {
                    "cwe_id": "CWE-79",
                    "name": "Improper Neutralization of Input During Web Page Generation"
                },
                {
                    "cwe_id": "CWE-89",
                    "name": "SQL Injection"
                }
            ],
            "exploits": [
                {
                    "value": "http://www.exploit-db.com/exploits/99999",
                    "type": "Exploit Database"
                },
                {
                    "value": "http://packetstormsecurity.com/files/dummy-exploit",
                    "type": "Packet Storm"
                }
            ],
            "exploits_count": 2,
            "ext_references": [
                {
                    "value": "12345",
                    "type": "Snort Signature ID",
                    "created_at": "2024-01-15T00:00:00Z",
                    "description": "Dummy Snort signature for testing",
                    "url": "http://www.snort.org/sid/12345"
                },
                {
                    "value": "TEST-2024-001",
                    "type": "Security Advisory",
                    "created_at": "2024-01-10T00:00:00Z",
                    "description": "Test security advisory reference",
                    "url": "http://security.example.com/advisory/TEST-2024-001"
                }
            ],
            "nvd_additional_information": [
                {
                    "cve_id": "CVE-2024-0001",
                    "summary": "Dummy vulnerability summary from NVD for testing purposes. This describes a hypothetical security issue in a test application.",
                    "cwes": [
                        {
                            "cwe_id": "CWE-79",
                            "name": "Cross-site Scripting"
                        }
                    ],
                    "references": [
                        {
                            "name": "99999",
                            "url": "http://www.securityfocus.com/bid/99999"
                        },
                        {
                            "name": "TEST-ADV-2024",
                            "url": "http://security.example.com/advisory/test"
                        }
                    ],
                    "cvss_v2s": [
                        {
                            "access_vector": "NETWORK",
                            "access_complexity": "LOW",
                            "authentication": "NONE",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5
                        }
                    ],
                    "cvss_v3s": [
                        {
                            "attack_vector": "NETWORK",
                            "attack_complexity": "LOW",
                            "privileges_required": "NONE",
                            "user_interaction": "PARTIAL",
                            "scope": "PARTIAL",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5,
                            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                            "version": "3.1"
                        }
                    ]
                }
            ],
            "classifications": [
                {
                    "name": "location_remote",
                    "longname": "Remote / Network Access",
                    "description": "This vulnerability can be exploited remotely over a network."
                },
                {
                    "name": "access_complexity_low",
                    "longname": "Low Access Complexity",
                    "description": "Exploitation requires minimal specialized access or circumstances."
                }
            ],
            "creditees": [
                {
                    "name": "Test Security Researcher"
                },
                {
                    "name": "Dummy Research Team"
                }
            ],
            "cvss_v2s": [
                {
                    "access_vector": "NETWORK",
                    "access_complexity": "LOW",
                    "authentication": "NONE",
                    "confidentiality_impact": "COMPLETE",
                    "integrity_impact": "COMPLETE",
                    "availability_impact": "COMPLETE",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 10.0,
                    "calculated_cvss_base_score": 10.0
                }
            ],
            "cvss_v3s": [
                {
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "scope": "CHANGED",
                    "confidentiality_impact": "HIGH",
                    "integrity_impact": "HIGH",
                    "availability_impact": "HIGH",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 9.8,
                    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                    "version": "3.1",
                    "remediation_level": "Official Fix",
                    "report_confidence": "Confirmed",
                    "exploit_code_maturity": "Proof-of-Concept",
                    "temporal_score": "8.9",
                    "updated_at": "2024-06-15T10:30:00Z"
                }
            ],
            "cvss_v4s": [
                {
                    "score": 9.2,
                    "threat_score": 8.5,
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "updated_at": "2024-06-15T10:30:00Z",
                    "cve_id": "CVE-2024-0001",
                    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "version": "4.0",
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "attack_requirements": "NONE",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "exploit_maturity": "PROOF_OF_CONCEPT",
                    "vulnerable_system_confidentiality_impact": "HIGH",
                    "vulnerable_system_integrity_impact": "HIGH",
                    "vulnerable_system_availability_impact": "HIGH",
                    "subsequent_system_confidentiality_impact": "NONE",
                    "subsequent_system_integrity_impact": "NONE",
                    "subsequent_system_availability_impact": "NONE"
                }
            ],
            "tags": [
                "test",
                "dummy",
                "critical"
            ],
            "products": [
                {
                    "id": 99999,
                    "name": "Dummy Test Application",
                    "versions": [
                        {
                            "id": 88888,
                            "vulndb_version_id": 77777,
                            "name": "1.0",
                            "affected": "Affected",
                            "all_prior_versions_affected": true,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        },
                        {
                            "id": 88889,
                            "vulndb_version_id": 77778,
                            "name": "1.5",
                            "affected": "Affected",
                            "all_prior_versions_affected": false,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        }
                    ],
                    "vendor_id": 12345,
                    "vendor": "Test Vendor Corporation"
                }
            ]
        }
    }
}

Human Readable Output

Ignite FP-VULN-123456 Vulnerability Details for: CVE-2024-0001, CVE-2024-0002

Vulnerability Information

ID Title Status Keywords Description Solution Technical Description Exploits Count Tags Creditees
123456 Dummy Vulnerability Title for Testing Active test, dummy, vulnerability This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application. Apply the latest security patch or upgrade to version 2.0 or higher. Technical details about the dummy vulnerability for testing. 2 test, dummy, critical - name: Test Security Researcher
- name: Dummy Research Team

Score Information

EPSS Score EPSS v1 Score Ransomware Score Severity Social Risk Scores
0.75 0.68 0.45 Critical - cve_id: CVE-2024-0001
numeric_score: 8.5
categorical_score: High
score_date: 2024-06-15T10:30:00Z
todays_tweets: 25
total_tweets: 150
unique_users: 75

Timeline Information

Published At Last Modified At Discovered At Disclosed At Vendor Informed At Vendor Acknowledged At Solution Provided At Exploited In The Wild At Vendor Response Time Time To Patch Total Time To Patch Time Unpatched Time To Exploit Total Time To Exploit
2024-01-01T00:00:00Z 2024-06-15T10:30:00Z 2023-12-15T00:00:00Z 2024-01-05T00:00:00Z 2023-12-20T00:00:00Z 2023-12-22T00:00:00Z 2024-01-30T00:00:00Z 2024-03-01T00:00:00Z 2 days 25 days 46 days 30 days, 0:00:00 40 days, 0:00:00 75 days

CVSS v2 Scores

Score Source Generated At CVE ID Calculated CVSS Base Score Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
10.0 http://nvd.nist.gov 2024-01-15T00:00:00Z CVE-2024-0001 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE

CVSS v3 Scores

Score Vector String Source Version Updated At Generated At CVE ID Temporal Score Calculated CVSS Base Score Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability Impact Remediation Level Report Confidence Exploit Code Maturity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H http://nvd.nist.gov 3.1 2024-06-15T10:30:00Z 2024-01-15T00:00:00Z CVE-2024-0001 8.9 N/A NETWORK LOW NONE NONE CHANGED HIGH HIGH HIGH Official Fix Confirmed Proof-of-Concept

CVSS v4 Score

Score Vector String Threat Score Source Version Generated At Updated At CVE ID Attack Vector Attack Complexity Attack Requirements Privileges Required User Interaction Exploit Maturity Vulnerable System Confidentiality Impact Vulnerable System Integrity Impact Vulnerable System Availability Impact Subsequent System Confidentiality Impact Subsequent System Integrity Impact Subsequent System Availability Impact
9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.5 http://nvd.nist.gov 4.0 2024-01-15T00:00:00Z 2024-06-15T10:30:00Z CVE-2024-0001 NETWORK LOW NONE NONE NONE PROOF_OF_CONCEPT HIGH HIGH HIGH NONE NONE NONE

Affected Products

Product ID Product Vendor ID Vendor Versions
99999 Dummy Test Application 12345 Test Vendor Corporation - id: 88888
vulndb_version_id: 77777
name: 1.0
affected: Affected
all_prior_versions_affected: true
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.0:::::::
_source: Official
- id: 88889
vulndb_version_id: 77778
name: 1.5
affected: Affected
all_prior_versions_affected: false
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.5:::::::
_source: Official

External References

Value Type URL Description Created At
12345 Snort Signature ID http://www.snort.org/sid/12345 Dummy Snort signature for testing 2024-01-15T00:00:00Z
TEST-2024-001 Security Advisory http://security.example.com/advisory/TEST-2024-001 Test security advisory reference 2024-01-10T00:00:00Z

CWES

CWE ID Name Source CVE IDs
CWE-79 Improper Neutralization of Input During Web Page Generation N/A N/A
CWE-89 SQL Injection N/A N/A

Exploits

Value Type
http://www.exploit-db.com/exploits/99999 Exploit Database
http://packetstormsecurity.com/files/dummy-exploit Packet Storm

Changelog

Created At Description
2024-06-15T10:30:00Z Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to “Affected”
2024-05-20T14:20:00Z Initial vulnerability entry created

cve

Retrieves detailed information about a specific CVE by its CVE ID.

Base Command

cve

Input

Argument Name Description Required
cve List of CVEs. Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE, for example: CVE-2015-1653.
CVE.CVSS String The CVSS of the CVE, for example: 10.0.
CVE.Version String The version of the CVE, for example: 3.0.
CVE.Vector String The vector of the CVE, for example: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N.
CVE.Table String The table of the CVE.
CVE.Published Date The timestamp of when the CVE was published.
CVE.Modified Date The timestamp of when the CVE was last modified.
CVE.Description String A description of the CVE.
CVE.Tags String The tags of the CVE.
CVE.VulnerableProducts String The vulnerable products of the CVE.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.timelines.vendor_response_time String The time taken for vendor response.
Ignite.Vulnerability.timelines.time_to_patch String The time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_patch String The total time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.time_unpatched String The time the vulnerability remained unpatched.
Ignite.Vulnerability.timelines.time_to_exploit String The time taken to exploit the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_exploit String The total time taken to exploit the vulnerability.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.cve_id String The CVE ID associated with the social risk score.
Ignite.Vulnerability.scores.social_risk_scores.numeric_score Number A numeric social risk score.
Ignite.Vulnerability.scores.social_risk_scores.categorical_score String A categorical social risk score.
Ignite.Vulnerability.scores.social_risk_scores.score_date Date The date when the social risk score was calculated.
Ignite.Vulnerability.scores.social_risk_scores.todays_tweets Number The number of tweets today about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.total_tweets Number The total number of tweets about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.unique_users Number The number of unique users discussing the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.alternate_vulndb_id String An alternate VulnDB ID.
Ignite.Vulnerability.changelog.created_at Date The date when the changelog entry was created.
Ignite.Vulnerability.changelog.description String The description of the changelog entry.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.nvd_additional_information.cve_id String The CVE ID from NVD.
Ignite.Vulnerability.nvd_additional_information.summary String The summary from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.cwe_id String The CWE identifier from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.name String The name of the CWE from NVD.
Ignite.Vulnerability.nvd_additional_information.references.name String The name of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.references.url String The URL of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_vector String The CVSS v2 access vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_complexity String The CVSS v2 access complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.authentication String The CVSS v2 authentication from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.integrity_impact String The CVSS v2 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.availability_impact Number The CVSS v2 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_vector String The CVSS v3 attack vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_complexity String The CVSS v3 attack complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.privileges_required String The CVSS v3 privileges required from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.user_interaction String The CVSS v3 user interaction from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.scope String The CVSS v3 scope from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.integrity_impact String The CVSS v3 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.availability_impact String The CVSS v3 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.score Number The CVSS v3 score from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.vector_string String The CVSS v3 vector string from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.version String The CVSS v3 version from NVD.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.creditees.name String The name of the individual or organization credited.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score String The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.
Ignite.Vulnerability.products.id Number The ID of the affected product.
Ignite.Vulnerability.products.name String The name of the affected product.
Ignite.Vulnerability.products.vendor_id Number The vendor ID of the affected product.
Ignite.Vulnerability.products.vendor String The vendor name of the affected product.
Ignite.Vulnerability.products.versions.id Number The ID of the product version.
Ignite.Vulnerability.products.versions.vulndb_version_id Number The VulnDB version ID.
Ignite.Vulnerability.products.versions.name String The name of the product version.
Ignite.Vulnerability.products.versions.affected String A string indicating whether the product version is affected.
Ignite.Vulnerability.products.versions.all_prior_versions_affected Boolean A boolean indicating whether all prior versions are affected.
Ignite.Vulnerability.products.versions.cpes.name String The CPE (Common Platform Enumeration) name.
Ignite.Vulnerability.products.versions.cpes.source String The source of the CPE.

Command Example

!cve cve="CVE-2024-0002"

Context Example

{
    "CVE": [
        {
            "CVSS": {
                "Score": 9.2,
                "Table": [
                    {
                        "metrics": "score",
                        "value": 9.2
                    },
                    {
                        "metrics": "threat_score",
                        "value": 8.5
                    },
                    {
                        "metrics": "source",
                        "value": "http://nvd.nist.gov"
                    },
                    {
                        "metrics": "generated_at",
                        "value": "2024-01-15T00:00:00Z"
                    },
                    {
                        "metrics": "updated_at",
                        "value": "2024-06-15T10:30:00Z"
                    },
                    {
                        "metrics": "cve_id",
                        "value": "CVE-2024-0001"
                    },
                    {
                        "metrics": "vector_string",
                        "value": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                    },
                    {
                        "metrics": "version",
                        "value": "4.0"
                    },
                    {
                        "metrics": "attack_vector",
                        "value": "NETWORK"
                    },
                    {
                        "metrics": "attack_complexity",
                        "value": "LOW"
                    },
                    {
                        "metrics": "attack_requirements",
                        "value": "NONE"
                    },
                    {
                        "metrics": "privileges_required",
                        "value": "NONE"
                    },
                    {
                        "metrics": "user_interaction",
                        "value": "NONE"
                    },
                    {
                        "metrics": "exploit_maturity",
                        "value": "PROOF_OF_CONCEPT"
                    },
                    {
                        "metrics": "vulnerable_system_confidentiality_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_integrity_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_availability_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "subsequent_system_confidentiality_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_integrity_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_availability_impact",
                        "value": "NONE"
                    }
                ],
                "Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "Version": "4.0"
            },
            "Description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "ID": "CVE-2024-0002",
            "Modified": "2024-06-15T10:30:00Z",
            "Published": "2024-01-01T00:00:00Z",
            "Tags": [
                "test",
                "dummy",
                "critical"
            ],
            "VulnerableProducts": [
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*"
                },
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2024-0002",
            "Score": 0,
            "Type": "cve",
            "Vendor": "Ignite"
        }
    ],
    "Ignite": {
        "Vulnerability": {
            "id": 123456,
            "cve_ids": [
                "CVE-2024-0001",
                "CVE-2024-0002"
            ],
            "title": "Dummy Vulnerability Title for Testing",
            "keywords": "test, dummy, vulnerability",
            "description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "solution": "Apply the latest security patch or upgrade to version 2.0 or higher.",
            "technical_description": "Technical details about the dummy vulnerability for testing.",
            "timelines": {
                "published_at": "2024-01-01T00:00:00Z",
                "last_modified_at": "2024-06-15T10:30:00Z",
                "exploit_published_at": "2024-02-10T00:00:00Z",
                "discovered_at": "2023-12-15T00:00:00Z",
                "disclosed_at": "2024-01-05T00:00:00Z",
                "vendor_informed_at": "2023-12-20T00:00:00Z",
                "vendor_acknowledged_at": "2023-12-22T00:00:00Z",
                "solution_provided_at": "2024-01-30T00:00:00Z",
                "exploited_in_the_wild_at": "2024-03-01T00:00:00Z",
                "vendor_response_time": "2 days",
                "time_to_patch": "25 days",
                "total_time_to_patch": "46 days",
                "time_unpatched": "30 days, 0:00:00",
                "time_to_exploit": "40 days, 0:00:00",
                "total_time_to_exploit": "75 days"
            },
            "scores": {
                "epss_score": 0.75,
                "epss_v1_score": 0.68,
                "ransomware_score": 0.45,
                "severity": "Critical",
                "social_risk_scores": [
                    {
                        "cve_id": "CVE-2024-0001",
                        "numeric_score": 8.5,
                        "categorical_score": "High",
                        "score_date": "2024-06-15T10:30:00Z",
                        "todays_tweets": 25,
                        "total_tweets": 150,
                        "unique_users": 75
                    }
                ]
            },
            "vuln_status": "Active",
            "changelog": [
                {
                    "created_at": "2024-06-15T10:30:00Z",
                    "description": "Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to \"Affected\""
                },
                {
                    "created_at": "2024-05-20T14:20:00Z",
                    "description": "Initial vulnerability entry created"
                }
            ],
            "cwes": [
                {
                    "cwe_id": "CWE-79",
                    "name": "Improper Neutralization of Input During Web Page Generation"
                },
                {
                    "cwe_id": "CWE-89",
                    "name": "SQL Injection"
                }
            ],
            "exploits": [
                {
                    "value": "http://www.exploit-db.com/exploits/99999",
                    "type": "Exploit Database"
                },
                {
                    "value": "http://packetstormsecurity.com/files/dummy-exploit",
                    "type": "Packet Storm"
                }
            ],
            "exploits_count": 2,
            "ext_references": [
                {
                    "value": "12345",
                    "type": "Snort Signature ID",
                    "created_at": "2024-01-15T00:00:00Z",
                    "description": "Dummy Snort signature for testing",
                    "url": "http://www.snort.org/sid/12345"
                },
                {
                    "value": "TEST-2024-001",
                    "type": "Security Advisory",
                    "created_at": "2024-01-10T00:00:00Z",
                    "description": "Test security advisory reference",
                    "url": "http://security.example.com/advisory/TEST-2024-001"
                }
            ],
            "nvd_additional_information": [
                {
                    "cve_id": "CVE-2024-0001",
                    "summary": "Dummy vulnerability summary from NVD for testing purposes. This describes a hypothetical security issue in a test application.",
                    "cwes": [
                        {
                            "cwe_id": "CWE-79",
                            "name": "Cross-site Scripting"
                        }
                    ],
                    "references": [
                        {
                            "name": "99999",
                            "url": "http://www.securityfocus.com/bid/99999"
                        },
                        {
                            "name": "TEST-ADV-2024",
                            "url": "http://security.example.com/advisory/test"
                        }
                    ],
                    "cvss_v2s": [
                        {
                            "access_vector": "NETWORK",
                            "access_complexity": "LOW",
                            "authentication": "NONE",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5
                        }
                    ],
                    "cvss_v3s": [
                        {
                            "attack_vector": "NETWORK",
                            "attack_complexity": "LOW",
                            "privileges_required": "NONE",
                            "user_interaction": "PARTIAL",
                            "scope": "PARTIAL",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5,
                            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                            "version": "3.1"
                        }
                    ]
                }
            ],
            "classifications": [
                {
                    "name": "location_remote",
                    "longname": "Remote / Network Access",
                    "description": "This vulnerability can be exploited remotely over a network."
                },
                {
                    "name": "access_complexity_low",
                    "longname": "Low Access Complexity",
                    "description": "Exploitation requires minimal specialized access or circumstances."
                }
            ],
            "creditees": [
                {
                    "name": "Test Security Researcher"
                },
                {
                    "name": "Dummy Research Team"
                }
            ],
            "cvss_v2s": [
                {
                    "access_vector": "NETWORK",
                    "access_complexity": "LOW",
                    "authentication": "NONE",
                    "confidentiality_impact": "COMPLETE",
                    "integrity_impact": "COMPLETE",
                    "availability_impact": "COMPLETE",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 10.0,
                    "calculated_cvss_base_score": 10.0
                }
            ],
            "cvss_v3s": [
                {
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "scope": "CHANGED",
                    "confidentiality_impact": "HIGH",
                    "integrity_impact": "HIGH",
                    "availability_impact": "HIGH",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 9.8,
                    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                    "version": "3.1",
                    "remediation_level": "Official Fix",
                    "report_confidence": "Confirmed",
                    "exploit_code_maturity": "Proof-of-Concept",
                    "temporal_score": "8.9",
                    "updated_at": "2024-06-15T10:30:00Z"
                }
            ],
            "cvss_v4s": [
                {
                    "score": 9.2,
                    "threat_score": 8.5,
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "updated_at": "2024-06-15T10:30:00Z",
                    "cve_id": "CVE-2024-0001",
                    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "version": "4.0",
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "attack_requirements": "NONE",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "exploit_maturity": "PROOF_OF_CONCEPT",
                    "vulnerable_system_confidentiality_impact": "HIGH",
                    "vulnerable_system_integrity_impact": "HIGH",
                    "vulnerable_system_availability_impact": "HIGH",
                    "subsequent_system_confidentiality_impact": "NONE",
                    "subsequent_system_integrity_impact": "NONE",
                    "subsequent_system_availability_impact": "NONE"
                }
            ],
            "tags": [
                "test",
                "dummy",
                "critical"
            ],
            "products": [
                {
                    "id": 99999,
                    "name": "Dummy Test Application",
                    "versions": [
                        {
                            "id": 88888,
                            "vulndb_version_id": 77777,
                            "name": "1.0",
                            "affected": "Affected",
                            "all_prior_versions_affected": true,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        },
                        {
                            "id": 88889,
                            "vulndb_version_id": 77778,
                            "name": "1.5",
                            "affected": "Affected",
                            "all_prior_versions_affected": false,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        }
                    ],
                    "vendor_id": 12345,
                    "vendor": "Test Vendor Corporation"
                }
            ]
        }
    }
}

Human Readable Output

Ignite CVE Details for: CVE-2024-0001, CVE-2024-0002

Vulnerability Information

ID Title Status Keywords Description Solution Technical Description Exploits Count Tags Creditees
123456 Dummy Vulnerability Title for Testing Active test, dummy, vulnerability This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application. Apply the latest security patch or upgrade to version 2.0 or higher. Technical details about the dummy vulnerability for testing. 2 test, dummy, critical - name: Test Security Researcher
- name: Dummy Research Team

Score Information

EPSS Score EPSS v1 Score Ransomware Score Severity Social Risk Scores
0.75 0.68 0.45 Critical - cve_id: CVE-2024-0001
numeric_score: 8.5
categorical_score: High
score_date: 2024-06-15T10:30:00Z
todays_tweets: 25
total_tweets: 150
unique_users: 75

Timeline Information

Published At Last Modified At Discovered At Disclosed At Vendor Informed At Vendor Acknowledged At Solution Provided At Exploited In The Wild At Vendor Response Time Time To Patch Total Time To Patch Time Unpatched Time To Exploit Total Time To Exploit
2024-01-01T00:00:00Z 2024-06-15T10:30:00Z 2023-12-15T00:00:00Z 2024-01-05T00:00:00Z 2023-12-20T00:00:00Z 2023-12-22T00:00:00Z 2024-01-30T00:00:00Z 2024-03-01T00:00:00Z 2 days 25 days 46 days 30 days, 0:00:00 40 days, 0:00:00 75 days

CVSS v2 Scores

Score Source Generated At CVE ID Calculated CVSS Base Score Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
10.0 http://nvd.nist.gov 2024-01-15T00:00:00Z CVE-2024-0001 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE

CVSS v3 Scores

Score Vector String Source Version Updated At Generated At CVE ID Temporal Score Calculated CVSS Base Score Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability Impact Remediation Level Report Confidence Exploit Code Maturity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H http://nvd.nist.gov 3.1 2024-06-15T10:30:00Z 2024-01-15T00:00:00Z CVE-2024-0001 8.9 N/A NETWORK LOW NONE NONE CHANGED HIGH HIGH HIGH Official Fix Confirmed Proof-of-Concept

CVSS v4 Score

Score Vector String Threat Score Source Version Generated At Updated At CVE ID Attack Vector Attack Complexity Attack Requirements Privileges Required User Interaction Exploit Maturity Vulnerable System Confidentiality Impact Vulnerable System Integrity Impact Vulnerable System Availability Impact Subsequent System Confidentiality Impact Subsequent System Integrity Impact Subsequent System Availability Impact
9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.5 http://nvd.nist.gov 4.0 2024-01-15T00:00:00Z 2024-06-15T10:30:00Z CVE-2024-0001 NETWORK LOW NONE NONE NONE PROOF_OF_CONCEPT HIGH HIGH HIGH NONE NONE NONE

Affected Products

Product ID Product Vendor ID Vendor Versions
99999 Dummy Test Application 12345 Test Vendor Corporation - id: 88888
vulndb_version_id: 77777
name: 1.0
affected: Affected
all_prior_versions_affected: true
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.0:::::::
_source: Official
- id: 88889
vulndb_version_id: 77778
name: 1.5
affected: Affected
all_prior_versions_affected: false
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.5:::::::
_source: Official

External References

Value Type URL Description Created At
12345 Snort Signature ID http://www.snort.org/sid/12345 Dummy Snort signature for testing 2024-01-15T00:00:00Z
TEST-2024-001 Security Advisory http://security.example.com/advisory/TEST-2024-001 Test security advisory reference 2024-01-10T00:00:00Z

CWES

CWE ID Name Source CVE IDs
CWE-79 Improper Neutralization of Input During Web Page Generation N/A N/A
CWE-89 SQL Injection N/A N/A

Exploits

Value Type
http://www.exploit-db.com/exploits/99999 Exploit Database
http://packetstormsecurity.com/files/dummy-exploit Packet Storm

Changelog

Created At Description
2024-06-15T10:30:00Z Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to “Affected”
2024-05-20T14:20:00Z Initial vulnerability entry created

flashpoint-ignite-vulnerability-list

List Vulnerabilities using provided filters.

Base Command

flashpoint-ignite-vulnerability-list

Input

Argument Name Description Required
vulnerability_ids Filter by the vulnerability IDs assigned by Flashpoint. Supports comma-separated values.

Example: 463513, FP-VULN-463512.		 Optional
updated_after Get vulnerabilities that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get vulnerabilities that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
disclosed_after Get vulnerabilities that were disclosed after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
disclosed_before Get vulnerabilities that were disclosed before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
published_after Get vulnerabilities that were published after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
published_before Get vulnerabilities that were published before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
last_touched_after Get vulnerabilities that were last touched after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
last_touched_before Get vulnerabilities that were last touched before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
ransomware_scores Filter by Ransomware score. Possible values are: Critical, High, Medium, Low. Optional
attack_types Filter by Attack type classification. Possible values are: Authentication Management, Cryptographic, Infrastructure, Input Manipulation, Misconfiguration, Man-In-The-Middle (MITM), Other, Race Condition, Attack Type Unknown. Optional
severities Filter by severity, which is calculated based on CVSS values. Possible values are: Critical, High, Medium, Low, Informational. Optional
products Filter by associated product names (case-insensitive). Optional
vendors Filter by associated vendor names (case-insensitive). Optional
cwe_ids Filter by CWE IDs assigned by Mitre. Optional
min_cvssv2_score Filter by lower limit of the CVSSv2 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv2_score Filter by upper limit of the CVSSv2 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
min_cvssv3_score Filter by lower limit of the CVSSv3 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv3_score Filter by upper limit of the CVSSv3 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
min_cvssv4_score Filter by lower limit of the CVSSv4 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv4_score Filter by upper limit of the CVSSv4 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
ref_types Filter by reference types. Possible values are: Bug Tracker, Bugtraq ID, CERT, CERT VU, CIAC Advisory, CVE ID, D2 Elliot, DISA IAVA, Exploit Activity, Exploit Database, Flashpoint, Generic Exploit URL, Generic Informational URL, Immunity CANVAS, Immunity CANVAS (D2ExploitPack), Immunity CANVAS (White Phosphorus), ISS X-Force ID, Japan Vulnerability Notes, Keyword, Mail List Post, Metasploit URL, Microsoft Knowledge Base Article, Microsoft Security Bulletin, Nessus Script ID, News Article, Nikto Item ID, Other Advisory URL, Other Solution URL, OVAL ID, Packet Storm, RedHat RHSA, Related VulnDB ID, SCIP VulDB ID, Secunia Advisory ID, Security Tracker, Snort Signature ID, Tenable PVS, US-CERT Cyber Security Alert, Vendor Specific Advisory URL, Vendor Specific Solution URL, Vendor URL, Vendor Specific News/Changelog Entry, VUPEN Advisory. Optional
ref_values Filter by reference values. Use with Reference Types to filter by specific reference type. Optional
locations Filter by location type classification. Possible values are: Context Dependent, Dial-up Access Required, Local Access Required, Legacy: Local / Remote, Mobile Phone / Hand-held Device, Physical Access Required, Remote / Network Access, Location Unknown, Wireless Vector. Optional
min_epss_score Filter by lower limit of the EPSS v3 score. Example value 0.5

Note: Value must be a float between 0 and 1.		 Optional
max_epss_score Filter by upper limit of the EPSS v3 score. Example value 1.0

Note: Value must be a float between 0 and 1.		 Optional
tags Filter vulnerabilities by tags. Optional
size Number of vulnerabilities to return per page. Maximum value: 1000. Default is 10. Optional
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
sort_by Specify the field used to sort the vulnerabilities. Possible values are: ID, Severity, Title, CVSSv3 Score, Published At. Default is Published At. Optional
sort_order Specify the order used to sort the vulnerabilities. Possible values are: Asc, Desc. Default is Desc. Optional

Context Output

Path Type Description
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.cvssv3_score Number A CVSS v3 score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.calculated_cvss_base_score Number A calculated CVSS v3 base score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score Number The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.products.id Number The unique numeric identifier assigned by Flashpoint for a single product.
Ignite.Vulnerability.products.name String The product name.
Ignite.Vulnerability.vendors.id Number The unique numeric identifier assigned by Flashpoint for a single vendor.
Ignite.Vulnerability.vendors.name String The vendor name.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.

Command Example

!flashpoint-ignite-vulnerability-list attack_types=”Attack Type Unknown” from=2 locations=”Context Dependent” min_cvssv2_score=9 products=”Squid” ransomware_scores=Critical ref_types=”D2 Elliot” sort_order=Asc sort_by=”ID” severities=Informational

Context Example

[
    {
        "id": 1,
        "cve_ids": [
            "CVE-2020-101010"
        ],
        "title": "Dummy Vulnerability Title for Testing",
        "keywords": "",
        "description": "Dummy Vulnerability Description for Testing",
        "solution": "Dummy Solution for Testing",
        "technical_description": "Dummy Technical Description for Testing",
        "timelines": {
            "published_at": "2026-02-28T01:07:11Z",
            "last_modified_at": "2026-02-28T01:17:13Z",
            "exploit_published_at": "2025-12-21T00:00:00Z",
            "disclosed_at": "2025-12-21T00:00:00Z",
            "solution_provided_at": "2025-12-21T00:00:00Z"
        },
        "scores": {
            "severity": "Medium",
            "cvssv3_score": 5.4,
            "epss_score": 0.00039,
            "epss_v1_score": 0.0166211,
            "ransomware_score": "High"
        },
        "vuln_status": "Active",
        "cwes": [
            {
                "cwe_id": 79,
                "name": "Dummy CWE Name for Testing",
                "source": "nvd",
                "cve_ids": "CVE-2025-70091"
            }
        ],
        "exploits_count": 0,
        "ext_references": [
            {
                "value": "https://github.com/opensourcepos/opensourcepos/commit/01010101",
                "type": "Vendor Specific Solution URL",
                "url": "https://github.com/opensourcepos/opensourcepos/commit/01010101",
                "created_at": "2026-01-13T21:40:34Z"
            }
        ],
        "cvss_v2s": [
            {
                "access_vector": "NETWORK",
                "access_complexity": "LOW",
                "authentication": "SINGLE_INSTANCE",
                "confidentiality_impact": "NONE",
                "integrity_impact": "PARTIAL",
                "availability_impact": "NONE",
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54Z",
                "score": 4.0
            }
        ],
        "cvss_v3s": [
            {
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "privileges_required": "LOW",
                "user_interaction": "REQUIRED",
                "scope": "CHANGED",
                "confidentiality_impact": "LOW",
                "integrity_impact": "LOW",
                "availability_impact": "NONE",
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54Z",
                "score": 5.4,
                "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/:U/RC:C",
                "version": "3.1",
                "remediation_level": "UNAVAILABLE",
                "report_confidence": "CONFIRMED",
                "exploit_code_maturity": "FUNCTIONAL",
                "temporal_score": 5.3,
                "updated_at": "2026-02-28T01:07:11Z"
            }
        ],
        "cvss_v4s": [
            {
                "score": 5.1,
                "threat_score": 5.1,
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54.998000Z",
                "updated_at": "2026-02-25T22:31:55.195000Z",
                "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A",
                "version": "4.0",
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "attack_requirements": "NONE",
                "privileges_required": "LOW",
                "user_interaction": "PASSIVE",
                "exploit_maturity": "ATTACKED",
                "vulnerable_system_confidentiality_impact": "LOW",
                "vulnerable_system_integrity_impact": "LOW",
                "vulnerable_system_availability_impact": "NONE",
                "subsequent_system_confidentiality_impact": "LOW",
                "subsequent_system_integrity_impact": "LOW",
                "subsequent_system_availability_impact": "NONE"
            }
        ],
        "tags": [
            "oss"
        ],
        "products": [
            {
                "id": 1903500,
                "name": "dummy product"
            }
        ],
        "vendors": [
            {
                "id": 1884569,
                "name": "dummy vendor"
            }
        ]
    },
    {
        "id": 2,
        "cve_ids": [
            "CVE-2025-101010"
        ],
        "title": "Dummy Title for Testing2",
        "keywords": "",
        "description": "Dummy Description for Testing2",
        "solution": "Dummy Solution for Testing2",
        "technical_description": "Dummy Technical Description for Testing2",
        "timelines": {
            "published_at": "2026-02-28T01:02:30Z",
            "last_modified_at": "2026-02-28T01:12:33Z",
            "exploit_published_at": "2026-01-04T00:00:00Z",
            "disclosed_at": "2026-01-04T00:00:00Z",
            "vendor_informed_at": "2025-11-01T00:00:00Z",
            "solution_provided_at": "2026-01-04T00:00:00Z"
        },
        "scores": {
            "severity": "High",
            "cvssv3_score": 7.5,
            "epss_score": 0.00128,
            "epss_v1_score": 0.0226512,
            "ransomware_score": "Low"
        },
        "vuln_status": "Active",
        "cwes": [
            {
                "cwe_id": 1,
                "name": "dummy cwe name",
                "source": "flashpoint"
            }
        ],
        "exploits_count": 0,
        "ext_references": [
            {
                "value": "https://github.com/issue/1xxx",
                "type": "Bug Tracker",
                "url": "https://github.com/issue/2xxx",
                "created_at": "2026-02-12T15:45:49Z"
            }
        ],
        "classifications": [
            {
                "name": "dummy classifications",
                "longname": "dummy longname",
                "description": "dummy description"
            }
        ],
        "cvss_v2s": [
            {
                "access_vector": "NETWORK",
                "access_complexity": "LOW",
                "authentication": "NONE",
                "confidentiality_impact": "NONE",
                "integrity_impact": "NONE",
                "availability_impact": "COMPLETE",
                "source": "Flashpoint",
                "generated_at": "2026-02-27T18:40:31Z",
                "score": 7.8
            }
        ],
        "cvss_v3s": [
            {
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "privileges_required": "NONE",
                "user_interaction": "NONE",
                "scope": "UNCHANGED",
                "confidentiality_impact": "NONE",
                "integrity_impact": "NONE",
                "availability_impact": "HIGH",
                "source": "Flashpoint",
                "generated_at": "2026-02-27T18:40:31Z",
                "score": 7.5,
                "vector_string": "CVSS:3.1/AV:N/AC:L/E:F/RL:O/RC:C",
                "version": "3.1",
                "remediation_level": "OFFICIAL_FIX",
                "report_confidence": "CONFIRMED",
                "exploit_code_maturity": "FUNCTIONAL",
                "temporal_score": 7.0,
                "updated_at": "2026-02-28T01:02:30Z"
            }
        ],
        "cvss_v4s": [
            {
                "score": 8.7,
                "threat_score": 8.7,
                "source": "Flashpoint",
                "generated_at": "2026-02-28T01:02:25.362000Z",
                "updated_at": "2026-02-28T01:02:25.392000Z",
                "vector_string": "CVSS:4.0/AV:N/AC:L/SA:N/E:A",
                "version": "4.0",
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "attack_requirements": "NONE",
                "privileges_required": "NONE",
                "user_interaction": "NONE",
                "exploit_maturity": "ATTACKED",
                "vulnerable_system_confidentiality_impact": "NONE",
                "vulnerable_system_integrity_impact": "NONE",
                "vulnerable_system_availability_impact": "HIGH",
                "subsequent_system_confidentiality_impact": "NONE",
                "subsequent_system_integrity_impact": "NONE",
                "subsequent_system_availability_impact": "NONE"
            }
        ],
        "tags": [
            "oss"
        ],
        "products": [
            {
                "id": 7483660,
                "name": "dummy product2"
            }
        ],
        "vendors": [
            {
                "id": 7441495,
                "name": "dummy vendor2"
            }
        ]
    }
]

Human Readable Output

Total number of vulnerabilities found: 4

Vulnerability List

ID CVE IDs Title Description Solution Vulnerability Status Severity EPSS Score Ransomware Score Published At Last Modified At Tags CVSS v2 CVSS v3 CVSS v4 Products CWEs Exploits Count
FP-VULN-1, link CVE-2020-101010 Dummy Vulnerability Title for Testing Dummy Vulnerability Description for Testing Dummy Solution for Testing Active Medium 0.00039 High 2026-02-28T01:07:11Z 2026-02-28T01:17:13Z oss - access_vector: NETWORK
access_complexity: LOW
authentication: SINGLE_INSTANCE
confidentiality_impact: NONE
integrity_impact: PARTIAL
availability_impact: NONE
source: Flashpoint
generated_at: 2026-02-25T22:31:54Z
cve_id: null
score: 4.0
calculated_cvss_base_score: null		 - attack_vector: NETWORK
attack_complexity: LOW
privileges_required: LOW
user_interaction: REQUIRED
scope: CHANGED
confidentiality_impact: LOW
integrity_impact: LOW
availability_impact: NONE
source: Flashpoint
generated_at: 2026-02-25T22:31:54Z
cve_id: null
score: 5.4
calculated_cvss_base_score: null
vector_string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/:U/RC:C
version: 3.1
remediation_level: UNAVAILABLE
report_confidence: CONFIRMED
exploit_code_maturity: FUNCTIONAL
temporal_score: 5.3
updated_at: 2026-02-28T01:07:11Z		 - score: 5.1
threat_score: 5.1
source: Flashpoint
generated_at: 2026-02-25T22:31:54.998000Z
updated_at: 2026-02-25T22:31:55.195000Z
cve_id: null
vector_string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A
version: 4.0
attack_vector: NETWORK
attack_complexity: LOW
attack_requirements: NONE
privileges_required: LOW
user_interaction: PASSIVE
exploit_maturity: ATTACKED
vulnerable_system_confidentiality_impact: LOW
vulnerable_system_integrity_impact: LOW
vulnerable_system_availability_impact: NONE
subsequent_system_confidentiality_impact: LOW
subsequent_system_integrity_impact: LOW
subsequent_system_availability_impact: NONE		 - id: 1903500
name: dummy product		 - cwe_id: 79
name: Dummy CWE Name for Testing
source: nvd
cve_ids: CVE-2025-70091		 0
FP-VULN-2, link CVE-2025-101010 Dummy Title for Testing2 Dummy Description for Testing2 Dummy Solution for Testing2 Active High 0.00128 Low 2026-02-28T01:02:30Z 2026-02-28T01:12:33Z oss - access_vector: NETWORK
access_complexity: LOW
authentication: NONE
confidentiality_impact: NONE
integrity_impact: NONE
availability_impact: COMPLETE
source: Flashpoint
generated_at: 2026-02-27T18:40:31Z
cve_id: null
score: 7.8
calculated_cvss_base_score: null		 - attack_vector: NETWORK
attack_complexity: LOW
privileges_required: NONE
user_interaction: NONE
scope: UNCHANGED
confidentiality_impact: NONE
integrity_impact: NONE
availability_impact: HIGH
source: Flashpoint
generated_at: 2026-02-27T18:40:31Z
cve_id: null
score: 7.5
calculated_cvss_base_score: null
vector_string: CVSS:3.1/AV:N/AC:L/E:F/RL:O/RC:C
version: 3.1
remediation_level: OFFICIAL_FIX
report_confidence: CONFIRMED
exploit_code_maturity: FUNCTIONAL
temporal_score: 7.0
updated_at: 2026-02-28T01:02:30Z		 - score: 8.7
threat_score: 8.7
source: Flashpoint
generated_at: 2026-02-28T01:02:25.362000Z
updated_at: 2026-02-28T01:02:25.392000Z
cve_id: null
vector_string: CVSS:4.0/AV:N/AC:L/SA:N/E:A
version: 4.0
attack_vector: NETWORK
attack_complexity: LOW
attack_requirements: NONE
privileges_required: NONE
user_interaction: NONE
exploit_maturity: ATTACKED
vulnerable_system_confidentiality_impact: NONE
vulnerable_system_integrity_impact: NONE
vulnerable_system_availability_impact: HIGH
subsequent_system_confidentiality_impact: NONE
subsequent_system_integrity_impact: NONE
subsequent_system_availability_impact: NONE		 - id: 7483660
name: dummy product2		 - cwe_id: 1
name: dummy cwe name
source: flashpoint
cve_ids: null		 0

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-vulnerability-library-list

Retrieves a list of libraries that are affected by a particular vulnerability.

Base Command

flashpoint-ignite-vulnerability-library-list

Input

Argument Name Description Required
vulnerability_id The Flashpoint vulnerability ID. Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of libraries to return per page. Maximum value: 1000. Default is 10. Optional
sort_by Specify the field used to sort the libraries. Possible values are: ID, Name. Default is ID. Optional
sort_order Specify the order to sort the libraries. Possible values are: Asc, Desc. Default is Asc. Optional
library_ids Flashpoint library ID(s) to filter by. Supports a comma-separated values. Optional
library_name The library name to filter by (case-insensitive). Optional
query Search libraries by namespace, name, version, type, etc. Optional

Context Output

Path Type Description
Ignite.Library.id Number The unique identifier of the library.
Ignite.Library.namespace String The namespace of the library.
Ignite.Library.name String The name of the library.
Ignite.Library.version String The version of the library.
Ignite.Library.qualifiers String The qualifiers of the library.
Ignite.Library.subpath String The subpath of the library.
Ignite.Library.type String The type of the library (e.g., pypi, npm, maven).
Ignite.Library.purl String The package URL of the library.
Ignite.Library.affected Boolean Whether the library is affected by the vulnerability.
Ignite.Library.constructed_purl String The constructed package URL of the library including name and version.

Command Example

!flashpoint-ignite-vulnerability-library-list vulnerability_id=101010 sort=id sort_order=asc from=2 name="dummy_name" query="1.11" size=2

Context Example

{
    "Ignite": {
        "Library": [
            {
                "id": 1010,
                "namespace": "-",
                "name": "dummy_name",
                "version": "1.11.112",
                "qualifiers": "-",
                "subpath": "-",
                "type": "pypi",
                "purl": "pkg:pypi",
                "affected": true,
                "constructed_purl": "pkg:pypi/dummy_name@1.11.112"
            },
            {
                "id": 101010,
                "namespace": "-",
                "name": "dummy_name",
                "version": "1.111.123",
                "qualifiers": "-",
                "subpath": "-",
                "type": "pypi",
                "purl": "pkg:pypi",
                "affected": true,
                "constructed_purl": "pkg:pypi/dummy_name@1.111.123"
            }
        ]
    }
}

Human Readable Output

Total number of libraries found: 2

Vulnerability Libraries

ID Name Version Type Namespace Package URL Affected
1010 dummy_name 1.11.112 pypi - pkg:pypi/dummy_name@1.11.112 true
101010 dummy_name 1.111.123 pypi - pkg:pypi/dummy_name@1.111.123 true

flashpoint-ignite-vulnerability-package-list

Retrieves a list of packages that are affected by a particular vulnerability.

Base Command

flashpoint-ignite-vulnerability-package-list

Input

Argument Name Description Required
vulnerability_id The Flashpoint vulnerability ID. Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of packages to return per page. Maximum value: 1000. Default is 10. Optional
sort_by Specify the field used to sort the packages. Possible values are: ID, Name. Default is ID. Optional
sort_order Specify the order to sort the packages. Possible values are: Asc, Desc. Default is Asc. Optional
package_ids Flashpoint package ID(s) to filter by. Supports comma-separated integer values. Optional
package_name The package name to filter by (case-insensitive). Optional
query Search packages by name, version, operating system, etc. Optional

Context Output

Path Type Description
Ignite.Package.id Number The unique identifier of the package.
Ignite.Package.name String The name of the package.
Ignite.Package.version String The version of the package.
Ignite.Package.filename String The filename of the package.
Ignite.Package.os String The operating system associated with the package.
Ignite.Package.os_version String The version of the operating system.
Ignite.Package.os_arch String The architecture of the operating system.
Ignite.Package.purl String The Package URL (purl) of the package.
Ignite.Package.operator String The operator indicating the version constraint relationship.
Ignite.Package.affected Boolean Whether the package is affected by the vulnerability.

Command Example

!flashpoint-ignite-vulnerability-package-list vulnerability_id=101010 sort_by=id sort_order=asc query="Debian GNU/Linux" size=2

Context Example

{
    "Ignite": {
        "Package": [
            {
                "id": 10000,
                "name": "dummy_package_1",
                "version": "1.0.0",
                "filename": "dummy_file_name_1",
                "os": "Debian GNU/Linux",
                "os_version": "10.1",
                "os_arch": "all",
                "purl": "pkg:deb/debian/dummy_package_1@1.0.0?distro=10.1",
                "operator": "=",
                "affected": true
            },
            {
                "id": 10001,
                "name": "dummy_package_2",
                "version": "2.0.0",
                "filename": "dummy_file_name_2",
                "os": "Debian GNU/Linux",
                "os_version": "10.1",
                "os_arch": "all",
                "purl": "pkg:deb/debian/dummy_package_2@2.0.0?distro=10.1",
                "operator": "<",
                "affected": false
            }
        ]
    }
}

Human Readable Output

Total number of packages found: 4

Vulnerability Packages

ID Package Version Filename OS OS Version OS Architecture Package URL Affected
10000 dummy_package_1 1.0.0 dummy_file_name_1 Debian GNU/Linux 10.1 all pkg:deb/debian/dummy_package_1@1.0.0?distro=10.1 true
10001 dummy_package_2 2.0.0 dummy_file_name_2 Debian GNU/Linux 10.1 all pkg:deb/debian/dummy_package_2@2.0.0?distro=10.1 false

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-vendor-list

List vendors using provided filters.

Base Command

flashpoint-ignite-vendor-list

Input

Argument Name Description Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of packages to return per page. Maximum value: 1000. Default is 10. Optional
vendor_ids Flashpoint vendor ID(s) to filter by. Supports comma-separated integer values. Optional
vendor_name The vendor name to filter by (case-insensitive). Optional
updated_after Get vendors that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get vendors that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional

Context Output

Path Type Description
Ignite.Vendor.id Number The unique identifier of the vendor.
Ignite.Vendor.name String The name of the vendor.

Command Example

!flashpoint-ignite-vendor-list size=2

Context Example

{
    "Ignite": {
        "Vendor": [
            {
                "id": 1001,
                "name": "Vendor Alpha"
            },
            {
                "id": 1002,
                "name": "Vendor Beta"
            }
        ]
    }
}

Human Readable Output

Total number of vendors found: 4

Vendor List

ID Name
1001 Vendor Alpha
1002 Vendor Beta

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-product-list

List products using provided filters.

Base Command

flashpoint-ignite-product-list

Input

Argument Name Description Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of products to return per page. Maximum value: 1000. Default is 10. Optional
product_ids Flashpoint product ID(s) to filter by. Supports comma-separated integer values. Optional
product_name The product name to filter by (case-insensitive). Optional
vendor_ids Flashpoint vendor ID(s) to filter by. Supports comma-separated integer values. Optional
updated_after Get products that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get products that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional

Context Output

Path Type Description
Ignite.Product.id Number The unique identifier of the product.
Ignite.Product.name String The name of the product.
Ignite.Product.vendor.id Number The unique identifier of the vendor associated with the product.
Ignite.Product.vendor.name String The name of the vendor associated with the product.
Ignite.Product.versions List List of versions associated with the product.

Command example

!flashpoint-ignite-product-list size=2

Context Example

{
    "Ignite": {
        "Product": [
            {
                "id": 10001,
                "name": "dummy product1",
                "vendor": {
                    "id": 1,
                    "name": "dummy vendor1"
                },
                "versions": [
                    {
                        "id": 1641849,
                        "vulndb_version_id": 11704,
                        "name": "1.1.4"
                    }
                ]
            },
            {
                "id": 10002,
                "name": "dummy product2",
                "vendor": {
                    "id": 2,
                    "name": "dummy vendor2"
                },
                "versions": [
                    {
                        "id": 1824886,
                        "vulndb_version_id": 11921,
                        "name": "1.6.6"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

Total number of products found: 5

Product List

Product ID Product Name Vendor ID Vendor Name
10001 dummy product1 1 dummy vendor1
10002 dummy product2 2 dummy vendor2

To retrieve the next set of result use, from = 2, size = 2

Migration Guide

Note:
For fetching incidents, set the First Fetch time to the previous integration’s Incidents Fetch Interval time. This might create duplicate alerts, but it will ensure that no alert data is lost.

Migrated Commands

Some of the previous integration’s commands have been migrated to new commands. Below is the table showing the commands that have been migrated to the new ones.

Flashpoint Command Migrated Ignite Command
ip ip
domain domain
url url
file file
flashpoint-search-intelligence-reports flashpoint-ignite-intelligence-report-search
flashpoint-get-single-intelligence-report flashpoint-ignite-intelligence-report-get
flashpoint-get-related-reports flashpoint-ignite-intelligence-related-report-list
flashpoint-get-single-event flashpoint-ignite-event-get
flashpoint-get-events flashpoint-ignite-event-list
flashpoint-common-lookup flashpoint-ignite-common-lookup
flashpoint-alert-list flashpoint-ignite-alert-list
flashpoint-compromised-credentials-list flashpoint-ignite-compromised-credentials-list

Deprecated Commands

Some of the previous integration’s commands have been deprecated from the Flashpoint API side. Below is the table showing the commands that have been deprecated for which, there is no replacement available.

Deprecated Command
flashpoint-get-forum-details
flashpoint-get-forum-room-details
flashpoint-get-forum-user-details
flashpoint-get-forum-post-details
flashpoint-search-forum-sites
flashpoint-search-forum-posts
filename
email

Configuration parameters

  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • url — Server URL (required)
  • credentials — (required)
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • fetch_type — Fetch Type
  • severity — Severity for Incidents
  • status — Alert Status
  • origin — Alert Origin
  • sources — Alert Sources
  • is_fresh_compromised_credentials — Fetch fresh compromised credentials alerts
  • password_has_lowercase — Fetch compromised credentials alerts having lowercase in password
  • password_has_uppercase — Fetch compromised credentials alerts having uppercase in password
  • password_has_number — Fetch compromised credentials alerts having numbers in password
  • password_has_symbol — Fetch compromised credentials alerts having symbol in password
  • password_min_length — Fetch compromised credentials alerts having minimum length of password
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • create_relationships — Create relationships
  • ioc_enrichment_exact_match — Enable Exact Match for IOC Enrichment
  • reputation_enrichments_limit — Reputation commands context limit
  • message_max_length — Community search message max length
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (22)

  • cve

    Retrieves detailed information about a specific CVE by its CVE ID.

  • domain

    Looks up the "Domain" type indicator details. The reputation of the domain is decided from the indicator score if it is found in the Ignite IOC database.

  • email Deprecated

    Looks up the "Email" type indicator details. The reputation of Email is considered malicious if there's at least one IoC event in the Ignite database matching the Email indicator.

  • file

    Looks up the "File" type indicator details. The reputation of the file is decided from the indicator score if it is found in the Ignite IOC database.

  • filename Deprecated

    Looks up the "Filename" type indicator details. The reputation of Filename is considered malicious if there's at least one IoC event in the Ignite database matching the Filename indicator.

  • flashpoint-ignite-alert-list

    Retrieves a list of alerts based on the filter values provided in the command arguments.

  • flashpoint-ignite-common-lookup

    Looks up details for indicators of types: "URL", "Domain", "File Hash", and "IP". The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

  • flashpoint-ignite-compromised-credentials-list

    Retrieves the compromised credentials based on the filter values provided in the command arguments.

  • flashpoint-ignite-event-get

    Retrieves the details of a single event using event FPID or UUID.

  • flashpoint-ignite-event-list

    Searches for events within the specified time period, the Flashpoint report ID, or attack IDs.

  • flashpoint-ignite-indicator-get

    Looks up details for indicators of types "URL", "Domain", "File Hash", and "IP" using their ID. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

  • flashpoint-ignite-intelligence-related-report-list

    List related reports for a particular report using the report ID.

  • flashpoint-ignite-intelligence-report-get

    Get single report details using the report id.

  • flashpoint-ignite-intelligence-report-search

    Search for the Intelligence Reports using a keyword.

  • flashpoint-ignite-product-list

    List products using provided filters.

  • flashpoint-ignite-vendor-list

    List vendors using provided filters.

  • flashpoint-ignite-vulnerability-get

    Retrieves detailed information about a specific vulnerability by its Flashpoint ID.

  • flashpoint-ignite-vulnerability-library-list

    Retrieves a list of libraries that are affected by a particular vulnerability.

  • flashpoint-ignite-vulnerability-list

    List Vulnerabilities using provided filters.

  • flashpoint-ignite-vulnerability-package-list

    Retrieves a list of packages that are affected by a particular vulnerability.

  • ip

    Looks up the "IP" type indicator details. The reputation of the IP address is decided from the indicator score if it is found in the Ignite IOC database. Alternatively, the IP address is considered suspicious if it matches any one of the community's peer IP addresses.

  • url

    Looks up the "URL" type indicator details. The reputation of the URL is decided from the indicator score if it is found in the Ignite IOC database.

Source

Ignite.py Ignite_test.py Ignite.yml Ignite_description.md
Download History Raw 
"""Ignite Main File."""

import ipaddress
import re
from copy import deepcopy
from typing import Any

import demistomock as demisto
import requests
import urllib3
from CommonServerPython import *  # noqa # pylint: disable=unused-wildcard-import
from CommonServerUserPython import *  # noqa

urllib3.disable_warnings()

""" CONSTANTS """
INTEGRATION_VERSION = get_pack_version()
INTEGRATION_PLATFORM = "Cortex XSOAR"
DEFAULT_API_PATH = "api.flashpoint.io"
DEFAULT_PLATFORM_PATH = "https://app.flashpoint.io"
DEFAULT_OLD_PLATFORM_PATH = "https://fp.tools"
FIRST_FETCH = "3 days"
DEFAULT_FETCH = 15
DEFAULT_PAGE_SIZE = 50
DEFAULT_FROM_VALUE = 0
DEFAULT_LIMIT = 10
DEFAULT_REPORT_LIMIT = 5
DEFAULT_REPUTATION_LIMIT = 5
DEFAULT_REPUTATION_CONTEXT_LIMIT = 50  # Default max entries for both relationships and enrichments per reputation result
DEFAULT_MESSAGE_MAX_LENGTH = 500  # Max characters to keep from a community search indicator's "message" field.
MESSAGE_TRUNCATION_SUFFIX = "... [message truncated, full content available in raw_response]"
MAX_PAGE_SIZE = 1000
MAX_FETCH_LIMIT = 200
MAX_PRODUCT = 10000
MAX_ALERTS_LIMIT = 500
MIN_CVSS_AND_EPSS_SCORE = 0
MAX_EPSS_SCORE = 1
MAX_CVSS_SCORE = 10
DEFAULT_SORT_ORDER = "asc"
DEFAULT_SORT_VALUE = "id"
DEFAULT_VULNERABILITIES_SORT_ORDER = "desc"
DEFAULT_VULNERABILITIES_SORT = "published at"
DEFAULT_FETCH_TYPE = "Compromised Credentials"
DEFAULT_FROM_VALUE = 0
DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ"  # ISO8601 format with UTC, default in XSOAR
READABLE_DATE_FORMAT = "%b %d, %Y  %H:%M"
TOTAL_RETRIES = 4
TOTAL_RETRIES_ON_ENRICHMENT = 0
DEFAULT_TIMEOUT = 60
TIMEOUT_ON_ENRICHMENT = 15
STATUS_CODE_TO_RETRY = (429, *(status_code for status_code in requests.status_codes._codes if status_code >= 500))  # type: ignore
OK_CODES = (
    400,
    401,
    403,
    404,
    521,
    *(
        status_code
        for status_code in requests.status_codes._codes  # type: ignore
        if status_code  # type: ignore[attr-defined]
        >= 200
        and status_code < 300
    ),  # type: ignore[attr-defined]
)  # type: ignore
BACKOFF_FACTOR = 7.5  # Sleep for [0s, 15s, 30s, 60s] between retries.
DEFAULT_END_TIME = "now"
DEFAULT_SEVERITY = "Unknown"

IS_FRESH_VALUES = ["true", "false"]
SORT_ORDER_VALUES = ["asc", "desc"]
SORT_DATE_VALUES = ["created_at", "first_observed_at"]
FILTER_DATE_VALUES = ["created_at", "first_observed_at"]
ALERT_STATUS_VALUES = ["archived", "starred", "sent", "none"]
ALERT_ORIGIN_VALUES = ["searches", "assets"]
LIBRARY_AND_PACKAGE_SORT_VALUES = ["id", "name"]

DATE_OBSERVED = "Date Observed (UTC)"
STRING_FORMAT = "[{}]({})"
TIME_OBSERVED = "Observed time (UTC)"
QUERY = r'+type:("ip-src","ip-dst","ip-dst|port") +value.\*:"'
HR_TITLE = "### Ignite {} reputation for "
REPUTATION_MALICIOUS = "Reputation: Malicious\n\n"
TABLE_TITLE = "Events in which this IOC observed"
ALL_DETAILS_LINK = "\nAll events and details (ignite): [{}]({})\n"
PLATFORM_LINK = "\nPlatform Link(ignite): [{}]({})\n"
MALICIOUS_DESCRIPTION = "Found in malicious indicators dataset"
SUSPICIOUS_DESCRIPTION = "Found in suspicious indicators dataset"
UNKONWN_DESCRIPTION = "Reputation of this Indicator is Unknown"
STIX_ATTACK_PATTERN = "STIX Attack Pattern"
REPUTATION_UNKNOWN = "Reputation: Unknown\n\n"
REPUTATION_SUSPICIOUS = "Reputation: Suspicious\n\n"
MALICIOUS_REPUTATION_SCORE = 3
UNKNOWN_REPUTATION_SCORE = 0
SUSPICIOUS_REPUTATION_SCORE = 2
FORUM_NAME = "Forum Name"
ROOM_TITLE = "Room Title"
AUTHOR_NAME = "Author Name"
THREAD_TITLE = "Thread Title"
EMPTY_DATA = "N/A"
VENDOR_NAME = "Ignite"
PAGINATION_HR = "#### To retrieve the next set of result use,"
MARKDOWN_CHARS = r"\*_{}[]()#+-!"
X_FP_HIGHLIGHT_TEXT = r"</?x-fp-highlight>"
DEFAULT_REPUTATION_VALUE = "unknown"
CUSTOM_INDICATOR_DBOTSCORE = DBotScoreType.CUSTOM
CUSTOM_OUTPUT_PREFIX = "Ignite.{}"

REPUTATION_SCORE_MAPPING = {"unknown": 0, "no_score": 0, "informational": 1, "suspicious": 2, "malicious": 3}

IOC_TYPE_MAPPING = {
    "ip": FeedIndicatorType.IP,
    "ipv4": FeedIndicatorType.IP,
    "ipv6": FeedIndicatorType.IPv6,
    "domain": FeedIndicatorType.Domain,
    "url": FeedIndicatorType.URL,
    "file": FeedIndicatorType.File,
}

DBOTSCORE_IOC_TYPE_MAPPING = {
    "ipv4": DBotScoreType.IP,
    "ipv6": DBotScoreType.IP,
    "domain": DBotScoreType.DOMAIN,
    "url": DBotScoreType.URL,
    "file": DBotScoreType.FILE,
}

URL_SUFFIX = {
    "LIST_INDICATORS": "/technical-intelligence/v2/indicators",
    "INDICATOR_SEARCH": "/technical-intelligence/v1/simple",
    "REPORT_SEARCH": "/finished-intelligence/v1/reports",
    "COMPROMISED_CREDENTIALS": "/sources/v1/noncommunities/search",
    "GET_REPORT_BY_ID": "/finished-intelligence/v1/reports/{}",
    "RELATED_REPORT_LIST": "/finished-intelligence/v1/reports/{}/related",
    "EVENT_LIST": "/technical-intelligence/v1/event",
    "EVENT_GET": "/technical-intelligence/v1/event/{}",
    "COMMUNITY_SEARCH": "/sources/v2/communities",
    "ALERTS": "/alert-management/v1/notifications",
    "VENDORS": "/vulnerability-intelligence/v1/vendors",
    "PRODUCTS": "/vulnerability-intelligence/v1/products",
    "VULNERABILITY_LIBRARIES": "/vulnerability-intelligence/v1/vulnerabilities/{}/libraries",
    "VULNERABILITY_PACKAGES": "/vulnerability-intelligence/v1/vulnerabilities/{}/packages",
    "VULNERABILITY_LIST": "/vulnerability-intelligence/v1/vulnerabilities",
    "VULNERABILITY_GET": "/vulnerability-intelligence/v1/vulnerabilities",
}

IGNITE_PATHS = {
    "Filename": "Ignite.Filename.Event(val.Fpid && val.Fpid == obj.Fpid)",
}

HR_SUFFIX = {
    "IOC_EMAIL": "/cti/malware/iocs?sort_date=All%20Time&types=email-dst,email-src,"
    "email-src-display-name,email-subject,email&query=%22{}%22",
    "IOC_FILENAME": "/cti/malware/iocs?sort_date=All%20Time&types=filename&query=%22{}%22",
    "IOC_URL": "/cti/malware/iocs?sort_date=All%20Time&types=url&query=%22{}%22",
    "IOC_FILE": "/cti/malware/iocs?sort_date=All%20time&types=md5,sha1,sha256,sha512,ssdeep&query=%22{}%22",
    "IOC_IP": "/cti/malware/iocs?query=%22{}%22&sort_date=All%20Time&types=ip-dst,ip-src,ip-dst|port",
    "IOC_SEARCH": "/cti/malware/iocs?query=%22{}%22&sort_date=All%20Time",
    "IOC_DOMAIN": "/cti/malware/iocs?sort_date=All%20Time&types=domain&query=%22{}%22",
    "IOC_ITEM": "/cti/malware/iocs/{}",
    "IOC_LIST": "/cti/malware/iocs",
    "IOC_UUID_LIST": "/cti/malware/iocs?query={}&sort_date=All+Time",
    "REPORT": "/cti/intelligence/report/{}#detail",
    "COMMUNITY_SEARCH": "/search/results/communities?query={}&include.date=all%20time",
    "VULNERABILITY": "/vuln/vulnerabilities/{}",
    "PRODUCT": "/vuln/products/{}",
    "VENDOR": "/vuln/vendors/{}",
}

OUTPUT_PREFIX = {
    "COMPROMISED_CREDENTIALS": "Ignite.CompromisedCredential",
    "REPORT": "Ignite.Report",
    "EMAIL": "Ignite.Email.Event",
    "FILENAME": "Ignite.Filename.Event",
    "DOMAIN": "Ignite.Domain",
    "IP": "Ignite.IP",
    "IP_COMMUNITY_SEARCH": "Ignite.IP",
    "IPV4": "Ignite.IP",
    "IPV6": "Ignite.IP",
    "URL": "Ignite.URL",
    "FILE": "Ignite.File",
    "EVENT": "Ignite.Event",
    "ALERT": "Ignite.Alert",
    "TOKEN": "Ignite.PageToken.Alert",
    "VULNERABILITY_LIBRARY": "Ignite.Library",
    "VULNERABILITY_PACKAGE": "Ignite.Package",
    "VULNERABILITY": "Ignite.Vulnerability",
    "VENDOR": "Ignite.Vendor",
    "PRODUCT": "Ignite.Product",
}

OUTPUT_KEY_FIELD = {
    "FPID": "Fpid",
    "REPORT_ID": "ReportId",
    "EVENT_ID": "EventId",
    "COMPROMISED_CREDENTIAL_ID": "_id",
    "VULNERABILITY_ID": "id",
}

ALERT_SOURCES_MAPPING = {
    "Github": "data_exposure__github",
    "Gitlab": "data_exposure__gitlab",
    "Bitbucket": "data_exposure__bitbucket",
    "Communities": "communities",
    "Images": "media",
    "Marketplaces": "marketplaces",
    "Reports": "reports",
    "Vulnerabilities": "vulnerabilities",
}

ALERT_RESOURCE_URL = {
    "communities": "/search/context/communities/{}",
    "marketplaces": "/search/context/marketplaces/{}",
    "media": "/search/results/media?include.date=all+time&include.media_id={}",
    "reports": "/cti/intelligence/report/{}",
}

ALERT_STATUS_MAPPING = {
    "starred": "flagged",
}

VALID_SEVERITIES = ("critical", "high", "medium", "low", "informational")
VALID_RANSOMWARE_SCORE = ("critical", "high", "medium", "low")
DEFAULT_FROM = 0

VULNERABILITY_SORT_MAPPING = {
    "id": "id",
    "severity": "severity",
    "title": "title",
    "cvssv3 score": "cvssv3_score",
    "published at": "published_at",
}
REFERENCE_TYPES_MAPPING = {
    "bugtraq id": "bid",
    "bug tracker": "bugtracker",
    "immunity canvas": "canvas",
    "immunity canvas (d2exploitpack)": "canvasd2",
    "immunity canvas (white phosphorus)": "canvaswp",
    "cert": "cert",
    "cert vu": "certvu",
    "ciac advisory": "ciac",
    "cve id": "cveid",
    "d2 elliot": "elliot",
    "exploit activity": "exploitactivity",
    "exploit database": "exploitdb",
    "flashpoint": "flashpoint",
    "generic exploit url": "gexploiturl",
    "generic informational url": "ginformurl",
    "disa iava": "iava",
    "iss x-force id": "iss",
    "japan vulnerability notes": "jpcert",
    "keyword": "keyword",
    "mail list post": "mailpost",
    "metasploit url": "metasploit",
    "microsoft knowledge base article": "mskb",
    "microsoft security bulletin": "mssb",
    "nessus script id": "nessus",
    "news article": "news",
    "nikto item id": "nikto",
    "other advisory url": "oadvisoryurl",
    "other solution url": "osolutionurl",
    "oval id": "oval",
    "packet storm": "packetstorm",
    "redhat rhsa": "redhat",
    "related vulndb id": "relvulndbid",
    "scip vuldb id": "scipid",
    "secunia advisory id": "secunia",
    "security tracker": "securitytracker",
    "snort signature id": "snort",
    "tenable pvs": "tenpvs",
    "us-cert cyber security alert": "uscert",
    "vendor specific advisory url": "vendadvisoryurl",
    "vendor specific solution url": "vendsolutionurl",
    "vendor url": "vendurl",
    "vendor specific news/changelog entry": "vsnewschangelog",
    "vupen advisory": "vupen",
}

LOCATION_MAPPING = {
    "context dependent": "context",
    "dial-up access required": "dialup",
    "local access required": "local",
    "legacy: local / remote": "local_remote",
    "mobile phone / hand-held device": "mobile",
    "physical access required": "physical",
    "remote / network access": "remote",
    "location unknown": "unknown",
    "wireless vector": "wireless",
}

ATTACK_TYPE_MAPPING = {
    "authentication management": "auth_manage",
    "cryptographic": "crypt",
    "infrastructure": "infrastruct",
    "input manipulation": "input_manip",
    "misconfiguration": "miss_config",
    "man-in-the-middle (mitm)": "mitm",
    "other": "other",
    "race condition": "race",
    "attack type unknown": "unknown",
}

VULNERABILITY_REPUTATION_SCORE_MAPPING = {
    "critical": Common.DBotScore.BAD,
    "high": Common.DBotScore.BAD,
    "medium": Common.DBotScore.SUSPICIOUS,
    "low": Common.DBotScore.SUSPICIOUS,
    "informational": Common.DBotScore.GOOD,
    "unknown": Common.DBotScore.NONE,
}
MESSAGES = {
    "INVALID_MAX_FETCH": "{} is an invalid value for maximum fetch. Maximum fetch must be between 1 to 200.",
    "INVALID_JSON_OBJECT": "Failed to parse json object from response: {}.",
    "STATUS_CODE": "Error in API call [{}] - {}",
    "INVALID_FETCH_TIME": "{} is invalid value for First Fetch Time. First fetch time should not be in the future.",
    "INVALID_FIRST_FETCH": "Argument 'First fetch time' should be a valid date or relative timestamp such as "
    "'2 days', '2 months', 'yyyy-mm-dd', 'yyyy-mm-ddTHH:MM:SSZ'",
    "SIZE_ERROR": "{} is an invalid value for size. Size must be between 1 to {}.",
    "NO_RECORDS_FOUND": "No {} were found for the given argument(s).",
    "PAGE_SIZE_ERROR": "{} is an invalid value for the page size. The page size must be between 1 to {}.",
    "LIMIT_ERROR": "{} is an invalid value for the limit. The limit must be between 1 to {}.",
    "PAGE_NUMBER_ERROR": "{} is an invalid value for the page number. The page number must be greater than 0.",
    "PRODUCT_ERROR": "The multiplication of the page_size and the page_number parameters cannot exceed {}. "
    "Current multiplication is {}.",
    "START_DATE_ERROR": "Requires the start_date argument along with the end_date argument.",
    "FILTER_DATE_ERROR": "{} is an invalid value for filter date. Filter date value must be of {}.",
    "SORT_DATE_ERROR": "{} is an invalid value for the sort date. The sort date value must be of {}.",
    "SORT_ORDER_ERROR": "{} is an invalid value for the sort order. The sort order value must be of {}.",
    "MISSING_DATE_ERROR": "Requires the argument value for at least the 'start_date' argument.",
    "MISSING_FILTER_DATE_ERROR": "Requires the filter_date argument's value when the start_date or the "
    "end_date argument is provided.",
    "MISSING_SORT_DATE_ERROR": "Requires sort_date value when sort_order is provided.",
    "IS_FRESH_ERROR": "{} is an invalid value for is fresh. Is fresh value must be of {}.",
    "MISSING_DATA": "{} response contains incorrect or missing data.",
    "TIME_RANGE_ERROR": f"The maximum records to fetch for the given first fetch can not exceed {MAX_PRODUCT}."
    " Current records are {}. Try decreasing the time interval.",
    "NO_PARAM_PROVIDED": "Please provide the {}.",
    "INVALID_ARGUMENT_RESPONSE": "Invalid argument value while trying to get information from Ignite: ",
    "INVALID_API_KEY": "Encountered error while trying to get information from Ignite: Invalid API Key configured.",
    "NO_RECORD_FOUND": "No record found for given argument(s): Not Found.",
    "TEST_CONNECTIVITY_FAILED": "Test connectivity failed. Please provide valid input parameters.",
    "MISSING_REQUIRED_ARGS": "{} is a required field. Please provide correct input.",
    "INVALID_IP_ADDRESS": "Invalid IP - {}",
    "INVALID_SINGLE_SELECT_PARAM": "{} is an invalid value for {}. Possible values are: {}.",
    "INVALID_TIME_INTERVAL": "{} parameter must be before {} parameter.({} - {})",
    "INVALID_PASSWORD_LENGTH": "Minimum length of password must be greater than zero.",
    "INVALID_FROM_PROVIDED": "{} is an invalid value for from. From must be greater than or equal to 0.",
    "INVALID_INTEGER_IDS": "The following {} IDs are not valid integers and will be ignored: {}",
    "INVALID_MULTI_PARAMS_PROVIDED": "{} is an invalid value for {}. Possible values are: {}.",
    "INVALID_INT_PARAMS_PROVIDED": "{} is an invalid value for {}. Please provide valid integer value(s).",
    "INVALID_CVSS_SCORE": "{} must be a float between 0 and 10.",
    "INVALID_EPSS_SCORE": "{} must be a float between 0 and 1.",
    "INVALID_SCORE_RANGE": "{} must be less than or equal to {}.",
    "INVALID_LIMIT_PROVIDED": "{} is an invalid value for limit. Limit must be between 1 to {}.",
}


class Client(BaseClient):
    """
    Client to use in integration with powerful http_request.
    """

    def __init__(
        self,
        url,
        headers,
        verify,
        proxy,
        create_relationships,
        reputation_enrichments_limit: int = DEFAULT_REPUTATION_CONTEXT_LIMIT,
        message_max_length: int = DEFAULT_MESSAGE_MAX_LENGTH,
    ):
        """Initialize class object.

        :type url: ``str``
        :param url: Base server address with suffix, for example: https://example.com.

        :type headers: ``Dict``
        :param headers: Additional headers to be included in the requests.

        :type verify: ``bool``
        :param verify: Use to indicate secure/insecure http request.

        :type proxy: ``bool``
        :param proxy: The proxy settings to be used.

        :type create_relationships: ``bool``
        :param create_relationships: True if integration will create relationships.

        :type reputation_enrichments_limit: ``int``
        :param reputation_enrichments_limit: Maximum number of enrichment entries stored per reputation
            command result. Lower values improve performance; higher values preserve more details.

        :type message_max_length: ``int``
        :param message_max_length: Maximum number of characters kept from a community search indicator's
            "message" field. Lower values reduce context size; higher values preserve more content.
        """
        self.url = url

        if DEFAULT_API_PATH in url:
            self.platform_url = DEFAULT_PLATFORM_PATH
        else:
            self.platform_url = url

        self.headers = headers
        self.verify = verify
        self.proxy = proxy
        self.create_relationships = create_relationships
        self.reputation_enrichments_limit = reputation_enrichments_limit
        self.message_max_length = message_max_length

        super().__init__(base_url=self.url, headers=self.headers, verify=self.verify, proxy=self.proxy)

    def http_request(self, method, url_suffix, params=None, json_data=None):
        """
        Get http response based on url and given parameters.

        :param method: Specify http methods
        :param url_suffix: url encoded url suffix
        :param params: None
        :param json_data: None
        :return: http response on json
        """
        demisto.debug(f"Requesting Ignite with method: {method}, url_suffix: {url_suffix} and params: {params}")
        # For reputation commands which run during an enrichment we limit the timeout and the retries
        retries = TOTAL_RETRIES_ON_ENRICHMENT if is_time_sensitive() else TOTAL_RETRIES
        timeout = TIMEOUT_ON_ENRICHMENT if is_time_sensitive() else DEFAULT_TIMEOUT

        resp = self._http_request(
            method=method,
            url_suffix=url_suffix,
            params=params,
            json_data=json_data,
            retries=retries,
            status_list_to_retry=STATUS_CODE_TO_RETRY,
            backoff_factor=BACKOFF_FACTOR,
            raise_on_redirect=False,
            raise_on_status=False,
            resp_type="response",
            ok_codes=OK_CODES,
            timeout=timeout,
        )  # type: ignore

        status_code = resp.status_code

        try:
            resp_json = resp.json()
        except ValueError as exception:
            raise DemistoException(
                MESSAGES["STATUS_CODE"].format(status_code, MESSAGES["INVALID_JSON_OBJECT"].format(resp.text)), exception
            ) from exception

        if status_code != 200:
            if status_code == 400:
                raise DemistoException(
                    MESSAGES["STATUS_CODE"].format(
                        status_code,
                        MESSAGES["INVALID_ARGUMENT_RESPONSE"]
                        + str(resp_json.get("detail", resp_json.get("message", json.dumps(resp_json)))),
                    )
                )
            if status_code == 401:
                raise DemistoException(MESSAGES["STATUS_CODE"].format(status_code, MESSAGES["INVALID_API_KEY"]))
            if status_code == 404:
                raise DemistoException(MESSAGES["STATUS_CODE"].format(status_code, MESSAGES["NO_RECORD_FOUND"]))
            if status_code in (521, 403):
                error_message = MESSAGES["TEST_CONNECTIVITY_FAILED"]
                if resp_json:
                    error_message += json.dumps(resp_json)
                raise DemistoException(MESSAGES["STATUS_CODE"].format(status_code, error_message))
            self.client_error_handler(resp)

        return resp_json

    def get_indicator(self, indicator_value: str, indicator_type: str, exact_match: bool = False):
        """
        Get an indicator by its type and value.

        :param indicator_type: The indicator type.
        :param indicator_value: The indicator value.
        :param exact_match: Whether to perform an exact match. If true, the indicator value is enclosed in quotes.

        :return: The indicator response.
        """
        indicator_value = f'"{indicator_value}"' if exact_match else indicator_value
        params = {"ioc_types": indicator_type, "ioc_value": indicator_value, "embed": "all"}

        return self.http_request("GET", URL_SUFFIX["LIST_INDICATORS"], params=params)

    def get_indicator_by_id(self, indicator_id: str):
        """
        Get an indicator by its id.

        :param indicator_id: ID of the indicator.

        :return: The indicator response.
        """

        url = f'{URL_SUFFIX["LIST_INDICATORS"]}/{indicator_id}'

        return self.http_request("GET", url)

    def get_vendors(self, params: dict):
        """
        Get vendors.

        :param params: Params to get vendors.

        :return: The vendors response.
        """
        return self.http_request("GET", URL_SUFFIX["VENDORS"], params=params)

    def get_products(self, params: dict):
        """
        Get products.

        :param params: Params to get products.

        :return: The products response.
        """
        return self.http_request("GET", URL_SUFFIX["PRODUCTS"], params=params)

    def get_vulnerability_libraries(self, vulnerability_id: str, params: dict):
        """
        Get libraries affected by a particular vulnerability.

        :param vulnerability_id: The vulnerability ID assigned by Flashpoint.
        :param params: Query parameters for the request.

        :return: The vulnerability libraries response.
        """
        url_suffix = URL_SUFFIX["VULNERABILITY_LIBRARIES"].format(vulnerability_id)

        return self.http_request("GET", url_suffix, params=params)

    def get_vulnerability_packages(self, vulnerability_id: str, params: dict):
        """
        Get packages affected by a particular vulnerability.

        :param vulnerability_id: The vulnerability ID assigned by Flashpoint.
        :param params: Query parameters for the request.

        :return: The vulnerability packages response.
        """
        url_suffix = URL_SUFFIX["VULNERABILITY_PACKAGES"].format(vulnerability_id)

        return self.http_request("GET", url_suffix, params=params)

    def vulnerability_list(self, query_params: dict, payload: dict):
        """
        List vulnerabilities

        :param query_params: Query parameters.
        :param payload: Body parameters.

        :return: The vulnerability response.
        """
        return self.http_request("POST", URL_SUFFIX["VULNERABILITY_LIST"], params=query_params, json_data=payload)


""" HELPER FUNCTIONS """


def string_escape_markdown(data: Any):
    """
    Escape any chars that might break a markdown string.

    :param data: The data to be modified (required).

    :return: A modified data.
    """
    if isinstance(data, str):
        data = "".join(["\\" + str(c) if c in MARKDOWN_CHARS else str(c) for c in data])
    elif isinstance(data, list):
        new_data = []
        for sub_data in data:
            if isinstance(sub_data, str):
                sub_data = "".join(["\\" + str(c) if c in MARKDOWN_CHARS else str(c) for c in sub_data])
            new_data.append(sub_data)
        data = new_data

    return data


def get_url_suffix(query):
    """
    Create url-suffix using the query value with url encoding.

    :param query: value of query param
    :return: url-encoded url-suffix
    """
    return URL_SUFFIX["INDICATOR_SEARCH"] + "?query=" + urllib.parse.quote(query.encode("utf8"))


def remove_space_from_args(args):
    """Remove space from args."""
    for key in args:
        if isinstance(args[key], str):
            args[key] = args[key].strip()
    return args


def validate_params(command: str, params: dict):
    """
    Validate the parameters.

    :param command: Command name.
    :type command: str

    :param params: Params to validate.
    :type params: Dict
    :return:
    """
    if not params.get("url"):
        raise DemistoException(MESSAGES["NO_PARAM_PROVIDED"].format("Server URL"))
    if not str(params.get("credentials", {}).get("password", "")).strip():
        raise DemistoException(MESSAGES["NO_PARAM_PROVIDED"].format("API Key"))
    if params.get("isFetch"):
        first_fetch = arg_to_datetime(params.get("first_fetch", FIRST_FETCH)).astimezone(timezone.utc)  # type: ignore
        current_time = arg_to_datetime(DEFAULT_END_TIME).astimezone(timezone.utc)  # type: ignore
        if first_fetch > current_time and command == "test-module":
            raise DemistoException(MESSAGES["INVALID_FETCH_TIME"].format(first_fetch.strftime(DATE_FORMAT)))


def replace_key(dictionary, new_key, old_key):
    """
    Replace key in dictionary.

    :param dictionary: dictionary object on which we wan to replace key.
    :param new_key: key which will replace in dictionary
    :param old_key: existing key in dictionary
    :return: dict object
    """
    if dictionary.get(old_key):
        dictionary[new_key] = dictionary.pop(old_key)
    return dictionary


def parse_event_response(client, event, fpid, href):
    """
    Prepare required event json object from event response.

    :param href: reference link of event
    :param fpid: unique id of event. i.e EventId
    :param client: object of client class
    :param event: event indicator from response
    :return: required event json object
    """
    observed_time = time.strftime(READABLE_DATE_FORMAT, time.gmtime(float(event["timestamp"])))
    name = event.get("info", "")
    uuid = event.get("uuid", "")
    if uuid:
        fp_link = urljoin(client.platform_url, HR_SUFFIX["IOC_UUID_LIST"].format(uuid))
        name_str = STRING_FORMAT.format(name, fp_link)
    else:
        name_str = name

    tags_list = [tag["name"] for tag in event.get("Tag", [])]
    tags_value = ", ".join(tags_list)

    event_creator_email = event.get("event_creator_email", "")

    event = {
        TIME_OBSERVED: observed_time,
        "Name": name_str,
        "EventName": name,
        "Tags": tags_value,
        "EventCreatorEmail": event_creator_email,
        "EventId": fpid,
        "UUID": uuid,
        "Href": href,
    }

    return event


def validate_fetch_incidents_params(params: dict, last_run: dict) -> dict:
    """
    Validate the parameter list for fetch incidents.

    :param params: Dictionary containing demisto configuration parameters
    :param last_run: last run returned by function demisto.getLastRun

    :return: Dictionary containing validated configuration parameters in proper format.
    """
    fetch_params = {}

    fetch_type = params.get("fetch_type", DEFAULT_FETCH_TYPE)
    if not fetch_type:
        fetch_type = DEFAULT_FETCH_TYPE

    first_fetch = arg_to_datetime(params.get("first_fetch", FIRST_FETCH))
    start_time = first_fetch.strftime(DATE_FORMAT)  # type: ignore

    if last_run and "start_time" in last_run:
        start_time = last_run.get("start_time")  # type: ignore

    is_fresh = argToBoolean(params.get("is_fresh_compromised_credentials", "true"))

    password_has_lowercase = params.get("password_has_lowercase", "")
    if password_has_lowercase:
        password_has_lowercase = argToBoolean(password_has_lowercase)

    password_has_uppercase = params.get("password_has_uppercase", "")
    if password_has_uppercase:
        password_has_uppercase = argToBoolean(password_has_uppercase)

    password_has_number = params.get("password_has_number", "")
    if password_has_number:
        password_has_number = argToBoolean(password_has_number)

    password_has_symbol = params.get("password_has_symbol", "")
    if password_has_symbol:
        password_has_symbol = argToBoolean(password_has_symbol)

    password_min_length = params.get("password_min_length", "")
    if password_min_length:
        password_min_length = arg_to_number(password_min_length)
        if password_min_length <= 0:
            raise ValueError(MESSAGES["INVALID_PASSWORD_LENGTH"])

    alert_status = params.get("status", "").lower()
    alert_origin = params.get("origin", "").lower()
    alert_sources = argToList(params.get("sources", ""))

    max_fetch = arg_to_number(params.get("max_fetch", DEFAULT_FETCH))

    if fetch_type == DEFAULT_FETCH_TYPE:
        fetch_params = prepare_args_for_fetch_compromised_credentials(
            max_fetch,  # type: ignore
            start_time,
            is_fresh,  # type: ignore
            password_has_lowercase,
            password_has_uppercase,
            password_has_number,
            password_has_symbol,
            password_min_length,
            last_run,
        )  # type: ignore

    elif fetch_type == "Alerts":
        fetch_params = prepare_args_for_fetch_alerts(
            max_fetch,  # type: ignore
            first_fetch,  # type: ignore
            alert_origin,
            alert_status,
            alert_sources,
            last_run,
        )
        start_time = fetch_params["created_after"]

    remove_nulls_from_dictionary(fetch_params)

    return {"fetch_type": fetch_type, "start_time": start_time, "fetch_params": fetch_params}


def prepare_args_for_fetch_compromised_credentials(
    max_fetch: int,
    start_time: str,
    is_fresh: bool,
    password_has_lowercase: bool,
    password_has_uppercase: bool,
    password_has_number: bool,
    password_has_symbol: bool,
    password_min_length: int,
    last_run: dict,
) -> dict:
    """
    Prepare arguments for fetching compromised credentials.

    :param max_fetch: Maximum number of incidents per fetch
    :param start_time: Date time to start fetching incidents from
    :param is_fresh: Boolean value showing whether to fetch the fresh compromised credentials or not
    :param password_has_lowercase: Value showing whether to fetch the compromised credentials with password containing lowercase
    :param password_has_uppercase: Value showing whether to fetch the compromised credentials with password containing uppercase
    :param password_has_number: Boolean value showing whether to fetch the compromised credentials with password containing number
    :param password_has_symbol: Boolean value showing whether to fetch the compromised credentials with password containing symbol
    :param password_min_length: Integer showing the minimum length of the password
    :param last_run: Dictionary containing last run objects

    :return: Dictionary of fetch arguments
    """
    fetch_params: dict[str, Any] = {}

    if max_fetch > MAX_FETCH_LIMIT and demisto.command() == "fetch-incidents":
        demisto.debug(
            f"The value for the Max Fetch parameter is {max_fetch} which is greater than "
            f"{MAX_FETCH_LIMIT}, so reducing it to {MAX_FETCH_LIMIT}."
        )
        max_fetch = 200

    if max_fetch < 1 or max_fetch > MAX_FETCH_LIMIT:
        raise DemistoException(MESSAGES["INVALID_MAX_FETCH"].format(max_fetch))
    fetch_params["limit"] = max_fetch

    if not last_run.get("fetch_count"):
        last_run["fetch_count"] = 0

    if not last_run.get("fetch_sum"):
        last_run["fetch_sum"] = 0

    fetch_params["skip"] = last_run["fetch_sum"]

    total = last_run.get("total")
    if total:
        # if total is present in record fetch_sum will be max_fetch and previous fetch_sum addition.
        fetch_sum = fetch_params["limit"] + fetch_params["skip"]
        if fetch_sum > total:
            # if calculated fetch sum is more than total records than calculate rest records from total value.
            fetch_params["limit"] = total - fetch_params["skip"]

    # update fetch_sum in last run is calculated fetch limit and fetched records addition.
    last_run["fetch_sum"] = fetch_params["limit"] + fetch_params["skip"]

    start_time = arg_to_datetime(start_time)
    start_time = datetime.timestamp(start_time)  # type: ignore

    if last_run["fetch_count"] == 0:
        # for first time fetch we have to update end_time as current time otherwise update end time as last run end_time.
        end_time = arg_to_datetime("now")
        last_run["end_time"] = end_time.strftime(DATE_FORMAT)  # type: ignore
    else:
        end_time = last_run["end_time"]
        end_time = arg_to_datetime(end_time)
    end_time = datetime.timestamp(end_time)  # type: ignore

    query = "+basetypes:(credential-sighting)"
    query += f" +header_.indexed_at: [{int(start_time)} TO {int(end_time)}]"  # type: ignore

    if is_fresh:
        query += " +is_fresh:true"

    if password_has_lowercase is not None:
        if password_has_lowercase is True:
            query += " +password_complexity.has_lowercase:(true)"
        if password_has_lowercase is False:
            query += " +password_complexity.has_lowercase:(false)"

    if password_has_uppercase is not None:
        if password_has_uppercase is True:
            query += " +password_complexity.has_uppercase:(true)"
        if password_has_uppercase is False:
            query += " +password_complexity.has_uppercase:(false)"

    if password_has_number is not None:
        if password_has_number is True:
            query += " +password_complexity.has_number:(true)"
        if password_has_number is False:
            query += " +password_complexity.has_number:(false)"

    if password_has_symbol is not None:
        if password_has_symbol is True:
            query += " +password_complexity.has_symbol:(true)"
        if password_has_symbol is False:
            query += " +password_complexity.has_symbol:(false)"

    if password_min_length is not None and password_min_length != "":
        query += f" +password_complexity.length:(>={password_min_length})"  # noqa: E231

    fetch_params["query"] = query
    fetch_params["sort"] = "header_.indexed_at:asc"

    return fetch_params


def prepare_args_for_fetch_alerts(
    max_fetch: int, first_fetch: str, alert_origin: str, alert_status: str, alert_sources: list, last_run: dict
) -> dict:
    """
    Prepare arguments for fetching alerts.

    :param max_fetch: Maximum number of incidents per fetch
    :param first_fetch: Date time to start fetching incidents from
    :param alert_origin: Alert origin
    :param alert_status: Alert status
    :param alert_sources: Alert sources
    :param last_run: Dictionary containing last run objects

    :return: Dictionary of fetch arguments
    """
    fetch_params: dict[str, Any] = {}
    end_time = arg_to_datetime("now").strftime(DATE_FORMAT)  # type: ignore
    start_time = first_fetch.strftime(DATE_FORMAT)  # type: ignore

    if max_fetch > MAX_FETCH_LIMIT and demisto.command() == "fetch-incidents":
        demisto.debug(
            f"The value for the Max Fetch parameter is {max_fetch} which is greater than "
            f"{MAX_FETCH_LIMIT}, so reducing it to {MAX_FETCH_LIMIT}."
        )
        max_fetch = 200

    if max_fetch < 1 or max_fetch > MAX_FETCH_LIMIT:
        raise DemistoException(MESSAGES["INVALID_MAX_FETCH"].format(max_fetch))

    fetch_params["size"] = max_fetch
    fetch_params["created_after"] = last_run.get("after_time", start_time)
    fetch_params["created_before"] = last_run.get("before_time", end_time)
    fetch_params["cursor"] = last_run.get("cursor")

    if alert_status and alert_status not in ALERT_STATUS_VALUES:
        raise ValueError(MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(alert_status, "alert_status", ALERT_STATUS_VALUES))

    if alert_origin and alert_origin not in ALERT_ORIGIN_VALUES:
        raise ValueError(MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(alert_origin, "alert_origin", ALERT_ORIGIN_VALUES))

    alert_sources = [ALERT_SOURCES_MAPPING.get(key, key) for key in alert_sources]

    fetch_params["status"] = ALERT_STATUS_MAPPING.get(alert_status, alert_status)  # type: ignore
    fetch_params["origin"] = alert_origin  # type: ignore
    fetch_params["sources"] = ",".join(alert_sources)  # type: ignore

    return fetch_params


def remove_duplicate_records(records: list, fetch_type: str, next_run: dict) -> list:
    """
    Check for duplicate records and remove them from the list.

    :param records: List of records
    :param fetch_type: Type of the records
    :param next_run: Dictionary to set in last run

    :return: Updated list of alerts
    """
    last_run_key = ""
    id_key = ""
    if fetch_type == DEFAULT_FETCH_TYPE:
        last_run_key = "hit_ids"
        id_key = "_id"

    if next_run.get(last_run_key):
        prev_alert_ids = next_run[last_run_key]
        records = [i for i in records if i[id_key] not in prev_alert_ids]

    return records


def prepare_incidents_from_alerts_data(
    response: dict, last_run: dict, fetch_params: dict, platform_url: str
) -> tuple[dict, list]:
    """
    Prepare incidents from the alerts data.

    :param response: Response from the alerts API
    :param last_run: Dictionary to set in last run
    :param fetch_params: Dictionary of fetch parameters
    :param platform_url: Platform URL

    :return: Tuple of dictionary of next run and list of fetched incidents
    """
    incidents = []
    alerts = response.get("items", [])
    alerts = remove_empty_elements(alerts)

    severity = demisto.params().get("severity", DEFAULT_SEVERITY)
    last_found_alert_ids = last_run.get("alert_ids", [])

    for alert in alerts:
        alert_id = alert.get("id")
        if alert_id in last_found_alert_ids:
            demisto.debug(f"Found existing alert with alert id: {alert_id}")
            continue

        tags = alert.get("tags", {})
        alert["tag_as_list"] = list(tags.keys())

        origin = alert.get("reason", {}).get("origin")
        source = alert.get("source") or ""
        resource_url = (alert.get("resource") or {}).get("url")
        if not resource_url and origin == "searches":
            resource_url = get_resource_url(source, alert.get("resource", {}).get("id"), platform_url)
        if source and source.lower() == "vulnerabilities":
            resource_url = (alert.get("resource") or {}).get("ignite_search_url")

        alert["resource"].update({"url": resource_url})

        incidents.append(
            {
                "name": alert.get("reason", {}).get("name", "") + " : " + str(alert.get("id", "")),
                "severity": IncidentSeverity.__dict__.get(severity.upper()),
                "occurred": alert.get("generated_at"),
                "rawJSON": json.dumps(alert),
            }
        )
        last_found_alert_ids.append(alert_id)

    next_run = {}
    _next = response.get("pagination", {}).get("next")

    if _next:
        parsed_url = urllib.parse.urlparse(_next)
        query_params = urllib.parse.parse_qs(parsed_url.query)
        cursor = query_params.get("cursor")[0]  # type: ignore
        next_run["cursor"] = cursor
        next_run["after_time"] = fetch_params["created_after"]
        next_run["before_time"] = fetch_params["created_before"]
    else:
        next_run["after_time"] = fetch_params["created_before"]

    demisto.debug(f"Set the last Run for notification alerts: {next_run}")
    next_run["alert_ids"] = last_found_alert_ids
    return next_run, incidents


def get_incident_name(hit_source: dict) -> str:
    """
    Determines the incident name based on available fields in the hit source.
    :param hit_source: The source data from the hit.
    :return: The incident name.
    """
    for field in ["username", "email", "fpid"]:
        value = hit_source.get(field)
        if value:
            demisto.debug(f"Setting incident name with {field}: {value}")
            return value
    demisto.debug("Setting incident name with default: Compromised Credential Alert")
    return "Compromised Credential Alert"


def prepare_incidents_from_compromised_credentials_data(
    response: dict, next_run: dict, start_time: str, is_test: bool
) -> tuple[dict, list]:
    """
    Prepare incidents from the compromised credentials data.

    :param response: Response from the compromised credentials API
    :param next_run: Dictionary to set in last run
    :param start_time: Date time saved of the last fetch

    :return: Tuple of dictionary of next run and list of fetched incidents
    """
    incidents = []
    total = arg_to_number(response.get("hits", {}).get("total"))
    check_value_of_total_records(total, next_run)

    if is_test:
        return {}, []

    hits = response.get("hits", {}).get("hits", [])

    hit_ids = [hit["_id"] for hit in hits]
    hits = remove_duplicate_records(hits, DEFAULT_FETCH_TYPE, next_run)
    severity = demisto.params().get("severity", DEFAULT_SEVERITY)

    for hit in hits:
        hit_source = hit.get("_source", {})
        incidents.append(
            {
                "name": get_incident_name(hit_source),
                "severity": getattr(IncidentSeverity, severity.upper(), None),  # safer access to enum
                "occurred": hit_source.get("breach", {}).get("created_at", {}).get("date-time"),
                "rawJSON": json.dumps(hit),
            }
        )

    if hits:
        prepare_checkpoint_and_related_objects(hits, hit_ids, next_run)

    if total > next_run["fetch_sum"]:
        # If more records are available, then increase the fetch count
        prepare_next_run_when_data_is_present(next_run, start_time)
    else:
        prepare_next_run_when_data_is_empty(next_run, hits)

    next_run_without_ids = {k: v for k, v in next_run.items() if k != "hit_ids"}
    demisto.debug(f"Set the last Run for compromised credentials: {next_run_without_ids}")
    return next_run, incidents


def check_value_of_total_records(total: Any, next_run: dict) -> None:
    """
    Check if total number of records are more than the limit or not.

    :param total: Total number of records
    :param next_run: Dictionary to set in last run

    :return: None
    """
    if total:
        if total > MAX_PRODUCT:  # type: ignore
            raise ValueError(MESSAGES["TIME_RANGE_ERROR"].format(total))
        next_run["total"] = total


def prepare_checkpoint_and_related_objects(hits: list, hit_ids: list, next_run: dict) -> None:
    """
    Prepare checkpoint and related objects for incidents of type compromised credentials.

    :param hits: List of compromised credentials
    :param hit_ids: List of ids of compromised credentials
    :param next_run: Dictionary to set in last run

    :return: None
    """
    indexed_at = hits[-1].get("_source", {}).get("header_", {}).get("indexed_at")
    indexed_at_date = datetime.utcfromtimestamp(float(indexed_at))
    indexed_at_date = indexed_at_date.strftime(DATE_FORMAT)
    next_run["last_time"] = indexed_at_date

    if next_run.get("last_timestamp"):
        if next_run["last_timestamp"] == indexed_at:
            # last_timestamp is similar as last_record indexed_at time than hit_ids will be appended to list.
            next_run["hit_ids"] += hit_ids
        else:
            # last_timestamp is not similar as last_record indexed_at so for that response hits_ids will be replaced.
            next_run["hit_ids"] = hit_ids
    else:
        next_run["hit_ids"] = hit_ids

    next_run["last_timestamp"] = indexed_at


def prepare_next_run_when_data_is_present(next_run: dict, start_time: str) -> None:
    """
    Prepare next run when data is present.

    :param next_run: Dictionary to set in last run
    :param start_time:  Date time saved of the last fetch

    :return: None
    """
    next_run["start_time"] = start_time
    next_run["fetch_count"] = next_run["fetch_count"] + 1


def prepare_next_run_when_data_is_empty(next_run: dict, hits: list) -> None:
    """
    Prepare next run when data is present.

    :param next_run: Dictionary to set in last run
    :param hits: List of compromised credentials

    :return: None
    """
    if hits:
        next_run["start_time"] = next_run["last_time"]
    next_run["fetch_count"] = 0
    next_run["fetch_sum"] = 0
    next_run["total"] = None


def validate_compromised_credentials_list_args(args: dict) -> dict:
    """
    Validate arguments for flashpoint-ignite-compromised-credentials-list command.

    :param args: The command arguments

    :return: Validated dictionary of arguments
    :raises: ValueError on invalid arguments
    """
    params = {"query": "+basetypes:(credential-sighting)"}

    validate_page_parameters_for_compromised_credentials(args, params)

    validate_date_parameters_for_compromised_credentials(args, params)

    validate_sort_parameters_for_compromised_credentials(args, params)

    is_fresh = args.get("is_fresh", "").lower()
    if is_fresh:
        if is_fresh not in IS_FRESH_VALUES:
            raise ValueError(MESSAGES["IS_FRESH_ERROR"].format(is_fresh, IS_FRESH_VALUES))
        params["query"] += f" +is_fresh:{is_fresh}"  # noqa: E231

    remove_nulls_from_dictionary(params)

    return params


def validate_date_parameters_for_compromised_credentials(args: dict, params: dict) -> None:
    """
    Validate date params for flashpoint-ignite-compromised-credentials-list command.

    :param args: The command arguments
    :param params: Dictionary of parameters

    :return: None
    """
    start_date = arg_to_datetime(args.get("start_date"))
    end_date = arg_to_datetime(args.get("end_date"))

    if end_date and not start_date:
        raise ValueError(MESSAGES["START_DATE_ERROR"])

    if start_date and not end_date:
        end_date = arg_to_datetime("now")

    filter_date = args.get("filter_date")
    if filter_date:
        if filter_date not in FILTER_DATE_VALUES:
            raise ValueError(MESSAGES["FILTER_DATE_ERROR"].format(filter_date, FILTER_DATE_VALUES))
        if not (start_date or end_date):
            raise ValueError(MESSAGES["MISSING_DATE_ERROR"])
        # type: ignore
        date_query = (
            f" +breach.{filter_date}.date-time: [{start_date.strftime(DATE_FORMAT)} TO"  # type: ignore[union-attr]
            f" {end_date.strftime(DATE_FORMAT)}]"  # type: ignore
        )  # type: ignore[union-attr]
        params["query"] += date_query
    elif start_date or end_date:
        raise ValueError(MESSAGES["MISSING_FILTER_DATE_ERROR"])


def validate_page_parameters_for_compromised_credentials(args: dict, params: dict) -> None:
    """
    Validate page_size and page_number for flashpoint-ignite-compromised-credentials-list command.

    :param args: The command arguments
    :param params: Dictionary of parameters

    :return: None
    """
    page_size = arg_to_number(args.get("page_size", DEFAULT_PAGE_SIZE))
    if page_size is None or page_size < 1 or page_size > MAX_PAGE_SIZE:
        raise ValueError(MESSAGES["PAGE_SIZE_ERROR"].format(page_size, MAX_PAGE_SIZE))

    page_number = arg_to_number(args.get("page_number", 1))
    if page_number is None or page_number < 1:
        raise ValueError(MESSAGES["PAGE_NUMBER_ERROR"].format(page_number))

    product = page_size * page_number
    if product > MAX_PRODUCT:
        raise ValueError(MESSAGES["PRODUCT_ERROR"].format(MAX_PRODUCT, product))

    params["skip"] = page_size * (page_number - 1)  # type: ignore
    params["limit"] = page_size  # type: ignore


def validate_sort_parameters_for_compromised_credentials(args: dict, params: dict) -> None:
    """
    Validate sort_order and sort_date for flashpoint-ignite-compromised-credentials-list command.

    :param args: The command arguments
    :param params: Dictionary of parameters

    :return: None
    """
    sort_order = args.get("sort_order", "").lower()
    if sort_order and sort_order not in SORT_ORDER_VALUES:
        raise ValueError(MESSAGES["SORT_ORDER_ERROR"].format(sort_order, SORT_ORDER_VALUES))

    sort_date = args.get("sort_date")
    if sort_date:
        if sort_date not in SORT_DATE_VALUES:
            raise ValueError(MESSAGES["SORT_DATE_ERROR"].format(sort_date, SORT_DATE_VALUES))
        if not sort_order:
            sort_order = DEFAULT_SORT_ORDER

        params["sort"] = f"breach.{sort_date}.timestamp:{sort_order}"  # noqa: E231
    elif sort_order:
        raise ValueError(MESSAGES["MISSING_SORT_DATE_ERROR"])


def validate_alert_list_args(args: dict) -> dict:
    """
    Validate arguments for flashpoint-ignite-alert-list command.

    :param args: The command arguments

    :return: Validated dictionary of arguments
    :raises: ValueError for invalid arguments
    """
    params = {}
    size = arg_to_number(args.get("size", DEFAULT_LIMIT))
    if size is None or size < 1 or size > MAX_ALERTS_LIMIT:  # type: ignore
        raise ValueError(MESSAGES["SIZE_ERROR"].format(size, MAX_ALERTS_LIMIT))
    params["size"] = size

    created_after = arg_to_datetime(args.get("created_after"))
    if created_after:
        params["created_after"] = created_after.strftime(DATE_FORMAT)  # type: ignore

    created_before = arg_to_datetime(args.get("created_before"))
    if created_before:
        params["created_before"] = created_before.strftime(DATE_FORMAT)  # type: ignore

    if created_after and created_before and created_after >= created_before:
        raise ValueError(
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "created_after", "created_before", params["created_after"], params["created_before"]
            )
        )

    params["cursor"] = args.get("cursor")  # type: ignore

    status = args.get("status", "").lower()
    if status and status not in ALERT_STATUS_VALUES:
        raise ValueError(MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(status, "status", ALERT_STATUS_VALUES))
    params["status"] = ALERT_STATUS_MAPPING.get(status, status)  # type: ignore

    origin = args.get("origin", "").lower()
    if origin and origin not in ALERT_ORIGIN_VALUES:
        raise ValueError(MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(origin, "origin", ALERT_ORIGIN_VALUES))
    params["origin"] = origin  # type: ignore

    params["cursor"] = args.get("cursor")  # type: ignore

    tags = argToList(args.get("tags"))
    if tags:
        params["tags"] = ",".join(tags)  # type: ignore

    sources = argToList(args.get("sources", ""))
    if sources:
        sources = [ALERT_SOURCES_MAPPING.get(key, key) for key in sources]
        params["sources"] = ",".join(sources)  # type: ignore

    asset_ids = argToList(args.get("asset_ids"))
    if asset_ids:
        params["asset_ids"] = ",".join(asset_ids)  # type: ignore

    query_ids = argToList(args.get("query_ids"))
    if query_ids:
        params["query_ids"] = ",".join(query_ids)  # type: ignore

    params["asset_type"] = args.get("asset_type")  # type: ignore

    asset_ip = args.get("asset_ip")
    if asset_ip and not is_ip_valid(asset_ip, True):
        raise ValueError(MESSAGES["INVALID_IP_ADDRESS"].format(asset_ip))
    params["asset_ip"] = asset_ip  # type: ignore

    remove_nulls_from_dictionary(params)

    return params


def validate_cvss_score(min_cvss: str | None, min_cvss_label: str, max_cvss: str | None, max_cvss_label: str) -> None:
    """
    Validate the CVSS score parameters.

    :type min_cvss: ``Optional[str]``
    :param min_cvss: Minimum CVSS score.

    :type min_cvss_label: ``str``
    :param min_cvss_label: Label for minimum CVSS score.

    :type max_cvss: ``Optional[str]``
    :param max_cvss: Maximum CVSS score.

    :type max_cvss_label: ``str``
    :param max_cvss_label: Label for maximum CVSS score.

    :raises DemistoException: If min_cvss or max_cvss is not a valid float between 0 and 10.
    :raises DemistoException: If min_cvss is greater than max_cvss.
    """
    min_cvss_float = None
    max_cvss_float = None
    if min_cvss:
        try:
            min_cvss_float = float(min_cvss)
        except ValueError:
            raise DemistoException(MESSAGES["INVALID_CVSS_SCORE"].format(min_cvss_label))
    if max_cvss:
        try:
            max_cvss_float = float(max_cvss)
        except ValueError:
            raise DemistoException(MESSAGES["INVALID_CVSS_SCORE"].format(max_cvss_label))

    if min_cvss_float is not None and (min_cvss_float < MIN_CVSS_AND_EPSS_SCORE or min_cvss_float > MAX_CVSS_SCORE):
        raise DemistoException(MESSAGES["INVALID_CVSS_SCORE"].format(min_cvss_label))
    if max_cvss_float is not None and (max_cvss_float < MIN_CVSS_AND_EPSS_SCORE or max_cvss_float > MAX_CVSS_SCORE):
        raise DemistoException(MESSAGES["INVALID_CVSS_SCORE"].format(max_cvss_label))

    if min_cvss_float is not None and max_cvss_float is not None and min_cvss_float > max_cvss_float:
        raise DemistoException(MESSAGES["INVALID_SCORE_RANGE"].format(min_cvss_label, max_cvss_label))


def validate_epss_score(min_epss: str | None, min_epss_label: str, max_epss: str | None, max_epss_label: str) -> None:
    """
    Validate the EPSS score parameters.

    :type min_epss: ``Optional[str]``
    :param min_epss: Minimum EPSS score.

    :type min_epss_label: ``str``
    :param min_epss_label: Label for minimum EPSS score.

    :type max_epss: ``Optional[str]``
    :param max_epss: Maximum EPSS score.

    :type max_epss_label: ``str``
    :param max_epss_label: Label for maximum EPSS score.

    :raises DemistoException: If min_epss or max_epss is not a valid float between 0 and 1.
    :raises DemistoException: If min_epss is greater than max_epss.
    """
    min_epss_float = None
    max_epss_float = None
    if min_epss:
        try:
            min_epss_float = float(min_epss)
        except ValueError:
            raise DemistoException(MESSAGES["INVALID_EPSS_SCORE"].format(min_epss_label))
    if max_epss:
        try:
            max_epss_float = float(max_epss)
        except ValueError:
            raise DemistoException(MESSAGES["INVALID_EPSS_SCORE"].format(max_epss_label))

    if min_epss_float is not None and (min_epss_float < MIN_CVSS_AND_EPSS_SCORE or min_epss_float > MAX_EPSS_SCORE):
        raise DemistoException(MESSAGES["INVALID_EPSS_SCORE"].format(min_epss_label))
    if max_epss_float is not None and (max_epss_float < MIN_CVSS_AND_EPSS_SCORE or max_epss_float > MAX_EPSS_SCORE):
        raise DemistoException(MESSAGES["INVALID_EPSS_SCORE"].format(max_epss_label))

    if min_epss_float is not None and max_epss_float is not None and min_epss_float > max_epss_float:
        raise DemistoException(MESSAGES["INVALID_SCORE_RANGE"].format(min_epss_label, max_epss_label))


def validate_time_range(
    after_time: datetime | None, before_time: datetime | None, after_arg_name: str, before_arg_name: str
) -> None:
    """
    Validate that the 'after' timestamp is earlier than the 'before' timestamp.

    Args:
        after_time (Optional[datetime]): The 'after' timestamp.
        before_time (Optional[datetime]): The 'before' timestamp.
        after_arg_name (str): The name of the 'after' argument for error messages.
        before_arg_name (str): The name of the 'before' argument for error messages.

    Raises:
        DemistoException: If after_time is not earlier than before_time.
    """
    if after_time and before_time and after_time >= before_time:
        raise DemistoException(MESSAGES["INVALID_TIME_INTERVAL"].format(after_arg_name, before_arg_name, after_time, before_time))


def validate_vulnerabilities_args(args: dict) -> tuple[dict, dict]:
    """
    Validate the parameter list for vulnerability list command.

    :type args: ``dict``
    :param args: Dictionary of arguments.

    :return: Tuple of (query_params, body_params) dicts.
    :rtype: ``tuple[dict, dict]``
    """
    tags = argToList(args.get("tags"))
    vulnerability_ids = [
        vulnerability_id.replace("FP-VULN-", "") for vulnerability_id in argToList(args.get("vulnerability_ids"))
    ]
    products = argToList(args.get("products"))
    vendors = argToList(args.get("vendors"))
    cwe_ids = argToList(args.get("cwe_ids"))
    ref_types = argToList(args.get("ref_types"), transform=lambda s: s.lower())
    ref_values = argToList(args.get("ref_values"))
    locations = argToList(args.get("locations"), transform=lambda s: s.lower())
    severities = argToList(args.get("severities"), transform=lambda s: s.lower())
    ransomware_scores = argToList(args.get("ransomware_scores"), transform=lambda s: s.lower())
    attack_types = argToList(args.get("attack_types"), transform=lambda s: s.lower())
    sort_by = args.get("sort_by", DEFAULT_VULNERABILITIES_SORT)
    sort_order = args.get("sort_order", DEFAULT_VULNERABILITIES_SORT_ORDER)
    updated_after = arg_to_datetime(args.get("updated_after"))
    updated_before = arg_to_datetime(args.get("updated_before"))
    disclosed_after = arg_to_datetime(args.get("disclosed_after"))
    disclosed_before = arg_to_datetime(args.get("disclosed_before"))
    published_after = arg_to_datetime(args.get("published_after"))
    published_before = arg_to_datetime(args.get("published_before"))
    last_touched_after = arg_to_datetime(args.get("last_touched_after"))
    last_touched_before = arg_to_datetime(args.get("last_touched_before"))
    min_epss_score = args.get("min_epss_score")
    max_epss_score = args.get("max_epss_score")
    min_cvssv2_score = args.get("min_cvssv2_score")
    max_cvssv2_score = args.get("max_cvssv2_score")
    min_cvssv3_score = args.get("min_cvssv3_score")
    max_cvssv3_score = args.get("max_cvssv3_score")
    min_cvssv4_score = args.get("min_cvssv4_score")
    max_cvssv4_score = args.get("max_cvssv4_score")

    validate_cvss_score(min_cvssv2_score, "Minimum CVSS v2 Score", max_cvssv2_score, "Maximum CVSS v2 Score")
    validate_cvss_score(min_cvssv3_score, "Minimum CVSS v3 Score", max_cvssv3_score, "Maximum CVSS v3 Score")
    validate_cvss_score(min_cvssv4_score, "Minimum CVSS v4 Score", max_cvssv4_score, "Maximum CVSS v4 Score")
    validate_epss_score(min_epss_score, "Minimum EPSS Score", max_epss_score, "Maximum EPSS Score")

    valid_severity = [severity for severity in severities if severity in VALID_SEVERITIES]
    invalid_severity = [severity for severity in severities if severity not in VALID_SEVERITIES]

    valid_ref_types = [REFERENCE_TYPES_MAPPING[ref_type] for ref_type in ref_types if ref_type in REFERENCE_TYPES_MAPPING]
    invalid_ref_types = [ref_type for ref_type in ref_types if ref_type not in REFERENCE_TYPES_MAPPING]

    valid_cwe_ids = [cwe_id for cwe_id in cwe_ids if cwe_id.isdigit()]
    invalid_cwe_ids = [cwe_id for cwe_id in cwe_ids if not cwe_id.isdigit()]

    valid_vulnerability_ids = [vulnerability_id for vulnerability_id in vulnerability_ids if vulnerability_id.isdigit()]
    invalid_vulnerability_ids = [vulnerability_id for vulnerability_id in vulnerability_ids if not vulnerability_id.isdigit()]

    valid_location = [LOCATION_MAPPING[loc] for loc in locations if loc in LOCATION_MAPPING]
    invalid_location = [loc for loc in locations if loc not in LOCATION_MAPPING]

    valid_ransomware_scores = [score for score in ransomware_scores if score in VALID_RANSOMWARE_SCORE]
    invalid_ransomware_scores = [score for score in ransomware_scores if score not in VALID_RANSOMWARE_SCORE]

    valid_attack_types = [ATTACK_TYPE_MAPPING[attack_type] for attack_type in attack_types if attack_type in ATTACK_TYPE_MAPPING]
    invalid_attack_types = [attack_type for attack_type in attack_types if attack_type not in ATTACK_TYPE_MAPPING]

    # Build query_params first (pagination and sorting)
    size = arg_to_number(args.get("size", DEFAULT_LIMIT))
    if size is not None and (size < 1 or size > MAX_PAGE_SIZE):
        raise DemistoException(MESSAGES["INVALID_LIMIT_PROVIDED"].format(size, MAX_PAGE_SIZE))

    from_ = arg_to_number(args.get("from", DEFAULT_FROM))
    if from_ is not None and from_ < 0:
        raise DemistoException(MESSAGES["INVALID_FROM_PROVIDED"].format(from_))

    sort_value = None
    if sort_by and sort_by.lower() not in VULNERABILITY_SORT_MAPPING:
        raise DemistoException(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(sort_by, "sort_by", VULNERABILITY_SORT_MAPPING.keys())
        )
    if sort_order and sort_order.lower() not in SORT_ORDER_VALUES:
        raise DemistoException(MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(sort_order, "sort_order", SORT_ORDER_VALUES))
    if sort_by:
        sort_value = (
            f"{VULNERABILITY_SORT_MAPPING[sort_by.lower()]}:desc"
            if sort_order and sort_order.lower() == "desc"
            else VULNERABILITY_SORT_MAPPING[sort_by.lower()]
        )

    query_params = assign_params(
        size=size,
        sort=sort_value,
    )

    if from_ is not None:
        query_params["from"] = from_

    errors = []
    if invalid_severity:
        errors.append(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                invalid_severity, "Severity", [severity.title() for severity in VALID_SEVERITIES]
            )
        )
    if invalid_ref_types:
        errors.append(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                invalid_ref_types, "Reference Types", [ref_type.title() for ref_type in REFERENCE_TYPES_MAPPING]
            )
        )
    if invalid_cwe_ids:
        errors.append(MESSAGES["INVALID_INT_PARAMS_PROVIDED"].format(invalid_cwe_ids, "CWE IDs"))

    if invalid_vulnerability_ids:
        errors.append(MESSAGES["INVALID_INT_PARAMS_PROVIDED"].format(invalid_vulnerability_ids, "Vulnerability IDs"))

    if invalid_location:
        errors.append(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                invalid_location, "Locations", [loc.title() for loc in LOCATION_MAPPING]
            )
        )
    if invalid_ransomware_scores:
        errors.append(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                invalid_ransomware_scores, "Ransomware Scores", [score.title() for score in VALID_RANSOMWARE_SCORE]
            )
        )
    if invalid_attack_types:
        errors.append(
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                invalid_attack_types, "Attack Types", [attack_type.title() for attack_type in ATTACK_TYPE_MAPPING]
            )
        )

    if errors:
        raise DemistoException("\n\n".join(errors))

    # Build payload (filters and search criteria)

    payload = assign_params(
        ids=",".join(valid_vulnerability_ids),
        tags=",".join(tags),
        min_epss_score=min_epss_score,
        max_epss_score=max_epss_score,
        min_cvssv2_score=min_cvssv2_score,
        max_cvssv2_score=max_cvssv2_score,
        min_cvssv3_score=min_cvssv3_score,
        max_cvssv3_score=max_cvssv3_score,
        min_cvssv4_score=min_cvssv4_score,
        max_cvssv4_score=max_cvssv4_score,
        products=",".join(products),
        vendors=",".join(vendors),
        cwe_ids=",".join(valid_cwe_ids),
        ref_types=",".join(valid_ref_types),
        ref_values=",".join(ref_values),
        location=",".join(valid_location),
        severity=",".join(valid_severity),
        ransomware_score=",".join(valid_ransomware_scores),
        attack_type=",".join(valid_attack_types),
        updated_after=updated_after.strftime(DATE_FORMAT) if updated_after else None,  # type: ignore
        updated_before=updated_before.strftime(DATE_FORMAT) if updated_before else None,  # type: ignore
        disclosed_after=disclosed_after.strftime(DATE_FORMAT) if disclosed_after else None,  # type: ignore
        disclosed_before=disclosed_before.strftime(DATE_FORMAT) if disclosed_before else None,  # type: ignore
        published_after=published_after.strftime(DATE_FORMAT) if published_after else None,  # type: ignore
        published_before=published_before.strftime(DATE_FORMAT) if published_before else None,  # type: ignore
        last_touched_after=last_touched_after.strftime(DATE_FORMAT) if last_touched_after else None,  # type: ignore
        last_touched_before=last_touched_before.strftime(DATE_FORMAT) if last_touched_before else None,  # type: ignore
    )

    validate_time_range(payload.get("updated_after"), payload.get("updated_before"), "updated_after", "updated_before")
    validate_time_range(payload.get("disclosed_after"), payload.get("disclosed_before"), "disclosed_after", "disclosed_before")
    validate_time_range(payload.get("published_after"), payload.get("published_before"), "published_after", "published_before")
    validate_time_range(
        payload.get("last_touched_after"),
        payload.get("last_touched_before"),
        "last_touched_after",
        "last_touched_before",
    )

    remove_nulls_from_dictionary(query_params)
    remove_nulls_from_dictionary(payload)

    return query_params, payload


def prepare_hr_for_list_vulnerabilities(vulnerabilities: list, platform_url: str) -> str:
    """
    Prepare human-readable output for a list of vulnerabilities.

    :param vulnerabilities: List of vulnerability data dictionaries.
    :param platform_url: Platform URL for generating clickable links.

    :return: Human-readable markdown string.
    """
    hr = []

    for vulnerability in vulnerabilities:
        cve_ids = vulnerability.get("cve_ids", [])
        vuln_id = vulnerability.get("id", "")

        data = {
            "ID": f"FP-VULN-{vuln_id}, [link]({urljoin(platform_url, HR_SUFFIX['VULNERABILITY'].format(vuln_id))})",
            "CVE IDs": cve_ids,
            "Title": vulnerability.get("title", ""),
            "Description": vulnerability.get("description", ""),
            "Solution": vulnerability.get("solution", ""),
            "Vulnerability Status": vulnerability.get("vuln_status", ""),
            "Severity": vulnerability.get("scores", {}).get("severity", ""),
            "CVSS v3 Score": vulnerability.get("cvssv3_score", ""),
            "EPSS Score": vulnerability.get("scores", {}).get("epss_score", ""),
            "Ransomware Score": vulnerability.get("scores", {}).get("ransomware_score", ""),
            "Published At": vulnerability.get("timelines", {}).get("published_at", ""),
            "Last Modified At": vulnerability.get("timelines", {}).get("last_modified_at", ""),
            "Tags": vulnerability.get("tags", ""),
            "CVSS v2": vulnerability.get("cvss_v2s", ""),
            "CVSS v3": vulnerability.get("cvss_v3s", ""),
            "CVSS v4": vulnerability.get("cvss_v4s", ""),
            "Products": vulnerability.get("products", ""),
            "CWEs": vulnerability.get("cwes", ""),
            "Exploits": vulnerability.get("exploits", ""),
            "Exploits Count": vulnerability.get("exploits_count", ""),
        }
        hr.append(data)

    headers = [
        "ID",
        "CVE IDs",
        "Title",
        "Description",
        "Solution",
        "Vulnerability Status",
        "Severity",
        "CVSS v3 Score",
        "EPSS Score",
        "Ransomware Score",
        "Published At",
        "Last Modified At",
        "Tags",
        "CVSS v2",
        "CVSS v3",
        "CVSS v4",
        "Products",
        "CWEs",
        "Exploits",
        "Exploits Count",
    ]

    return tableToMarkdown(
        name="Vulnerability List",
        t=hr,
        headers=headers,
        removeNull=True,
        json_transform_mapping={
            header: JsonTransformer(is_nested=True)
            for header in ["CVSS v2", "CVSS v3", "CVSS v4", "Products", "CWEs", "Exploits"]
        },
    )


def prepare_hr_for_compromised_credentials(hits: list) -> str:
    """
    Prepare human readable format for compromised credentials.

    :param hits: List of compromised credentials

    :return: Human readable format of compromised credentials
    """
    hr = []
    for hit in hits:
        source = hit.get("_source", {})
        created_date = source.get("breach", {}).get("created_at", {}).get("date-time")
        created_date = arg_to_datetime(created_date)
        if created_date:
            created_date = created_date.strftime(READABLE_DATE_FORMAT)  # type: ignore

        first_observed_date = source.get("breach", {}).get("first_observed_at", {}).get("date-time")
        first_observed_date = arg_to_datetime(first_observed_date)
        if first_observed_date:
            first_observed_date = first_observed_date.strftime(READABLE_DATE_FORMAT)  # type: ignore

        data = {
            "FPID": source.get("fpid", ""),
            "Email": source.get("email", ""),
            "Username": source.get("username", ""),
            "Breach Source": source.get("breach", {}).get("source"),
            "Breach Source Type": source.get("breach", {}).get("source_type"),
            "Password": source.get("password"),
            "Created Date (UTC)": created_date,
            "First Observed Date (UTC)": first_observed_date,
        }
        hr.append(data)

    return tableToMarkdown(
        "Compromised Credential(s)",
        hr,
        [
            "FPID",
            "Email",
            "Username",
            "Breach Source",
            "Breach Source Type",
            "Password",
            "Created Date (UTC)",
            "First Observed Date (UTC)",
        ],
        removeNull=True,
    )


def parse_indicator_response(indicators):
    """
    Extract Ignite event details and href values from each of the indicator in an indicator list.

    :param indicators: list of indicators
    :return: dict containing event details and href
    """
    events = []
    hrefs = []
    attack_ids = []
    for indicator in indicators:
        hrefs.append(indicator.get("Attribute", {}).get("href", ""))

        event = indicator.get("Attribute", {}).get("Event", {})
        attack_ids = event.get("attack_ids", [])
        tags_list = list(event["Tags"])
        tags_value = ", ".join(tags_list)

        observed_time = time.strftime(READABLE_DATE_FORMAT, time.gmtime(float(event["timestamp"])))

        events.append(
            {
                DATE_OBSERVED: observed_time,
                "Name": event.get("info", ""),
                "Tags": tags_value,
            }
        )

    return {"events": events, "href": hrefs, "attack_ids": attack_ids}


def create_relationships_list_v2(client, related_iocs, indicator_value, indicator_type):
    """
    Create relationships list from given data.

    :param client: object of client class
    :param related_iocs: list of related iocs
    :param indicator_value: value of indicator
    :param indicator_type: type of indicator

    :return: list of relationships
    """

    relationships = []
    if client.create_relationships and related_iocs:
        for ioc in related_iocs:
            if ioc.get("type", "") != "extracted_config":
                relationships.append(
                    EntityRelationship(
                        name="related-to",
                        entity_a=indicator_value,
                        entity_a_type=IOC_TYPE_MAPPING.get(indicator_type, indicator_type),
                        entity_b=ioc.get("value"),
                        entity_b_type=IOC_TYPE_MAPPING.get(ioc.get("type"), ioc.get("type")),
                        brand=VENDOR_NAME,
                    )
                )
    return relationships


def create_relationships_list_for_community_search(client, indicators, ip):
    relationships: list = []
    limit = client.reputation_enrichments_limit
    if client.create_relationships:
        ip_address_data = indicators.get("enrichments", {}).get("ip_address", [])
        for ip_address in ip_address_data:
            if is_ip_valid(ip_address, True):
                if len(relationships) >= limit:
                    demisto.debug(
                        f"Reached the maximum limit of relationships: {limit} "
                        "for community search. truncating the rest of the relationships."
                    )
                    break
                relationships.append(
                    EntityRelationship(
                        name="indicator-of",
                        entity_a=ip,
                        entity_a_type=FeedIndicatorType.IP,
                        entity_b=ip_address,
                        entity_b_type=FeedIndicatorType.indicator_type_by_server_version(STIX_ATTACK_PATTERN),
                        brand=VENDOR_NAME,
                    )
                )

        indicator_data = indicators.get("enrichments", {}).get("url_domains", [])
        indicator_data += indicators.get("enrichments", {}).get("email_addresses", [])
        indicator_data += indicators.get("enrichments", {}).get("cve_ids", [])

        for indicator in indicator_data:
            if len(relationships) >= limit:
                demisto.debug(
                    f"Reached the maximum limit of relationships: {limit} "
                    "for community search. truncating the rest of the relationships."
                )
                break
            relationships.append(
                EntityRelationship(
                    name="indicator-of",
                    entity_a=ip,
                    entity_a_type=FeedIndicatorType.IP,
                    entity_b=indicator,
                    entity_b_type=FeedIndicatorType.indicator_type_by_server_version(STIX_ATTACK_PATTERN),
                    brand=VENDOR_NAME,
                )
            )

    return relationships


def create_indicator_object(item: dict, relationships: dict):
    """
    Create indicator object from given data.

    :param item: item dictionary from  response
    :param relationships: relationships dictionary

    :return: Indicator object
    """

    indicator_value = item.get("value", "")
    indicator_type = item.get("type", "")

    dbot_score = Common.DBotScore(
        indicator=indicator_value,
        indicator_type=DBOTSCORE_IOC_TYPE_MAPPING.get(indicator_type, CUSTOM_INDICATOR_DBOTSCORE),
        integration_name=VENDOR_NAME,
        score=REPUTATION_SCORE_MAPPING.get(item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)),
        malicious_description=MALICIOUS_DESCRIPTION,
        reliability=demisto.params().get("integrationReliability"),
    )
    dbot_score.integration_name = VENDOR_NAME

    if indicator_type == "domain":
        return Common.Domain(domain=indicator_value, dbot_score=dbot_score, relationships=relationships)
    elif indicator_type == "url":
        return Common.URL(url=indicator_value, dbot_score=dbot_score, relationships=relationships)
    elif indicator_type == "file":
        hashes = {
            "md5": item.get("hashes", {}).get("md5"),
            "sha1": item.get("hashes", {}).get("sha1"),
            "sha256": item.get("hashes", {}).get("sha256"),
        }
        return Common.File(dbot_score=dbot_score, relationships=relationships, **hashes)
    elif indicator_type == "ipv4" or indicator_type == "ipv6":
        return Common.IP(ip=indicator_value, dbot_score=dbot_score, relationships=relationships)
    else:
        return Common.CustomIndicator(
            value=indicator_value,
            indicator_type=indicator_type,
            data=remove_empty_elements(item),
            context_prefix=indicator_type,
            dbot_score=dbot_score,
            relationships=relationships,
        )


def get_resource_url(source: str, resource_id: str, platform_url: str):
    """
    Generates the resource URL based on the given source and resource ID.

    :param source: The source of the resource.
    :param resource_id: The ID of the resource.
    :param platform_url: The platform URL

    :return: The generated resource URL.
    """
    if not resource_id:
        raise ValueError(MESSAGES["MISSING_DATA"].format("alerts"))

    resource_url = platform_url + ALERT_RESOURCE_URL.get(source, "").format(resource_id)

    return resource_url


def prepare_hr_for_alerts(alerts: list, platform_url: str) -> str:
    """
    Prepare human readable format for alerts.

    :param alerts: List of alerts
    :param platform_url: The platform URL

    :return: Human readable format of alerts
    """
    table_data = []
    for alert in alerts:
        _id = alert.get("id")
        keyword_text = alert.get("reason", {}).get("text")
        created_at = arg_to_datetime(alert.get("created_at"))
        if created_at:
            created_at = created_at.strftime(READABLE_DATE_FORMAT)  # type: ignore

        source = alert.get("source")
        repo = alert.get("resource", {}).get("repo")
        owner = alert.get("resource", {}).get("owner")
        origin = alert.get("reason", {}).get("origin")
        resource_url = alert.get("resource", {}).get("url")
        if not resource_url and origin == "searches":
            resource_url = get_resource_url(source, alert.get("resource", {}).get("id"), platform_url)
        highlight_text = alert.get("highlight_text")
        ports = ", ".join([re.sub(X_FP_HIGHLIGHT_TEXT, "", port) for port in alert.get("highlights", {}).get("ports", [])])
        services = ", ".join(
            [re.sub(X_FP_HIGHLIGHT_TEXT, "", service) for service in alert.get("highlights", {}).get("services", [])]
        )
        site_title = alert.get("resource", {}).get("site", {}).get("title")
        shodan_info = alert.get("resource", {}).get("shodan_host", {})
        if created_at:
            table_data.append(
                {
                    "ID": _id,
                    "Created at (UTC)": created_at,
                    "Query": keyword_text,
                    "Highlight Text": string_escape_markdown(highlight_text),
                    "Source": source,
                    "Repository": repo,
                    "Owner": owner,
                    "Resource URL": resource_url,
                    "Origin": origin,
                    "Site Title": site_title,
                    "Shodan Host": shodan_info,
                    "Ports": ports,
                    "Services": services,
                }
            )

    headers = [
        "ID",
        "Created at (UTC)",
        "Query",
        "Source",
        "Resource URL",
        "Site Title",
        "Shodan Host",
        "Repository",
        "Owner",
        "Origin",
        "Ports",
        "Services",
        "Highlight Text",
    ]

    return tableToMarkdown(
        "Alerts",
        remove_empty_elements(table_data),
        headers,
        removeNull=True,
        url_keys=["Resource URL", "shodan_url"],
        json_transform_mapping={"Shodan Host": JsonTransformer()},
    )


def get_related_iocs_and_tags(item: dict) -> tuple[list, list]:
    """
    Get related IOCs and tags from the given item.

    :param item: The item to get related IOCs and tags from.

    :return: A tuple containing a list of related IOCs and a list of tags.
    """

    tags = deepcopy(item.get("latest_sighting", {}).get("tags", []))
    related_iocs = []
    related_iocs_data = []
    latest_sighting_related_iocs = item.get("latest_sighting", {}).get("related_iocs", [])
    related_iocs_data.append(latest_sighting_related_iocs)
    sightings_data = item.get("sightings", [])

    for sighting in sightings_data:
        related_iocs_data.append(sighting.get("related_iocs", []))
        for tag in sighting.get("tags", []):
            if tag not in tags:
                tags.append(tag)

    for related_ioc in related_iocs_data:
        for ioc in related_ioc:
            if ioc.get("value") != item.get("value"):
                if ioc.get("type", "") == "extracted_config":
                    ioc_data = {
                        "type": ioc.get("type"),
                        "value": json.loads(ioc.get("value")),
                    }
                else:
                    ioc_data = {
                        "type": ioc.get("type"),
                        "value": ioc.get("value"),
                    }
                if ioc_data not in related_iocs:
                    related_iocs.append(ioc_data)

    return related_iocs, tags


def html_to_text(html) -> str:
    """
    Convert HTML to text.

    param html: The HTML to convert.

    return: The converted text.
    """

    # Remove HTML tags
    text = re.sub(r"<.*?>", "", html)

    # Replace HTML entities with their corresponding characters
    text = re.sub(r"&amp;", "&", text)
    text = re.sub(r"&lt;", "<", text)
    text = re.sub(r"&gt;", ">", text)
    text = re.sub(r"&quot;", '"', text)
    text = re.sub(r"&#(\d+);", lambda m: chr(int(m.group(1))), text)

    return text.strip()


def truncate_message(message: str | None, max_length: int = DEFAULT_MESSAGE_MAX_LENGTH) -> str | None:
    """
    Cut a free-text message down to `max_length` characters.

    :param message: The raw message text to truncate.
    :param max_length: Maximum number of characters to keep.

    :return: The truncated message, unchanged if it was already short enough or not a non-empty string.
    """
    if not message or not isinstance(message, str) or len(message) <= max_length:
        return message

    return message[:max_length].rstrip() + MESSAGE_TRUNCATION_SUFFIX


def prepare_hr_for_vulnerability(vulnerability: dict, platform_url: str, is_reputation: bool = False) -> str:
    """
    Prepare human-readable output for vulnerability details.

    :param vulnerability: Vulnerability data dictionary
    :param platform_url: Platform URL
    :param is_reputation: Whether the vulnerability is a reputation
    :return: Human-readable markdown string
    """
    if not is_reputation:
        hr = f"### Ignite FP-VULN-{vulnerability.get('id')} Vulnerability Details" + (
            " for: " + ", ".join(vulnerability.get("cve_ids", [])) if vulnerability.get("cve_ids") else ""
        )
    else:
        hr = "### Ignite CVE Details for: " + ", ".join(vulnerability.get("cve_ids", []))

    vulnerability_details = {
        "ID": f"[{vulnerability.get('id', '')}]"
        + f"({urljoin(platform_url, HR_SUFFIX['VULNERABILITY'].format(vulnerability.get('id', '')))})",
        "Title": vulnerability.get("title", EMPTY_DATA),
        "Status": vulnerability.get("vuln_status", EMPTY_DATA),
        "Keywords": vulnerability.get("keywords", EMPTY_DATA),
        "Description": vulnerability.get("description", EMPTY_DATA),
        "Solution": vulnerability.get("solution", EMPTY_DATA),
        "Technical Description": vulnerability.get("technical_description", EMPTY_DATA),
        "Exploits Count": vulnerability.get("exploits_count", EMPTY_DATA),
        "Alternate VulnDB ID": vulnerability.get("alternate_vulndb_id", EMPTY_DATA),
        "Tags": ", ".join(vulnerability.get("tags", [])) if vulnerability.get("tags") else EMPTY_DATA,
        "Creditees": vulnerability.get("creditees", EMPTY_DATA),
    }

    hr += "\n" + tableToMarkdown(
        "Vulnerability Information",
        vulnerability_details,
        headers=[
            "ID",
            "Title",
            "Status",
            "Keywords",
            "Description",
            "Solution",
            "Technical Description",
            "Exploits Count",
            "Alternate VulnDB ID",
            "Tags",
            "Creditees",
        ],
        json_transform_mapping={
            "Creditees": JsonTransformer(is_nested=True),
        },
        removeNull=True,
    )

    scores = vulnerability.get("scores", {})
    if scores:
        score_details = {
            "EPSS Score": scores.get("epss_score", EMPTY_DATA),
            "EPSS v1 Score": scores.get("epss_v1_score", EMPTY_DATA),
            "Ransomware Score": scores.get("ransomware_score", EMPTY_DATA),
            "Severity": scores.get("severity", EMPTY_DATA),
            "Social Risk Scores": scores.get("social_risk_scores", EMPTY_DATA),
        }
        hr += "\n" + tableToMarkdown(
            "Score Information",
            score_details,
            headers=[
                "EPSS Score",
                "EPSS v1 Score",
                "Ransomware Score",
                "Severity",
                "Social Risk Scores",
            ],
            json_transform_mapping={
                "Social Risk Scores": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

    timelines = vulnerability.get("timelines", {})
    if timelines:
        timeline_details = {
            "Published At": timelines.get("published_at", EMPTY_DATA),
            "Last Modified At": timelines.get("last_modified_at", EMPTY_DATA),
            "Exploit Published At": timelines.get("exploit_published_at", EMPTY_DATA),
            "Discovered At": timelines.get("discovered_at", EMPTY_DATA),
            "Disclosed At": timelines.get("disclosed_at", EMPTY_DATA),
            "Vendor Informed At": timelines.get("vendor_informed_at", EMPTY_DATA),
            "Vendor Acknowledged At": timelines.get("vendor_acknowledged_at", EMPTY_DATA),
            "Third Party Solution Provided At": timelines.get("third_party_solution_provided_at", EMPTY_DATA),
            "Solution Provided At": timelines.get("solution_provided_at", EMPTY_DATA),
            "Exploited In The Wild At": timelines.get("exploited_in_the_wild_at", EMPTY_DATA),
            "Vendor Response Time": timelines.get("vendor_response_time", EMPTY_DATA),
            "Time To Patch": timelines.get("time_to_patch", EMPTY_DATA),
            "Total Time To Patch": timelines.get("total_time_to_patch", EMPTY_DATA),
            "Time Unpatched": timelines.get("time_unpatched", EMPTY_DATA),
            "Time To Exploit": timelines.get("time_to_exploit", EMPTY_DATA),
            "Total Time To Exploit": timelines.get("total_time_to_exploit", EMPTY_DATA),
        }
        hr += "\n" + tableToMarkdown(
            "Timeline Information",
            timeline_details,
            headers=[
                "Published At",
                "Last Modified At",
                "Discovered At",
                "Disclosed At",
                "Vendor Informed At",
                "Vendor Acknowledged At",
                "Third Party Solution Provided At",
                "Solution Provided At",
                "Exploited In The Wild At",
                "Vendor Response Time",
                "Time To Patch",
                "Total Time To Patch",
                "Time Unpatched",
                "Time To Exploit",
                "Total Time To Exploit",
            ],
            removeNull=True,
        )

    cvss_v2s = vulnerability.get("cvss_v2s", [])
    if cvss_v2s:
        cvss_data = []
        for cvss in cvss_v2s:
            cvss_data.append(
                {
                    "Score": cvss.get("score", EMPTY_DATA),
                    "Source": cvss.get("source", EMPTY_DATA),
                    "Generated At": cvss.get("generated_at", EMPTY_DATA),
                    "CVE ID": cvss.get("cve_id", EMPTY_DATA),
                    "Calculated CVSS Base Score": cvss.get("calculated_cvss_base_score", EMPTY_DATA),
                    "Access Vector": cvss.get("access_vector", EMPTY_DATA),
                    "Access Complexity": cvss.get("access_complexity", EMPTY_DATA),
                    "Authentication": cvss.get("authentication", EMPTY_DATA),
                    "Confidentiality Impact": cvss.get("confidentiality_impact", EMPTY_DATA),
                    "Integrity Impact": cvss.get("integrity_impact", EMPTY_DATA),
                    "Availability Impact": cvss.get("availability_impact", EMPTY_DATA),
                }
            )
        if cvss_data:
            hr += "\n" + tableToMarkdown(
                "CVSS v2 Scores",
                cvss_data,
                headers=[
                    "Score",
                    "Source",
                    "Generated At",
                    "CVE ID",
                    "Calculated CVSS Base Score",
                    "Access Vector",
                    "Access Complexity",
                    "Authentication",
                    "Confidentiality Impact",
                    "Integrity Impact",
                    "Availability Impact",
                ],
                removeNull=True,
            )

    cvss_v3s = vulnerability.get("cvss_v3s", [])
    if cvss_v3s:
        cvss_data = []
        for cvss in cvss_v3s:
            cvss_data.append(
                {
                    "Score": cvss.get("score", EMPTY_DATA),
                    "Vector String": cvss.get("vector_string", EMPTY_DATA),
                    "Source": cvss.get("source", EMPTY_DATA),
                    "Version": cvss.get("version", EMPTY_DATA),
                    "Updated At": cvss.get("updated_at", EMPTY_DATA),
                    "Generated At": cvss.get("generated_at", EMPTY_DATA),
                    "CVE ID": cvss.get("cve_id", EMPTY_DATA),
                    "Temporal Score": cvss.get("temporal_score", EMPTY_DATA),
                    "Calculated CVSS Base Score": cvss.get("calculated_cvss_base_score", EMPTY_DATA),
                    "Attack Vector": cvss.get("attack_vector", EMPTY_DATA),
                    "Attack Complexity": cvss.get("attack_complexity", EMPTY_DATA),
                    "Privileges Required": cvss.get("privileges_required", EMPTY_DATA),
                    "User Interaction": cvss.get("user_interaction", EMPTY_DATA),
                    "Scope": cvss.get("scope", EMPTY_DATA),
                    "Confidentiality Impact": cvss.get("confidentiality_impact", EMPTY_DATA),
                    "Integrity Impact": cvss.get("integrity_impact", EMPTY_DATA),
                    "Availability Impact": cvss.get("availability_impact", EMPTY_DATA),
                    "Remediation Level": cvss.get("remediation_level", EMPTY_DATA),
                    "Report Confidence": cvss.get("report_confidence", EMPTY_DATA),
                    "Exploit Code Maturity": cvss.get("exploit_code_maturity", EMPTY_DATA),
                }
            )
        if cvss_data:
            hr += "\n" + tableToMarkdown(
                "CVSS v3 Scores",
                cvss_data,
                headers=[
                    "Score",
                    "Vector String",
                    "Source",
                    "Version",
                    "Updated At",
                    "Generated At",
                    "CVE ID",
                    "Temporal Score",
                    "Calculated CVSS Base Score",
                    "Attack Vector",
                    "Attack Complexity",
                    "Privileges Required",
                    "User Interaction",
                    "Scope",
                    "Confidentiality Impact",
                    "Integrity Impact",
                    "Availability Impact",
                    "Remediation Level",
                    "Report Confidence",
                    "Exploit Code Maturity",
                ],
                removeNull=True,
            )

    cvss_v4s = vulnerability.get("cvss_v4s", [])
    if cvss_v4s:
        cvss_v4s_data = []
        for cvss_v4 in cvss_v4s:
            cvss_v4s_data.append(
                {
                    "Score": cvss_v4.get("score", EMPTY_DATA),
                    "Vector String": cvss_v4.get("vector_string", EMPTY_DATA),
                    "Threat Score": cvss_v4.get("threat_score", EMPTY_DATA),
                    "Source": cvss_v4.get("source", EMPTY_DATA),
                    "Version": cvss_v4.get("version", EMPTY_DATA),
                    "Generated At": cvss_v4.get("generated_at", EMPTY_DATA),
                    "Updated At": cvss_v4.get("updated_at", EMPTY_DATA),
                    "CVE ID": cvss_v4.get("cve_id", EMPTY_DATA),
                    "Attack Vector": cvss_v4.get("attack_vector", EMPTY_DATA),
                    "Attack Complexity": cvss_v4.get("attack_complexity", EMPTY_DATA),
                    "Attack Requirements": cvss_v4.get("attack_requirements", EMPTY_DATA),
                    "Privileges Required": cvss_v4.get("privileges_required", EMPTY_DATA),
                    "User Interaction": cvss_v4.get("user_interaction", EMPTY_DATA),
                    "Exploit Maturity": cvss_v4.get("exploit_maturity", EMPTY_DATA),
                    "Vulnerable System Confidentiality Impact": cvss_v4.get(
                        "vulnerable_system_confidentiality_impact", EMPTY_DATA
                    ),
                    "Vulnerable System Integrity Impact": cvss_v4.get("vulnerable_system_integrity_impact", EMPTY_DATA),
                    "Vulnerable System Availability Impact": cvss_v4.get("vulnerable_system_availability_impact", EMPTY_DATA),
                    "Subsequent System Confidentiality Impact": cvss_v4.get(
                        "subsequent_system_confidentiality_impact", EMPTY_DATA
                    ),
                    "Subsequent System Integrity Impact": cvss_v4.get("subsequent_system_integrity_impact", EMPTY_DATA),
                    "Subsequent System Availability Impact": cvss_v4.get("subsequent_system_availability_impact", EMPTY_DATA),
                }
            )
        if cvss_v4s_data:
            hr += "\n" + tableToMarkdown(
                "CVSS v4 Score",
                cvss_v4s_data,
                headers=[
                    "Score",
                    "Vector String",
                    "Threat Score",
                    "Source",
                    "Version",
                    "Generated At",
                    "Updated At",
                    "CVE ID",
                    "Attack Vector",
                    "Attack Complexity",
                    "Attack Requirements",
                    "Privileges Required",
                    "User Interaction",
                    "Exploit Maturity",
                    "Vulnerable System Confidentiality Impact",
                    "Vulnerable System Integrity Impact",
                    "Vulnerable System Availability Impact",
                    "Subsequent System Confidentiality Impact",
                    "Subsequent System Integrity Impact",
                    "Subsequent System Availability Impact",
                ],
                removeNull=True,
            )

    products = vulnerability.get("products", [])
    if products:
        product_data = []
        for product in products:
            product_data.append(
                {
                    "Product ID": product.get("id", EMPTY_DATA),
                    "Product": product.get("name", EMPTY_DATA),
                    "Vendor ID": product.get("vendor_id", EMPTY_DATA),
                    "Vendor": product.get("vendor", EMPTY_DATA),
                    "Versions": product.get("versions", EMPTY_DATA),
                }
            )
        if product_data:
            hr += "\n" + tableToMarkdown(
                "Affected Products",
                product_data,
                headers=["Product ID", "Product", "Vendor ID", "Vendor", "Versions"],
                json_transform_mapping={
                    "Versions": JsonTransformer(is_nested=True),
                },
                removeNull=True,
            )

    external_references = vulnerability.get("ext_references", [])
    if external_references:
        external_reference_data = []
        for external_reference in external_references:
            external_reference_data.append(
                {
                    "Value": external_reference.get("value", EMPTY_DATA),
                    "Type": external_reference.get("type", EMPTY_DATA),
                    "URL": external_reference.get("url", EMPTY_DATA),
                    "Description": external_reference.get("description", EMPTY_DATA),
                    "Created At": external_reference.get("created_at", EMPTY_DATA),
                }
            )
        if external_reference_data:
            hr += "\n" + tableToMarkdown(
                "External References",
                external_reference_data,
                headers=["Value", "Type", "URL", "Description", "Created At"],
                url_keys=["URL"],
                removeNull=True,
            )

    cwes = vulnerability.get("cwes", [])
    if cwes:
        cwe_data = []
        for cwe in cwes:
            cwe_data.append(
                {
                    "CWE ID": cwe.get("cwe_id", EMPTY_DATA),
                    "Name": cwe.get("name", EMPTY_DATA),
                    "Source": cwe.get("source", EMPTY_DATA),
                    "CVE IDs": cwe.get("cve_ids", EMPTY_DATA),
                }
            )
        if cwe_data:
            hr += "\n" + tableToMarkdown(
                "CWES",
                cwe_data,
                headers=["CWE ID", "Name", "Source", "CVE IDs"],
                removeNull=True,
            )

    exploits = vulnerability.get("exploits", [])
    if exploits:
        exploit_data = []
        for exploit in exploits:
            exploit_data.append(
                {
                    "Value": exploit.get("value", EMPTY_DATA),
                    "Type": exploit.get("type", EMPTY_DATA),
                }
            )
        if exploit_data:
            hr += "\n" + tableToMarkdown(
                "Exploits",
                exploit_data,
                headers=["Value", "Type"],
                removeNull=True,
            )

    changelog = vulnerability.get("changelog", [])
    if changelog:
        changelog_data = []
        for change in changelog:
            changelog_data.append(
                {
                    "Created At": change.get("created_at", EMPTY_DATA),
                    "Description": change.get("description", EMPTY_DATA),
                }
            )
        if changelog_data:
            hr += "\n" + tableToMarkdown(
                "Changelog",
                changelog_data,
                headers=["Created At", "Description"],
                removeNull=True,
            )

    return hr


def create_cvss_table(cvss_data: dict) -> list:
    """
    Creates a CVSS table for the indicator.

    :type cvss_data: ``dict``
    :param cvss_data: CVSS data.

    :return: CVSS table.
    :rtype: ``list``
    """
    cvss_table_rows = []
    for item in cvss_data:
        cvss_table_rows.append({"metrics": item, "value": cvss_data[item]})

    return cvss_table_rows


def create_vulnerability_indicator(
    vulnerability: dict,
    platform_url: str,
    is_reputation: bool = False,
    create_relationships: bool = False,
) -> list[Common.CVE | Common.CustomIndicator]:
    """
    Creates a Common.CVE or Common.CustomIndicator object from the given vulnerability.

    :param vulnerability: The vulnerability to create the indicator from.
    :type vulnerability: dict

    :param platform_url: The platform URL to use for the indicator.
    :type platform_url: str

    :param is_reputation: Whether the indicator is a reputation.
    :type is_reputation: bool

    :param create_relationships: Whether to create relationships for the indicator.
    :type create_relationships: bool

    :return: The Common.CVE or Common.CustomIndicator object.
    :rtype: list[Common.CVE | Common.CustomIndicator]
    """
    vulnerability_ioc: list[Common.CVE | Common.CustomIndicator] = []
    severity = vulnerability.get("scores", {}).get("severity", DEFAULT_SEVERITY).lower()
    relationships = []

    cvss_score = ""
    cvss_version = ""
    cvss_vector = ""
    cvss_table_rows = []
    cvss_v2s = vulnerability.get("cvss_v2s", [])
    cvss_v3s = vulnerability.get("cvss_v3s", [])
    cvss_v4s = vulnerability.get("cvss_v4s", [])
    if cvss_v4s:
        item = [item for item in cvss_v4s if item.get("source") == "Flashpoint"]
        cvss_v4 = item[0] if item else cvss_v4s[0]
        cvss_score = cvss_v4.get("score", "")
        cvss_version = cvss_v4.get("version", "")
        cvss_vector = cvss_v4.get("vector_string", "")
        cvss_table_rows = create_cvss_table(cvss_v4)
    elif cvss_v3s:
        item = [item for item in cvss_v3s if item.get("source") == "Flashpoint"]
        cvss_v3 = item[0] if item else cvss_v3s[0]
        cvss_score = cvss_v3.get("score", "")
        cvss_version = cvss_v3.get("version", "")
        cvss_vector = cvss_v3.get("vector_string", "")
        cvss_table_rows = create_cvss_table(cvss_v3)
    elif cvss_v2s:
        item = [item for item in cvss_v2s if item.get("source") == "Flashpoint"]
        cvss_v2 = item[0] if item else cvss_v2s[0]
        cvss_score = cvss_v2.get("score", "")
        cvss_version = cvss_v2.get("version", "")
        cvss_vector = cvss_v2.get("vector_string", "")
        cvss_table_rows = create_cvss_table(cvss_v2)

    cpe: list = []
    cve_cpe: list = []
    products = vulnerability.get("products", [])
    for product in products:
        versions = product.get("versions", [])
        for _version in versions:
            cve_cpe.extend(Common.CPE(cpe=cpe.get("name", "")) for cpe in _version.get("cpes", []))
            cpe.extend({"CPE": cpe.get("name", "")} for cpe in _version.get("cpes", []))

    if not is_reputation:
        custom_dbot_score = Common.DBotScore(
            indicator=f"FP-VULN-{vulnerability.get('id')}",
            indicator_type=DBotScoreType.CUSTOM,
            integration_name=VENDOR_NAME,
            score=VULNERABILITY_REPUTATION_SCORE_MAPPING.get(severity, Common.DBotScore.NONE),
            reliability=demisto.params().get("integrationReliability"),
        )

        custom_vulnerability_context = deepcopy(vulnerability)
        custom_vulnerability_context["cvss_details"] = {
            "cvss_score": cvss_score,
            "cvss_version": cvss_version,
            "cvss_vector": cvss_vector,
            "cvss_table": cvss_table_rows,
        }
        custom_vulnerability_context["vulnerable_products"] = cpe
        custom_vulnerability_context["platform_url"] = urljoin(
            platform_url, HR_SUFFIX["VULNERABILITY"].format(vulnerability.get("id", ""))
        )

        if create_relationships:
            relationships = create_relationship_for_cve(f"FP-VULN-{vulnerability.get('id')}", vulnerability.get("cve_ids", []))

        custom_indicator = Common.CustomIndicator(
            value=f"FP-VULN-{vulnerability.get('id')}",
            indicator_type="Flashpoint Vulnerability",
            dbot_score=custom_dbot_score,
            context_prefix="FlashpointVulnerability",
            data=custom_vulnerability_context,
            relationships=relationships,
        )
        vulnerability_ioc.append(custom_indicator)

    if vulnerability.get("cve_ids"):
        for item in vulnerability.get("cve_ids", []):
            dbot_score = Common.DBotScore(
                indicator=item,
                indicator_type=DBotScoreType.CVE,
                integration_name=VENDOR_NAME,
                score=VULNERABILITY_REPUTATION_SCORE_MAPPING.get(severity, Common.DBotScore.NONE),
                reliability=demisto.params().get("integrationReliability"),
            )

            if create_relationships:
                relationships = create_relationship_for_cve(item, vulnerability.get("cve_ids", []))  # type: ignore

            cve_ioc = Common.CVE(
                id=item,
                cvss=cvss_score,
                cvss_version=cvss_version,
                cvss_score=cvss_score,
                cvss_vector=cvss_vector,
                cvss_table=cvss_table_rows,
                description=vulnerability.get("description", ""),
                modified=vulnerability.get("timelines", {}).get("last_modified_at", ""),
                published=vulnerability.get("timelines", {}).get("published_at", ""),
                tags=vulnerability.get("tags", []),
                vulnerable_products=cve_cpe,
                dbot_score=dbot_score,
                relationships=relationships,
            )
            vulnerability_ioc.append(cve_ioc)

    return vulnerability_ioc


def validate_vulnerability_library_and_package_list_args(args: dict, _type: str) -> tuple[dict, str]:
    """
    Validate arguments and build query_params for flashpoint-ignite-vulnerability-library-list
    and flashpoint-ignite-vulnerability-package-list command.

    :param args: Dictionary of command arguments.
    :param _type: Type of the command (library or package).

    :return: Tuple of (query_params, vulnerability_id)
    :rtype: ``tuple[dict, str]``

    :raises: ValueError on invalid arguments
    """
    vulnerability_id = args.get("vulnerability_id")
    from_index = arg_to_number(args.get("from", DEFAULT_FROM_VALUE), arg_name="from")
    sort_order = args.get("sort_order", DEFAULT_SORT_ORDER)
    sort_by = args.get("sort_by", DEFAULT_SORT_VALUE)
    ids = argToList(args.get(f"{_type}_ids"))
    name = args.get(f"{_type}_name")
    query = args.get("query")
    size = arg_to_number(args.get("size", DEFAULT_LIMIT), arg_name="size")

    if not vulnerability_id:
        raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("vulnerability_id"))

    if size is not None and (size < 1 or size > MAX_PAGE_SIZE):
        raise ValueError(MESSAGES["SIZE_ERROR"].format(size, MAX_PAGE_SIZE))

    if sort_by:
        sort_value = sort_by.lower()
        if sort_value not in LIBRARY_AND_PACKAGE_SORT_VALUES:
            raise ValueError(
                MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(sort_value, "sort_by", LIBRARY_AND_PACKAGE_SORT_VALUES)
            )

    if sort_order and sort_order.lower() not in SORT_ORDER_VALUES:
        raise ValueError(MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format(sort_order, "sort_order", SORT_ORDER_VALUES))

    if from_index is not None and (from_index < 0):
        raise ValueError(MESSAGES["INVALID_FROM_PROVIDED"].format(from_index))

    valid_ids = []
    invalid_ids = []

    if ids:
        valid_ids = [id_str for id_str in ids if id_str.isdigit()]
        invalid_ids = [id_str for id_str in ids if not id_str.isdigit()]

        if invalid_ids:
            return_warning(MESSAGES["INVALID_INTEGER_IDS"].format(_type, ", ".join(invalid_ids)))

    sort_value = None
    if sort_by:
        sort_value = f"{sort_by.lower()}:desc" if sort_order and sort_order.lower() == "desc" else sort_by.lower()

    # Build query_params
    query_params = assign_params(
        **{"from": from_index},
        size=size,
        sort=sort_value,
        ids=",".join(valid_ids) if valid_ids else None,
        name=name,
        query=query,
    )

    return query_params, vulnerability_id


def validate_vendor_and_product_list_args(args: dict, _type: str) -> dict:
    """
    Validate and parse arguments for the vendor list and product list commands.

    :param args: Demisto args
    :param _type: Entity type - "vendor" or "product"
    :return: Validated and processed parameters dict
    """

    from_index = arg_to_number(args.get("from", DEFAULT_FROM_VALUE), arg_name="from")
    ids = argToList(args.get(f"{_type}_ids"))
    name = args.get(f"{_type}_name")
    size = arg_to_number(args.get("size", DEFAULT_LIMIT), arg_name="size")
    updated_after = arg_to_datetime(args.get("updated_after"))
    updated_before = arg_to_datetime(args.get("updated_before"))

    if from_index is not None and (from_index < 0):
        raise ValueError(MESSAGES["INVALID_FROM_PROVIDED"].format(from_index))

    if size is not None and (size < 1 or size > MAX_PAGE_SIZE):
        raise ValueError(MESSAGES["SIZE_ERROR"].format(size, MAX_PAGE_SIZE))

    valid_ids = []
    invalid_ids = []

    if ids:
        valid_ids = [id_str for id_str in ids if id_str.isdigit()]
        invalid_ids = [id_str for id_str in ids if not id_str.isdigit()]

        if invalid_ids:
            return_warning(MESSAGES["INVALID_INTEGER_IDS"].format(_type, ", ".join(invalid_ids)))

    vendor_ids_raw = argToList(args.get("vendor_ids")) if _type == "product" else []
    valid_vendor_ids = []
    invalid_vendor_ids = []
    if vendor_ids_raw:
        valid_vendor_ids = [v for v in vendor_ids_raw if v.isdigit()]
        invalid_vendor_ids = [v for v in vendor_ids_raw if not v.isdigit()]
        if invalid_vendor_ids:
            return_warning(MESSAGES["INVALID_INTEGER_IDS"].format("vendor", ", ".join(invalid_vendor_ids)))

    # Build query_params
    query_params = assign_params(
        **{"from": from_index},
        size=size,
        ids=",".join(valid_ids),
        name=name,
        vendor_ids=",".join(valid_vendor_ids),
        updated_after=updated_after.strftime(DATE_FORMAT) if updated_after else None,  # type: ignore
        updated_before=updated_before.strftime(DATE_FORMAT) if updated_before else None,  # type: ignore
    )

    if updated_after and updated_before and updated_after >= updated_before:
        raise ValueError(
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "updated_after", "updated_before", query_params["updated_after"], query_params["updated_before"]
            )
        )

    remove_nulls_from_dictionary(query_params)

    return query_params


def prepare_hr_for_vendors(vendors: list[dict], platform_url: str) -> str:
    """
    Prepare human readable format for vendors.

    :param vendors: List of vendors
    :param platform_url: Platform URL for generating clickable links.

    :return: Human readable format of vendors
    """
    vendor_data = []
    for vendor in vendors:
        vendor_id = vendor.get("id", "")
        data = {
            "ID": f"[{vendor_id}]({urljoin(platform_url, HR_SUFFIX['VENDOR'].format(vendor_id))})",
            "Name": vendor.get("name", ""),
        }
        vendor_data.append(data)

    headers = ["ID", "Name"]

    return tableToMarkdown(
        name="Vendor List",
        t=vendor_data,
        headers=headers,
        removeNull=True,
    )


def prepare_hr_for_products(products: list, platform_url: str) -> str:
    """
    Prepare human readable format for products.

    :param products: List of products
    :param platform_url: Platform URL for generating clickable links.

    :return: Human readable format of products
    """
    product_data = []
    for product in products:
        vendor = product.get("vendor") or {}
        product_id = product.get("id", "")
        data = {
            "Product ID": f"[{product_id}]({urljoin(platform_url, HR_SUFFIX['PRODUCT'].format(product_id))})",
            "Product Name": product.get("name", ""),
            "Vendor ID": vendor.get("id", ""),
            "Vendor Name": vendor.get("name", ""),
        }
        product_data.append(data)

    headers = [
        "Product ID",
        "Product Name",
        "Vendor ID",
        "Vendor Name",
    ]

    return tableToMarkdown(
        name="Product List",
        t=product_data,
        headers=headers,
        removeNull=True,
    )


def prepare_hr_for_vulnerability_libraries(libraries: list[dict]) -> str:
    """
    Prepare human readable format for vulnerability libraries.

    :param libraries: List of vulnerability libraries

    :return: Human readable format of vulnerability libraries
    """
    hr = []
    for library in libraries:
        data = {
            "ID": library.get("id", ""),
            "Name": library.get("name", ""),
            "Version": library.get("version", ""),
            "Type": library.get("type", ""),
            "Namespace": library.get("namespace", ""),
            "Package URL": library.get("constructed_purl", ""),
            "Affected": library.get("affected", ""),
        }
        hr.append(data)

    return tableToMarkdown(
        "Vulnerability Libraries",
        hr,
        [
            "ID",
            "Name",
            "Version",
            "Type",
            "Namespace",
            "Package URL",
            "Affected",
        ],
        removeNull=True,
    )


def prepare_hr_for_vulnerability_packages(packages: list[dict]) -> str:
    """
    Prepare human readable format for vulnerability packages.

    :param packages: List of package records.

    :return: Markdown string.
    """
    hr_data = []
    for pkg in packages:
        hr_data.append(
            {
                "ID": pkg.get("id"),
                "Package": pkg.get("name"),
                "Version": pkg.get("version"),
                "Filename": pkg.get("filename"),
                "OS": pkg.get("os"),
                "OS Version": pkg.get("os_version"),
                "OS Architecture": pkg.get("os_arch"),
                "Package URL": pkg.get("purl"),
                "Affected": pkg.get("affected"),
            }
        )

    return tableToMarkdown(
        "Vulnerability Packages",
        hr_data,
        headers=["ID", "Package", "Version", "Filename", "OS", "OS Version", "OS Architecture", "Package URL", "Affected"],
        removeNull=True,
    )


def validate_cve_values(cve_ids: list[str]) -> tuple[list[str], list[str]]:
    """
    Validate CVE format and return valid/invalid CVE lists.

    Args:
        cve_ids: List of CVE identifiers to validate

    Returns:
        Tuple of (valid_cves, invalid_cves)
    """

    valid_cves = []
    invalid_cves = []

    cve_pattern = re.compile(r"^CVE-\d{4}-\d{4,}$", re.IGNORECASE)

    for cve_id in cve_ids:
        normalized_cve = cve_id.upper().strip()
        if cve_pattern.match(normalized_cve):
            valid_cves.append(normalized_cve)
        else:
            invalid_cves.append(cve_id)

    return valid_cves, invalid_cves


def create_relationship_for_cve(entity_a: str, entity_b_data: list) -> list:
    """
    Create a list of relationships objects from the tags.

    :param entity_a: the entity a of the relation which is the current indicator.
    :param entity_b_data: list of entity_b_data returned from the API.

    :return: list of EntityRelationship objects containing all the relationships.
    """
    relationships = []
    for entity_b in entity_b_data:
        if "FP-VULN-" in entity_a:
            entity_a_type = "Flashpoint Vulnerability"
        else:
            entity_a_type = FeedIndicatorType.CVE

        if entity_b:
            obj = EntityRelationship(
                name=EntityRelationship.Relationships.RELATED_TO,
                entity_a=entity_a,
                entity_a_type=entity_a_type,
                entity_b=entity_b,
                entity_b_type=FeedIndicatorType.CVE,
            )
            relationships.append(obj)

    return relationships


""" COMMAND FUNCTIONS """


def test_module(client: Client) -> str:
    """
    Test the Ignite instance configuration.

    :param: client: Object of Client class.
    :return: str
    """
    params = demisto.params()
    is_fetch = params.get("isFetch")
    if is_fetch:
        fetch_incidents(client, {}, params, is_test=True)
    else:
        client.http_request(method="GET", url_suffix=URL_SUFFIX["LIST_INDICATORS"], params={"size": 1})

    return "ok"


def fetch_incidents(client: Client, last_run: dict, params: dict, is_test: bool = False) -> tuple[dict, list]:
    """
    Fetch incidents from Flashpoint.

    :param client: Client object
    :param last_run: Last run returned by function demisto.getLastRun
    :param params: Dictionary of parameters
    :param is_test:to test test-module using is_test value.
    :return: Tuple of dictionary of next run and list of fetched incidents
    """
    fetch_params = validate_fetch_incidents_params(params, last_run)
    fetch_type = fetch_params["fetch_type"]

    url_suffix = ""
    if fetch_type == DEFAULT_FETCH_TYPE:
        url_suffix = URL_SUFFIX["COMPROMISED_CREDENTIALS"]
    elif fetch_type == "Alerts":
        url_suffix = URL_SUFFIX["ALERTS"]

    response = client.http_request("GET", url_suffix=url_suffix, params=fetch_params["fetch_params"])

    incidents: list[dict[str, Any]] = []
    next_run = last_run
    start_time = fetch_params["start_time"]

    if fetch_type == DEFAULT_FETCH_TYPE:
        next_run, incidents = prepare_incidents_from_compromised_credentials_data(response, next_run, start_time, is_test)

    elif fetch_type == "Alerts":
        if is_test:
            return {}, []
        next_run, incidents = prepare_incidents_from_alerts_data(
            response, last_run, fetch_params["fetch_params"], client.platform_url
        )

    demisto.info(f"Fetched {len(incidents)} incidents for {fetch_type}")
    return next_run, incidents


def email_lookup_command(client: Client, email: str) -> CommandResults:
    """
    Lookup a particular email address or subject.

    :param client: object of client class
    :param email: email address or subject
    :return: command output
    """
    query = (
        r'+type:("email-dst", "email-src", "email-src-display-name", "email-subject", "email") +value.\*.keyword:"' + email + '"'
    )
    demisto.debug(get_url_suffix(query))
    resp = client.http_request("GET", url_suffix=get_url_suffix(query))

    if isinstance(resp, list):
        indicators = deepcopy(resp)
    else:
        indicators = []

    if len(indicators) > 0:
        hr = HR_TITLE.format("Email") + email + "\n"
        hr += REPUTATION_MALICIOUS

        events_details = parse_indicator_response(indicators)

        hr += tableToMarkdown(TABLE_TITLE, events_details["events"], [DATE_OBSERVED, "Name", "Tags"])

        fp_link = urljoin(client.platform_url, HR_SUFFIX["IOC_EMAIL"].format(urllib.parse.quote(email.encode("utf-8"))))
        hr += ALL_DETAILS_LINK.format(fp_link, fp_link)

        dbot_score = Common.DBotScore(
            indicator=email,
            indicator_type=DBotScoreType.EMAIL,
            integration_name=VENDOR_NAME,
            score=MALICIOUS_REPUTATION_SCORE,
            reliability=demisto.params().get("integrationReliability"),
        )
        dbot_score.integration_name = VENDOR_NAME

        email_ioc = Common.EMAIL(address=email, dbot_score=dbot_score, description=MALICIOUS_DESCRIPTION.strip())

        ignite_email_context = []
        for indicator in resp:
            indicator = indicator.get("Attribute", {})
            event = {
                "Email": email,
                "EventDetails": indicator.get("Event", ""),
                "Category": indicator.get("category", ""),
                "Fpid": indicator.get("fpid", ""),
                "Href": indicator.get("href", ""),
                "Timestamp": indicator.get("timestamp", ""),
                "Type": indicator.get("type", ""),
                "Uuid": indicator.get("uuid", ""),
                "Comment": indicator["value"].get("comment", ""),
            }
            ignite_email_context.append(event)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["EMAIL"],
            outputs_key_field=OUTPUT_KEY_FIELD["FPID"],
            outputs=remove_empty_elements(ignite_email_context),
            readable_output=hr,
            indicator=email_ioc,
            raw_response=resp,
        )

    hr = HR_TITLE.format("Email") + email + "\n"
    hr += REPUTATION_UNKNOWN
    dbot_score = Common.DBotScore(
        indicator=email,
        indicator_type=DBotScoreType.EMAIL,
        integration_name=VENDOR_NAME,
        score=UNKNOWN_REPUTATION_SCORE,
        reliability=demisto.params().get("integrationReliability"),
    )
    dbot_score.integration_name = VENDOR_NAME

    email_ioc = Common.EMAIL(address=email, dbot_score=dbot_score, description=UNKONWN_DESCRIPTION.strip())
    return CommandResults(
        indicator=email_ioc,
        readable_output=hr,
        raw_response=resp,
    )


def filename_lookup_command(client: Client, filename: str) -> CommandResults:
    """
    Lookup a particular filename.

    :param client: object of client class
    :param filename: filename
    :return: command output
    """
    query = r'+type:("filename") +value.\*.keyword:"' + filename.replace("\\", "\\\\") + '"'
    resp = client.http_request("GET", url_suffix=get_url_suffix(query))

    if isinstance(resp, list):
        indicators = deepcopy(resp)
    else:
        indicators = []

    if len(indicators) > 0:
        hr = HR_TITLE.format("Filename") + filename + "\n"
        hr += REPUTATION_MALICIOUS

        events_details = parse_indicator_response(indicators)

        hr += tableToMarkdown(TABLE_TITLE, events_details["events"], [DATE_OBSERVED, "Name", "Tags"])

        fp_link = urljoin(
            client.platform_url,
            HR_SUFFIX["IOC_FILENAME"].format(urllib.parse.quote(filename.replace("\\", "\\\\").encode("utf-8"))),
        )
        hr += ALL_DETAILS_LINK.format(fp_link, fp_link)

        filename_context = {"Name": filename, "Malicious": {"Vendor": VENDOR_NAME, "Description": MALICIOUS_DESCRIPTION}}

        dbot_context = {
            "Indicator": filename,
            "Type": "filename",
            "Vendor": VENDOR_NAME,
            "Score": MALICIOUS_REPUTATION_SCORE,
            "Reliability": demisto.params().get("integrationReliability"),
        }

        ignite_filename_context = []
        for indicator in resp:
            indicator = indicator.get("Attribute", {})
            event = {
                "Filename": filename,
                "Category": indicator.get("category", ""),
                "Fpid": indicator.get("fpid", ""),
                "Href": indicator.get("href", ""),
                "Timestamp": indicator.get("timestamp", ""),
                "Type": indicator.get("type"),
                "Uuid": indicator.get("uuid", ""),
                "EventDetails": indicator.get("Event", []),
                "Comment": indicator["value"].get("comment", ""),
            }
            ignite_filename_context.append(event)

        ec = {
            "DBotScore": dbot_context,
            "Filename(val.Name == obj.Name)": filename_context,
            IGNITE_PATHS["Filename"]: ignite_filename_context,
        }

        return CommandResults(
            outputs=remove_empty_elements(ec),
            readable_output=hr,
            raw_response=resp,
        )

    hr = HR_TITLE.format("Filename") + filename + "\n"
    hr += REPUTATION_UNKNOWN
    ec = {
        "DBotScore": {
            "Indicator": filename,
            "Type": "filename",
            "Vendor": VENDOR_NAME,
            "Score": UNKNOWN_REPUTATION_SCORE,
            "Reliability": demisto.params().get("integrationReliability"),
        },
        "Filename(val.Name == obj.Name)": {"Name": filename, "Description": UNKONWN_DESCRIPTION},
    }

    return CommandResults(
        outputs=remove_empty_elements(ec),
        readable_output=hr,
        raw_response=resp,
    )


def ip_lookup_command(client: Client, ip: str, exact_match: bool = False) -> CommandResults:
    """
    Lookup a particular ip-address.

    This command searches for the ip in Ignite's IOC Dataset. If found, mark it as Malicious.
    If not found, lookup in Community search for matching peer ip. If found, mark it as Suspicious.

    : param client: object of client class
    : param ip: ip-address
    : param exact_match: Whether to perform an exact match. If true, the indicator value is enclosed in quotes.
    : return: command output
    """
    if not is_ip_valid(ip, True):
        raise ValueError(MESSAGES["INVALID_IP_ADDRESS"].format(ip))

    if is_ip_address_internal(ip):
        return CommandResults(readable_output=f"Skipping internal IP: {ip}")

    if is_ipv6_valid(ip):
        response = client.get_indicator(ip, "ipv6", exact_match)
    else:
        response = client.get_indicator(ip, "ipv4", exact_match)
    items = response.get("items", [])

    if items:
        item = items[0]
        reputation = item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f'{HR_TITLE.format("IP Address")}{ip}\nReputation: {reputation.capitalize()}\n\n'
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(item)
        malware_description = item.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        ip_hr_data = {
            "ID": item.get("id", ""),
            "IP": item.get("value", ""),
            "Type": item.get("type", ""),
            "Malware Description": malware_description,
            "Tags": tags,
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": item.get("mitre_attack_ids", []),
            "Created At": arg_to_datetime(item.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("created_at")
            else "",
            "Modified At": arg_to_datetime(item.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(item.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "IP",
            "Type",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            ip_hr_data,
            headers=headers,
            json_transform_mapping={
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = item.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        dbot_score = Common.DBotScore(
            indicator=ip,
            indicator_type=DBotScoreType.IP,
            integration_name=VENDOR_NAME,
            score=REPUTATION_SCORE_MAPPING.get(reputation, DEFAULT_REPUTATION_VALUE),
            malicious_description=MALICIOUS_DESCRIPTION,
            reliability=demisto.params().get("integrationReliability"),
        )
        dbot_score.integration_name = VENDOR_NAME

        relationships = create_relationships_list_v2(client, related_iocs, ip, "ip")
        ip_ioc = Common.IP(ip=ip, dbot_score=dbot_score, relationships=relationships)

        command_results = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["IP"],
            outputs_key_field="id",
            outputs=remove_empty_elements(item),
            readable_output=human_readable,
            indicator=ip_ioc,
            raw_response=response,
            relationships=relationships,
        )

    else:
        # Search for IP in Communities
        json_data = {"query": ip, "size": DEFAULT_REPUTATION_LIMIT}

        community_response = client.http_request("POST", url_suffix=URL_SUFFIX["COMMUNITY_SEARCH"], json_data=json_data)
        indicators = community_response.get("items", [])

        if indicators:
            community_search_link = urljoin(client.platform_url, HR_SUFFIX["COMMUNITY_SEARCH"].format(ip))

            dbot_score = Common.DBotScore(
                indicator=ip,
                indicator_type=DBotScoreType.IP,
                integration_name=VENDOR_NAME,
                score=SUSPICIOUS_REPUTATION_SCORE,
                reliability=demisto.params().get("integrationReliability"),
            )
            dbot_score.integration_name = VENDOR_NAME

            relationships = []

            hr_data = []
            for indicator in indicators:
                relationship = create_relationships_list_for_community_search(client, indicator, ip)
                filter_enrichments = deepcopy(indicator.get("enrichments", {}))
                filter_enrichments.pop("translation", None)
                filter_enrichments.pop("bins", None)
                hr_indicator = {
                    "Author": indicator.get("author", EMPTY_DATA),
                    # type: ignore[union-attr]
                    "Date (UTC)": arg_to_datetime(indicator.get("date")).strftime(  # type: ignore
                        READABLE_DATE_FORMAT
                    )
                    if indicator.get("date")
                    else "",
                    "First Observed Date (UTC)": arg_to_datetime(indicator.get("first_observed_at")).strftime(  # type: ignore
                        READABLE_DATE_FORMAT
                    )
                    if indicator.get("first_observed_at")
                    else "",
                    "Last Observed Date (UTC)": arg_to_datetime(indicator.get("last_observed_at")).strftime(  # type: ignore
                        READABLE_DATE_FORMAT
                    )
                    if indicator.get("last_observed_at")
                    else "",
                    "Title": indicator.get("title", EMPTY_DATA),
                    "Site": indicator.get("site", EMPTY_DATA),
                    "Enrichments": filter_enrichments,
                }
                relationships += relationship
                hr_data.append(hr_indicator)

            ip_ioc = Common.IP(
                dbot_score=dbot_score, ip=ip, relationships=relationships, description=SUSPICIOUS_DESCRIPTION.strip()
            )

            title = HR_TITLE.format("IP Address") + ip + "\n" + REPUTATION_SUSPICIOUS
            title = title[4:]
            human_readable = tableToMarkdown(
                title, hr_data, json_transform_mapping={"Enrichments": JsonTransformer()}, removeNull=True
            )
            human_readable += f"\nIgnite link to community search: [{community_search_link}]({community_search_link})\n"

            limited_indicators = []
            for indicator in indicators:
                limited_indicator = deepcopy(indicator)

                for enr_key, enr_val in limited_indicator.get("enrichments", {}).items():
                    if isinstance(enr_val, list) and len(enr_val) > client.reputation_enrichments_limit:
                        demisto.debug(
                            f"Community search for IP {ip}: enrichments[{enr_key}] truncated to "
                            f"{client.reputation_enrichments_limit} entries for indicator "
                            f"{limited_indicator.get('id', 'unknown')}. Full data available in raw_response."
                        )
                        limited_indicator["enrichments"][enr_key] = enr_val[: client.reputation_enrichments_limit]

                raw_message = limited_indicator.get("message")
                truncated_message = truncate_message(raw_message, client.message_max_length)
                if truncated_message != raw_message:
                    demisto.debug(
                        f"Community search for IP {ip}: message truncated for indicator "
                        f"{limited_indicator.get('id', 'unknown')}. Full content available in raw_response."
                    )
                    limited_indicator["message"] = truncated_message

                limited_indicators.append(limited_indicator)
            command_results = CommandResults(
                outputs_prefix=OUTPUT_PREFIX["IP_COMMUNITY_SEARCH"],
                outputs_key_field="id",
                outputs=remove_empty_elements(limited_indicators),
                readable_output=human_readable,
                indicator=ip_ioc,
                raw_response=community_response,
                relationships=relationships,
            )

        else:
            human_readable = HR_TITLE.format("IP Address") + ip + "\n"
            human_readable += REPUTATION_UNKNOWN
            dbot_score = Common.DBotScore(
                indicator=ip,
                indicator_type=DBotScoreType.IP,
                integration_name=VENDOR_NAME,
                score=UNKNOWN_REPUTATION_SCORE,
                reliability=demisto.params().get("integrationReliability"),
            )
            dbot_score.integration_name = VENDOR_NAME

            ip_ioc = Common.IP(dbot_score=dbot_score, ip=ip, description=UNKONWN_DESCRIPTION.strip())
            command_results = CommandResults(readable_output=human_readable, indicator=ip_ioc, raw_response=response)

    return command_results


def common_lookup_command(client: Client, indicator_value: str) -> CommandResults:
    """
    Lookup all types of the indicators.

    :param client: object of client class
    :param indicator_value: value of the indicator to lookup
    :return: command output
    """

    try:
        ipaddress.ip_address(indicator_value)
        if is_ipv6_valid(indicator_value):
            response = client.get_indicator(indicator_value, "ipv6")
        else:
            response = client.get_indicator(indicator_value, "ipv4")
    except ValueError:
        params = {"ioc_value": indicator_value, "embed": "all"}
        response = client.http_request("GET", URL_SUFFIX["LIST_INDICATORS"], params=params)

    items = response.get("items", [])

    if items:
        item = items[0]
        indicator_type = item.get("type", "")
        reputation = item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f"{HR_TITLE.format(indicator_type.capitalize())} {indicator_value}\nReputation: {reputation.capitalize()}\n\n"
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(item)
        malware_description = item.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        indicator_hr_data = {
            "ID": item.get("id", ""),
            "Type": indicator_type,
            "Hashes": remove_empty_elements(item.get("hashes", {})),
            "Malware Description": malware_description,
            "Tags": tags,
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": item.get("mitre_attack_ids", []),
            "Created At": arg_to_datetime(item.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("created_at")
            else "",
            "Modified At": arg_to_datetime(item.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(item.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "Type",
            "Hashes",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            indicator_hr_data,
            headers=headers,
            json_transform_mapping={
                "Hashes": JsonTransformer(is_nested=True),
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = item.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        relationships = create_relationships_list_v2(client, related_iocs, indicator_value, indicator_type)

        common_ioc = create_indicator_object(item=item, relationships=relationships)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX.get(indicator_type.upper(), CUSTOM_OUTPUT_PREFIX.format(indicator_type)),
            outputs_key_field="id",
            outputs=remove_empty_elements(item),
            readable_output=human_readable,
            indicator=common_ioc,
            raw_response=response,
            relationships=relationships,
        )

    human_readable = "### Ignite reputation for " + indicator_value + "\n"
    human_readable += REPUTATION_UNKNOWN

    return CommandResults(
        readable_output=human_readable,
        raw_response=response,
    )


def indicator_get_command(client: Client, args: dict) -> CommandResults:
    """
    Lookup all types of the indicators.

    :param client: object of client class
    :param args: demisto args
    :return: command output
    """

    indicator_id = args.get("indicator_id")
    if not indicator_id:
        raise DemistoException(MESSAGES["MISSING_REQUIRED_ARGS"].format("indicator_id"))

    indicator = client.get_indicator_by_id(indicator_id)

    if indicator:
        indicator_value = indicator.get("value", "")
        indicator_type = indicator.get("type", "")
        reputation = indicator.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f"{HR_TITLE.format(indicator_type.capitalize())} {indicator_value}\nReputation: {reputation.capitalize()}\n\n"
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(indicator)
        malware_description = indicator.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        indicator_hr_data = {
            "ID": indicator.get("id", ""),
            "Type": indicator_type,
            "Hashes": remove_empty_elements(indicator.get("hashes", {})),
            "Malware Description": malware_description,
            "Tags": indicator.get("historical_tags", []),
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": indicator.get("mitre_attack_ids", []),
            "Reports": indicator.get("reports", []),
            "Created At": arg_to_datetime(indicator.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if indicator.get("created_at")
            else "",
            "Modified At": arg_to_datetime(indicator.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if indicator.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(indicator.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if indicator.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "Type",
            "Hashes",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Reports",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            indicator_hr_data,
            headers=headers,
            json_transform_mapping={
                "Hashes": JsonTransformer(is_nested=True),
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
                "Reports": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = indicator.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        relationships = create_relationships_list_v2(client, related_iocs, indicator_value, indicator_type)

        common_ioc = create_indicator_object(item=indicator, relationships=relationships)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX.get(indicator_type.upper(), CUSTOM_OUTPUT_PREFIX.format(indicator_type)),
            outputs_key_field="id",
            outputs=remove_empty_elements(indicator),
            readable_output=human_readable,
            indicator=common_ioc,
            raw_response=indicator,
            relationships=relationships,
        )

    human_readable = "No indicator found for the given ID."

    return CommandResults(
        readable_output=human_readable,
        raw_response=indicator,
    )


def url_lookup_command(client: Client, url: str, exact_match: bool = False) -> CommandResults:
    """
    Lookup a particular url.

    :param client: object of client class
    :param url: url as indicator
    :param exact_match: Whether to perform an exact match. If true, the indicator value is enclosed in quotes.
    :return: command output
    """
    response = client.get_indicator(url, "url", exact_match)
    items = response.get("items", [])

    if items:
        item = items[0]
        reputation = item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f'{HR_TITLE.format("URL")}{url}\nReputation: {reputation.capitalize()}\n\n'
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(item)
        malware_description = item.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        ip_hr_data = {
            "ID": item.get("id", ""),
            "URL": item.get("value", ""),
            "Malware Description": malware_description,
            "Tags": tags,
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": item.get("mitre_attack_ids", []),
            "Created At": arg_to_datetime(item.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("created_at")
            else "",
            "Modified At": arg_to_datetime(item.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(item.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "URL",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            ip_hr_data,
            headers=headers,
            json_transform_mapping={
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = item.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        dbot_score = Common.DBotScore(
            indicator=url,
            indicator_type=DBotScoreType.URL,
            integration_name=VENDOR_NAME,
            score=REPUTATION_SCORE_MAPPING.get(reputation, DEFAULT_REPUTATION_VALUE),
            malicious_description=MALICIOUS_DESCRIPTION,
            reliability=demisto.params().get("integrationReliability"),
        )
        dbot_score.integration_name = VENDOR_NAME

        relationships = create_relationships_list_v2(client, related_iocs, url, "url")
        url_ioc = Common.URL(url=url, dbot_score=dbot_score, relationships=relationships)

        command_results = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["URL"],
            outputs_key_field="id",
            outputs=remove_empty_elements(item),
            readable_output=human_readable,
            indicator=url_ioc,
            raw_response=response,
            relationships=relationships,
        )
        return command_results

    hr = HR_TITLE.format("URL") + url + "\n"
    hr += REPUTATION_UNKNOWN
    dbot_score = Common.DBotScore(
        indicator=url,
        indicator_type=DBotScoreType.URL,
        integration_name=VENDOR_NAME,
        score=UNKNOWN_REPUTATION_SCORE,
        reliability=demisto.params().get("integrationReliability"),
    )
    dbot_score.integration_name = VENDOR_NAME

    url_ioc = Common.URL(url=url, dbot_score=dbot_score, description=UNKONWN_DESCRIPTION.strip())
    command_results = CommandResults(
        indicator=url_ioc,
        readable_output=hr,
        raw_response=response,
    )

    return command_results


def domain_lookup_command(client: Client, domain: str, exact_match: bool = False) -> CommandResults:
    """
    Lookup a particular domain.

    :param client: object of client class
    :param domain: domain
    :param exact_match: Whether to perform an exact match. If true, the indicator value is enclosed in quotes.
    :return: command output
    """

    response = client.get_indicator(domain, "domain", exact_match)
    items = response.get("items", [])

    if items:
        item = items[0]
        reputation = item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f'{HR_TITLE.format("Domain")}{domain}\nReputation: {reputation.capitalize()}\n\n'
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(item)
        malware_description = item.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        domain_hr_data = {
            "ID": item.get("id", ""),
            "Domain": item.get("value", ""),
            "Malware Description": malware_description,
            "Tags": tags,
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": item.get("mitre_attack_ids", []),
            "Created At": arg_to_datetime(item.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("created_at")
            else "",
            "Modified At": arg_to_datetime(item.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(item.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "Domain",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            domain_hr_data,
            headers=headers,
            json_transform_mapping={
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = item.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        dbot_score = Common.DBotScore(
            indicator=domain,
            indicator_type=DBotScoreType.DOMAIN,
            integration_name=VENDOR_NAME,
            score=REPUTATION_SCORE_MAPPING.get(reputation, DEFAULT_REPUTATION_VALUE),
            malicious_description=MALICIOUS_DESCRIPTION,
            reliability=demisto.params().get("integrationReliability"),
        )
        dbot_score.integration_name = VENDOR_NAME

        relationships = create_relationships_list_v2(client, related_iocs, domain, "domain")
        domain_ioc = Common.Domain(domain=domain, dbot_score=dbot_score, relationships=relationships)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["DOMAIN"],
            outputs_key_field="id",
            outputs=remove_empty_elements(item),
            readable_output=human_readable,
            indicator=domain_ioc,
            raw_response=response,
            relationships=relationships,
        )

    human_readable = HR_TITLE.format("Domain") + domain + "\n"
    human_readable += REPUTATION_UNKNOWN
    dbot_score = Common.DBotScore(
        indicator=domain,
        indicator_type=DBotScoreType.DOMAIN,
        integration_name=VENDOR_NAME,
        score=UNKNOWN_REPUTATION_SCORE,
        reliability=demisto.params().get("integrationReliability"),
    )
    dbot_score.integration_name = VENDOR_NAME

    domain_ioc = Common.Domain(domain=domain, dbot_score=dbot_score, description=UNKONWN_DESCRIPTION.strip())

    return CommandResults(indicator=domain_ioc, readable_output=human_readable, raw_response=response)


def file_lookup_command(client: Client, file: str, exact_match: bool = False) -> CommandResults:
    """
    Lookup a particular file hash.

    :param client: object of client class
    :param file: file as indicator
    :param exact_match: Whether to perform an exact match. If true, the indicator value is enclosed in quotes.
    :return: command output
    """

    response = client.get_indicator(file, "file", exact_match)
    items = response.get("items", [])

    if items:
        item = items[0]
        reputation = item.get("score", {}).get("value", DEFAULT_REPUTATION_VALUE)
        reputation = DEFAULT_REPUTATION_VALUE if reputation == "no_score" else reputation
        title = f'{HR_TITLE.format("File")}{file}\nReputation: {reputation.capitalize()}\n\n'
        title = title[4:]

        related_iocs, tags = get_related_iocs_and_tags(item)
        hash_type = get_hash_type(file)
        malware_description = item.get("malware_description", "")
        if not malware_description or malware_description == "N/A":
            malware_description = ""
        else:
            malware_description = html_to_text(malware_description)

        file_hr_data = {
            "ID": item.get("id", ""),
            "Hash Type": hash_type,
            "Hashes": remove_empty_elements(item.get("hashes", {})),
            "Malware Description": malware_description,
            "Tags": tags,
            "Related IOCs": related_iocs,
            "Mitre Attack IDs": item.get("mitre_attack_ids", []),
            "Created At": arg_to_datetime(item.get("created_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("created_at")
            else "",
            "Modified At": arg_to_datetime(item.get("modified_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("modified_at")
            else "",
            "Last Seen At": arg_to_datetime(item.get("last_seen_at")).strftime(  # type: ignore
                READABLE_DATE_FORMAT
            )
            if item.get("last_seen_at")
            else "",
        }
        headers = [
            "ID",
            "Hash Type",
            "Hashes",
            "Malware Description",
            "Tags",
            "Related IOCs",
            "Mitre Attack IDs",
            "Created At",
            "Modified At",
            "Last Seen At",
        ]

        human_readable = tableToMarkdown(
            title,
            file_hr_data,
            headers=headers,
            json_transform_mapping={
                "Hashes": JsonTransformer(is_nested=True),
                "Related IOCs": JsonTransformer(is_nested=True),
                "Mitre Attack IDs": JsonTransformer(is_nested=True),
            },
            removeNull=True,
        )

        platform_link = item.get("platform_urls", {}).get("ignite", "")
        human_readable += PLATFORM_LINK.format(platform_link, platform_link)

        dbot_score = Common.DBotScore(
            indicator=file,
            indicator_type=DBotScoreType.FILE,
            integration_name=VENDOR_NAME,
            score=REPUTATION_SCORE_MAPPING.get(reputation, DEFAULT_REPUTATION_VALUE),
            malicious_description=MALICIOUS_DESCRIPTION,
            reliability=demisto.params().get("integrationReliability"),
        )
        dbot_score.integration_name = VENDOR_NAME

        hashes = {
            "md5": item.get("hashes", {}).get("md5"),
            "sha1": item.get("hashes", {}).get("sha1"),
            "sha256": item.get("hashes", {}).get("sha256"),
        }
        relationships = create_relationships_list_v2(client, related_iocs, file, "file")
        file_ioc = Common.File(dbot_score=dbot_score, relationships=relationships, **hashes)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["FILE"],
            outputs_key_field="id",
            outputs=remove_empty_elements(item),
            readable_output=human_readable,
            indicator=file_ioc,
            raw_response=response,
            relationships=relationships,
        )

    hr = HR_TITLE.format("File") + file + "\n"
    hr += REPUTATION_UNKNOWN

    dbot_score = Common.DBotScore(
        indicator=file,
        indicator_type=DBotScoreType.FILE,
        integration_name=VENDOR_NAME,
        score=UNKNOWN_REPUTATION_SCORE,
        reliability=demisto.params().get("integrationReliability"),
    )
    dbot_score.integration_name = VENDOR_NAME

    file_ioc = Common.File(name=file, dbot_score=dbot_score, description=UNKONWN_DESCRIPTION.strip())

    return CommandResults(indicator=file_ioc, readable_output=hr, raw_response=response)


def get_reports_command(client, args) -> CommandResults:
    """
    Get reports matching the given search term or query.

    :param client: object of client class
    :param args: demisto args
    :return: command output
    """
    report_search = args.get("report_search")
    if not report_search:
        raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("report_search"))
    params = {"query": urllib.parse.quote(report_search), "limit": DEFAULT_REPORT_LIMIT}

    response = client.http_request(method="GET", url_suffix=URL_SUFFIX["REPORT_SEARCH"], params=params)
    reports = deepcopy(response.get("data", []))
    human_readable = "### Ignite Intelligence reports related to search: " + report_search + "\n"
    report_details: list[Any] = []

    if reports:
        human_readable += "Top 5 reports:\n\n"

        index = 0
        for report in reports:
            title = report.get("title", EMPTY_DATA)
            platform_url = report.get("platform_url", "")
            if isinstance(platform_url, str) and DEFAULT_OLD_PLATFORM_PATH in platform_url:
                platform_url = platform_url.replace(DEFAULT_OLD_PLATFORM_PATH, DEFAULT_PLATFORM_PATH)
            summary = string_escape_markdown(report.get("summary", EMPTY_DATA))
            index += 1
            human_readable += "" + str(index) + f") [{title}]({platform_url})" + "\n"
            if report.get("summary"):
                human_readable += "   Summary: " + str(summary) + "\n\n\n"
            else:
                human_readable += "   Summary: N/A\n\n\n"

            report_detail = {
                "ReportId": report.get("id", EMPTY_DATA),
                "UpdatedAt": report.get("updated_at", ""),
                "PostedAt": report.get("posted_at", ""),
                "NotifiedAt": report.get("notified_at", ""),
                "PlatformUrl": platform_url,
                "Title": title,
                "Summary": summary,
            }
            report_details.append(report_detail)
        report_details = remove_empty_elements(report_details)

        fp_url = urljoin(client.platform_url, "/cti/intelligence/search?sort_date=All Time&query=" + report_search)
        fp_url = urllib.parse.quote(fp_url, safe=":/?&=")
        human_readable += f"Link to Report-search on Ignite platform: [{fp_url}]({fp_url})\n"

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["REPORT"],
            outputs_key_field=OUTPUT_KEY_FIELD["REPORT_ID"],
            outputs=report_details,
            readable_output=human_readable,
            raw_response=response,
        )

    human_readable += "No reports found for the search."
    return CommandResults(readable_output=human_readable, raw_response=response)


def flashpoint_ignite_compromised_credentials_list_command(client: Client, args: dict) -> CommandResults:
    """
    List compromised credentials from Flashpoint Ignite platform.

    :param client: Client object
    :param args: The command arguments
    :return: Standard command result or no records found message.
    """
    args = validate_compromised_credentials_list_args(args)
    response = client.http_request("GET", url_suffix=URL_SUFFIX["COMPROMISED_CREDENTIALS"], params=args)

    hits = deepcopy(response.get("hits", {}).get("hits", []))
    if not hits:
        return CommandResults(
            readable_output=MESSAGES["NO_RECORDS_FOUND"].format("compromised credentials"), raw_response=response
        )

    readable_output = ""

    total_records = response.get("hits", {}).get("total")
    if total_records:
        readable_output += f"#### Total number of records found: {total_records}\n\n"

    readable_output += prepare_hr_for_compromised_credentials(hits)

    outputs = remove_empty_elements(hits)

    return CommandResults(
        outputs_prefix=OUTPUT_PREFIX["COMPROMISED_CREDENTIALS"],
        outputs_key_field=OUTPUT_KEY_FIELD["COMPROMISED_CREDENTIAL_ID"],
        outputs=outputs,
        readable_output=readable_output,
        raw_response=response,
    )


def get_report_by_id_command(client: Client, args: dict) -> CommandResults:
    """
    Get specific report using its fpid.

    :param client: object of client class
    :param args: demisto args
    :return: command output
    """
    report_id = args.get("report_id")
    if not report_id:
        raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("report_id"))

    response = client.http_request(
        method="GET", url_suffix=URL_SUFFIX["GET_REPORT_BY_ID"].format(urllib.parse.quote(str(report_id)))
    )
    report = deepcopy(response)

    human_readable = "### Ignite Intelligence Report details\n"

    if report:
        if report.get("tags") is None:
            raise ValueError(MESSAGES["NO_RECORD_FOUND"])

        timestamp = None
        try:
            time_str = report.get("posted_at", "")[:-10] + "UTC"
            timestamp = time.strptime(time_str, "%Y-%m-%dT%H:%M:%S%Z")
        except (TypeError, ValueError):
            pass

        tags = report.get("tags", [])
        tag_string = ", ".join(tags)

        if timestamp:
            timestamp_str = time.strftime(READABLE_DATE_FORMAT, timestamp)
        else:
            timestamp_str = EMPTY_DATA

        platform_url = report.get("platform_url", "")
        if isinstance(platform_url, str) and DEFAULT_OLD_PLATFORM_PATH in platform_url:
            platform_url = platform_url.replace(DEFAULT_OLD_PLATFORM_PATH, DEFAULT_PLATFORM_PATH)
        report_details = [
            {
                "Title": STRING_FORMAT.format(report.get("title", EMPTY_DATA), platform_url),
                "Date Published (UTC)": timestamp_str,
                "Summary": string_escape_markdown(report.get("summary", EMPTY_DATA)),
                "Tags": tag_string,
            }
        ]

        human_readable += tableToMarkdown(
            "Below are the details found:", report_details, ["Title", "Date Published (UTC)", "Summary", "Tags"]
        )
        human_readable += "\n"
        entry_context = {
            "ReportId": report.get("id", ""),
            "UpdatedAt": report.get("updated_at", ""),
            "PostedAt": report.get("posted_at", ""),
            "NotifiedAt": report.get("notified_at", ""),
            "PlatformUrl": platform_url,
            "Title": report.get("title", ""),
            "Summary": report.get("summary", ""),
            "Tags": tag_string,
        }
        entry_context = remove_empty_elements(entry_context)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["REPORT"],
            outputs_key_field=OUTPUT_KEY_FIELD["REPORT_ID"],
            outputs=entry_context,
            readable_output=human_readable,
            raw_response=response,
        )

    human_readable += "No report found for the given ID."
    return CommandResults(readable_output=human_readable, raw_response=response)


def related_report_list_command(client: Client, args: dict) -> CommandResults:
    """
    Get reports related to given report.

    :param args: demisto args
    :param client: object of client class
    :return: command output
    """
    report_id = args.get("report_id")
    if not report_id:
        raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("report_id"))
    params = {"limit": DEFAULT_REPORT_LIMIT}

    response = client.http_request(
        method="GET", url_suffix=URL_SUFFIX["RELATED_REPORT_LIST"].format(urllib.parse.quote(str(report_id))), params=params
    )
    reports = deepcopy(response.get("data", []))
    human_readable = "### Ignite Intelligence related reports:\n"
    report_details: list[Any] = []

    if reports:
        human_readable += "Top 5 related reports:\n\n"
        index = 0
        for report in reports:
            title = report.get("title", EMPTY_DATA)
            platform_url = report.get("platform_url", "")
            if isinstance(platform_url, str) and DEFAULT_OLD_PLATFORM_PATH in platform_url:
                platform_url = platform_url.replace(DEFAULT_OLD_PLATFORM_PATH, DEFAULT_PLATFORM_PATH)
            summary = string_escape_markdown(report.get("summary", EMPTY_DATA))
            index += 1
            human_readable += "" + str(index) + f") [{title}]({platform_url})" + "\n"
            human_readable += "   Summary: " + str(summary) + "\n\n\n"

            report_detail = {
                "ReportId": report.get("id", EMPTY_DATA),
                "UpdatedAt": report.get("updated_at", ""),
                "PostedAt": report.get("posted_at", ""),
                "NotifiedAt": report.get("notified_at", ""),
                "PlatformUrl": platform_url,
                "Title": title,
                "Summary": summary,
            }
            report_details.append(report_detail)
        report_details = remove_empty_elements(report_details)

        fp_url = urljoin(client.platform_url, HR_SUFFIX["REPORT"].format(urllib.parse.quote(str(report_id))))
        human_readable += f"Link to the given Report on Ignite platform: [{fp_url}]({fp_url})\n"

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["REPORT"],
            outputs_key_field=OUTPUT_KEY_FIELD["REPORT_ID"],
            outputs=report_details,
            readable_output=human_readable,
            raw_response=response,
        )

    human_readable += "No reports found for the search."
    return CommandResults(readable_output=human_readable, raw_response=response)


def event_list_command(client, args) -> CommandResults:
    """
    Get events matching the given parameters.

    :param client: object of client class
    :param args: demisto args
    :return: command output
    """
    limit = arg_to_number(args.get("limit", DEFAULT_LIMIT), "limit")
    report_fpid = args.get("report_fpid")
    attack_ids = args.get("attack_ids")
    time_period = args.get("time_period")
    url_suffix = f'{URL_SUFFIX["EVENT_LIST"]}?sort_timestamp=desc&'
    getvars = {}
    if limit or limit == 0:
        if limit < 1 or limit > MAX_PRODUCT:
            raise DemistoException(MESSAGES["LIMIT_ERROR"].format(limit, MAX_PRODUCT))
        getvars["limit"] = limit

    if report_fpid:
        getvars["report"] = report_fpid

    if attack_ids:
        getvars["attack_ids"] = attack_ids

    if time_period:
        getvars["time_period"] = time_period

    url_suffix = url_suffix + urllib.parse.urlencode(getvars)

    resp = client.http_request("GET", url_suffix=url_suffix)
    indicators = deepcopy(resp)
    hr = ""
    events = []

    if len(indicators) > 0:
        hr += "### Ignite Events\n\n"

        for indicator in indicators:
            href = indicator.get("href", "")
            event = indicator.get("Event", {})
            fpid = indicator.get("fpid", "")
            event = parse_event_response(client, event, fpid, href)
            if indicator.get("malware_description"):
                event["Malware Description"] = indicator.get("malware_description")
            events.append(event)

        hr += tableToMarkdown("Below are the detail found:", events, [TIME_OBSERVED, "Name", "Tags", "Malware Description"])

        fp_link = urljoin(client.platform_url, HR_SUFFIX["IOC_LIST"])
        hr += ALL_DETAILS_LINK.format(fp_link, fp_link)

        # Replacing the dict keys for ec  to strip any white spaces and special characters
        for event in events:
            replace_key(event, "ObservedTime", TIME_OBSERVED)
            replace_key(event, "MalwareDescription", "Malware Description")
            replace_key(event, "Name", "EventName")

        events = remove_empty_elements(events)

        return CommandResults(
            outputs_prefix=OUTPUT_PREFIX["EVENT"],
            outputs_key_field=OUTPUT_KEY_FIELD["EVENT_ID"],
            outputs=events,
            readable_output=hr,
            raw_response=resp,
        )

    hr += MESSAGES["NO_RECORDS_FOUND"].format("events")
    return CommandResults(readable_output=hr, raw_response=resp)


def event_get_command(client, args) -> CommandResults:
    """
    Get specific event using its event id.

    :param client: object of client class
    :param args: demisto args
    :return: command output
    """
    event_id = args.get("event_id")
    if not event_id:
        raise DemistoException(MESSAGES["MISSING_REQUIRED_ARGS"].format("event_id"))
    url_suffix = URL_SUFFIX["EVENT_GET"].format(urllib.parse.quote(event_id.encode("utf-8")))
    resp = client.http_request("GET", url_suffix=url_suffix)

    ec: dict[Any, Any] = {}

    if len(resp) <= 0:
        hr = MESSAGES["NO_RECORDS_FOUND"].format("event")
        return CommandResults(readable_output=hr, raw_response=resp)

    hr = "### Ignite Event details\n"
    indicator = deepcopy(resp[0])
    event = indicator.get("Event", "")
    fpid = indicator.get("fpid", "")
    href = indicator.get("href", "")

    if event:
        event = parse_event_response(client, event, fpid, href)
        if indicator.get("malware_description"):
            event["Malware Description"] = indicator.get("malware_description", "")

        hr += tableToMarkdown("Below are the detail found:", event, [TIME_OBSERVED, "Name", "Tags", "Malware Description"])

        ec = {
            "EventId": event["EventId"],
            "UUID": event["UUID"],
            "Name": event["EventName"],
            "Tags": event["Tags"],
            "ObservedTime": event[TIME_OBSERVED],
            "EventCreatorEmail": event["EventCreatorEmail"],
            "Href": href,
        }
        # if no key `malware_description` is present, it should not be included in context data
        if event.get("Malware Description"):
            ec["MalwareDescription"] = event["Malware Description"]

    ec = remove_empty_elements(ec)

    return CommandResults(
        outputs_prefix=OUTPUT_PREFIX["EVENT"],
        outputs_key_field=OUTPUT_KEY_FIELD["EVENT_ID"],
        outputs=ec,
        readable_output=hr,
        raw_response=resp,
    )


def vulnerability_library_list_command(client: Client, args: dict) -> CommandResults:
    """
    List libraries affected by a particular vulnerability.

    :param client: Client object
    :param args: The command arguments
    :return: Standard command result or no records found message.
    """
    query_params, vulnerability_id = validate_vulnerability_library_and_package_list_args(args, "library")

    response = client.get_vulnerability_libraries(vulnerability_id, query_params)

    libraries = deepcopy(response.get("results", []))
    if not libraries:
        return CommandResults(
            readable_output=MESSAGES["NO_RECORDS_FOUND"].format("vulnerability libraries"),
            raw_response=response,
        )

    readable_output = ""

    total_records = response.get("total")
    if total_records is not None:
        readable_output += f"#### Total number of libraries found: {total_records}\n\n"

    readable_output += prepare_hr_for_vulnerability_libraries(libraries)

    from_index = response.get("from", DEFAULT_FROM_VALUE)
    size = response.get("size", DEFAULT_LIMIT)
    next_index = from_index + size
    if total_records and next_index < total_records:
        readable_output += f"\n{PAGINATION_HR} from = {next_index}, size = {size}\n"

    outputs = remove_empty_elements(libraries)

    return CommandResults(
        outputs_prefix=OUTPUT_PREFIX["VULNERABILITY_LIBRARY"],
        outputs_key_field="id",
        outputs=outputs,
        readable_output=readable_output,
        raw_response=response,
    )


def vulnerability_package_list_command(client: Client, args: dict) -> CommandResults:
    """
    Retrieve a list of packages affected by a particular vulnerability.

    :param client: Client object
    :param args: The command arguments
    :return: Standard command result or no records found message.
    """
    query_params, vulnerability_id = validate_vulnerability_library_and_package_list_args(args, "package")

    response = client.get_vulnerability_packages(vulnerability_id, query_params)

    packages = deepcopy(response.get("results", []))
    if not packages:
        return CommandResults(
            readable_output=MESSAGES["NO_RECORDS_FOUND"].format("vulnerability packages"),
            raw_response=response,
        )

    readable_output = ""
    total_records = response.get("total")
    if total_records is not None:
        readable_output += f"#### Total number of packages found: {total_records}\n\n"

    readable_output += prepare_hr_for_vulnerability_packages(packages)

    from_index = response.get("from", DEFAULT_FROM_VALUE)
    size = response.get("size", DEFAULT_LIMIT)
    next_index = from_index + size
    if total_records and next_index < total_records:
        readable_output += f"\n{PAGINATION_HR} from = {next_index}, size = {size}\n"

    outputs = remove_empty_elements(packages)

    return CommandResults(
        outputs_prefix=OUTPUT_PREFIX["VULNERABILITY_PACKAGE"],
        outputs_key_field="id",
        outputs=outputs,
        readable_output=readable_output,
        raw_response=response,
    )


def alert_list_command(client: Client, args: dict):
    """
    List alerts notification from Flashpoint Ignite.

    :param client: Client object
    :param args: The command arguments
    :return: Standard command result or no records found message.
    """
    params = validate_alert_list_args(args)

    response = client.http_request("GET", url_suffix=URL_SUFFIX["ALERTS"], params=params)

    alerts = deepcopy(response.get("items", []))
    command_results = []

    if alerts:
        human_readable = prepare_hr_for_alerts(alerts, client.platform_url)

        alert_result = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["ALERT"],
            outputs_key_field="id",
            outputs=remove_empty_elements(alerts),
            raw_response=response,
            readable_output=human_readable,
        )
        command_results.append(alert_result)

        _next = response.get("pagination", {}).get("next")
        if _next:
            token_hr = PAGINATION_HR
            parsed_url = urllib.parse.urlparse(_next)
            query_params = urllib.parse.parse_qs(parsed_url.query)

            token_context_keys = ["created_after", "created_before", "size", "cursor"]
            token_context = {key: EMPTY_DATA for key in token_context_keys}

            for query in token_context_keys:
                query_value = query_params.get(query)
                if query_value:
                    token_context[query] = query_value[0]
                    token_hr += "\n" + query + " = " + token_context[query]

            token_context["name"] = "flashpoint-ignite-alert-list"
            token_context = remove_empty_elements(token_context)

            token_result = CommandResults(
                outputs_prefix=OUTPUT_PREFIX["TOKEN"], outputs_key_field="name", outputs=token_context, readable_output=token_hr
            )
            command_results.append(token_result)
    else:
        command_results.append(
            CommandResults(raw_response=response, readable_output=MESSAGES["NO_RECORDS_FOUND"].format("alerts"))
        )

    return command_results


def vulnerability_get_command(client: Client, args: dict) -> list[CommandResults]:
    """
    Get specific vulnerability using its ID.

    :param client: Client object
    :param args: Demisto args
    :return: Command output
    """
    platform_url = client.platform_url
    create_relationships = client.create_relationships
    vulnerability_id = args.get("id")
    if not vulnerability_id:
        raise DemistoException(MESSAGES["MISSING_REQUIRED_ARGS"].format("id"))

    if "FP-VULN-" in vulnerability_id:
        vulnerability_id = vulnerability_id.replace("FP-VULN-", "")

    url_suffix = f"{URL_SUFFIX['VULNERABILITY_GET']}/{vulnerability_id}"
    resp = client.http_request("GET", url_suffix=url_suffix)

    if not resp:
        hr = MESSAGES["NO_RECORDS_FOUND"].format("vulnerability")
        return [CommandResults(readable_output=hr, raw_response=resp)]

    vulnerability = deepcopy(resp)
    hr = prepare_hr_for_vulnerability(vulnerability, platform_url)

    vulnerability = remove_empty_elements(vulnerability)

    vulnerability_ioc = create_vulnerability_indicator(vulnerability, platform_url, create_relationships=create_relationships)

    results = []
    if vulnerability_ioc:
        for ioc in vulnerability_ioc:
            if ioc == vulnerability_ioc[0]:
                results.append(
                    CommandResults(
                        outputs_prefix=OUTPUT_PREFIX["VULNERABILITY"],
                        outputs_key_field=OUTPUT_KEY_FIELD["VULNERABILITY_ID"],
                        outputs=vulnerability,
                        indicator=ioc,
                        readable_output=hr,
                        raw_response=resp,
                    )
                )
            else:
                results.append(
                    CommandResults(
                        readable_output="Created Indicator for " + ioc.id,  # type: ignore
                        indicator=ioc,
                    )
                )

    return results


def vendor_list_command(client: Client, args: dict) -> list:
    """
    Retrieve a list of vendors.

    :param client: Client object
    :param args: Demisto args
    :return: Command output
    """
    query_params = validate_vendor_and_product_list_args(args, "vendor")

    response = client.get_vendors(query_params)

    vendors = deepcopy(response.get("results", []))
    command_results = []

    if vendors:
        human_readable = ""

        total_vendors = response.get("total")
        if total_vendors is not None:
            human_readable += f"#### Total number of vendors found: {total_vendors}\n\n"

        human_readable += prepare_hr_for_vendors(vendors, client.platform_url)

        next_index = query_params.get("size", DEFAULT_LIMIT) + query_params.get("from", DEFAULT_FROM_VALUE)
        if total_vendors and next_index < total_vendors:
            human_readable += f"\n\n{PAGINATION_HR} from = {next_index}, size = {query_params.get('size', DEFAULT_LIMIT)}"

        vendor_result = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["VENDOR"],
            outputs_key_field="id",
            outputs=remove_empty_elements(vendors),
            raw_response=response,
            readable_output=human_readable,
        )
        command_results.append(vendor_result)
    else:
        command_results.append(
            CommandResults(raw_response=response, readable_output=MESSAGES["NO_RECORDS_FOUND"].format("vendors"))
        )

    return command_results


def product_list_command(client: Client, args: dict) -> list:
    """
    Retrieve a list of products.

    :param client: Client object
    :param args: Demisto args
    :return: Command output
    """
    query_params = validate_vendor_and_product_list_args(args, "product")

    response = client.get_products(query_params)

    products = deepcopy(response.get("results", []))
    command_results = []

    if products:
        human_readable = ""

        total_products = response.get("total")
        if total_products is not None:
            human_readable += f"#### Total number of products found: {total_products}\n\n"

        human_readable += prepare_hr_for_products(products, client.platform_url)

        next_index = query_params.get("size", DEFAULT_LIMIT) + query_params.get("from", DEFAULT_FROM_VALUE)
        if total_products and next_index < total_products:
            human_readable += f"\n\n{PAGINATION_HR} from = {next_index}, size = {query_params.get('size', DEFAULT_LIMIT)}"

        product_result = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["PRODUCT"],
            outputs_key_field="id",
            outputs=remove_empty_elements(products),
            raw_response=response,
            readable_output=human_readable,
        )
        command_results.append(product_result)
    else:
        command_results.append(
            CommandResults(raw_response=response, readable_output=MESSAGES["NO_RECORDS_FOUND"].format("products"))
        )

    return command_results


def vulnerability_list_command(client: Client, args: dict) -> list[CommandResults]:
    """
    List vulnerabilities from Flashpoint Ignite.

    :param client: Client object
    :param args: The command arguments
    :return: Standard command result or no records found message.
    """
    query_params, payload = validate_vulnerabilities_args(args)

    response = client.vulnerability_list(query_params, payload)

    vulnerabilities = deepcopy(response.get("results", []))
    command_results = []

    if vulnerabilities:
        human_readable = ""

        total_vulnerabilities = response.get("total")
        if total_vulnerabilities is not None:
            human_readable += f"#### Total number of vulnerabilities found: {total_vulnerabilities}\n\n"

        human_readable += prepare_hr_for_list_vulnerabilities(vulnerabilities, client.platform_url)

        next_index = query_params["size"] + query_params["from"]
        if total_vulnerabilities and next_index < total_vulnerabilities:
            human_readable += f"\n\n{PAGINATION_HR} from = {next_index}, size = {query_params['size']}"

        vulnerability_result = CommandResults(
            outputs_prefix=OUTPUT_PREFIX["VULNERABILITY"],
            outputs_key_field=OUTPUT_KEY_FIELD["VULNERABILITY_ID"],
            outputs=remove_empty_elements(vulnerabilities),
            raw_response=response,
            readable_output=human_readable,
        )
        command_results.append(vulnerability_result)
    else:
        command_results.append(
            CommandResults(raw_response=response, readable_output=MESSAGES["NO_RECORDS_FOUND"].format("vulnerabilities"))
        )

    return command_results


def cve_command(client: Client, args: dict) -> list[CommandResults]:
    """
    Get specific vulnerability using its CVE.

    :param client: Client object
    :param args: Demisto args

    :return: Command output
    """
    cves = argToList(args.get("cve"))
    platform_url = client.platform_url
    create_relationships = client.create_relationships

    if not cves:
        raise DemistoException(MESSAGES["MISSING_REQUIRED_ARGS"].format("cve"))

    valid_cves, invalid_cves = validate_cve_values(cves)

    if invalid_cves:
        return_warning(
            "The following CVEs were found invalid: {}".format(", ".join(invalid_cves)), exit=len(invalid_cves) == len(cves)
        )

    url_suffix = URL_SUFFIX["VULNERABILITY_GET"]
    params = {"cves": ",".join(valid_cves)}
    resp = client.http_request("GET", url_suffix=url_suffix, params=params)
    vulnerabilities = resp.get("results", [])

    if not vulnerabilities:
        hr = MESSAGES["NO_RECORDS_FOUND"].format("cve")
        return [CommandResults(readable_output=hr, raw_response=resp)]

    results = []
    for vulnerability in vulnerabilities:
        hr = prepare_hr_for_vulnerability(vulnerability, platform_url=platform_url, is_reputation=True)
        vulnerability = remove_empty_elements(vulnerability)
        vulnerability_ioc = create_vulnerability_indicator(
            vulnerability,
            platform_url=platform_url,
            is_reputation=True,
            create_relationships=create_relationships,
        )

        if vulnerability_ioc:
            for ioc in vulnerability_ioc:
                if ioc == vulnerability_ioc[0]:
                    results.append(
                        CommandResults(
                            outputs_prefix=OUTPUT_PREFIX["VULNERABILITY"],
                            outputs_key_field=OUTPUT_KEY_FIELD["VULNERABILITY_ID"],
                            outputs=vulnerability,
                            indicator=ioc,
                            readable_output=hr,
                            raw_response=resp,
                        )
                    )
                else:
                    results.append(
                        CommandResults(
                            readable_output="Created Indicator for " + ioc.id,  # type: ignore
                            indicator=ioc,
                        )
                    )

    return results


def main():
    """main function, parses params and runs command functions"""
    params = remove_space_from_args(demisto.params())
    remove_nulls_from_dictionary(params)

    api_key = str(params.get("credentials", {}).get("password", "")).strip()
    url = params.get("url")

    verify = not argToBoolean(params.get("insecure", False))

    create_relationships = argToBoolean(params.get("create_relationships", True))

    reputation_enrichments_limit = (
        arg_to_number(params.get("reputation_enrichments_limit", DEFAULT_REPUTATION_CONTEXT_LIMIT))
        or DEFAULT_REPUTATION_CONTEXT_LIMIT
    )

    message_max_length = arg_to_number(params.get("message_max_length", DEFAULT_MESSAGE_MAX_LENGTH)) or DEFAULT_MESSAGE_MAX_LENGTH

    config_exact_match = argToBoolean(params.get("ioc_enrichment_exact_match", False))

    # if your Client class inherits from BaseClient, system proxy is handled
    # out of the box by it, just pass ``proxy`` to the Client constructor
    proxy = argToBoolean(params.get("proxy", False))

    args = remove_space_from_args(demisto.args())
    remove_nulls_from_dictionary(args)

    command = demisto.command()
    demisto.debug(f"Command being called is {command}.")

    try:
        headers = {
            "Authorization": f"Bearer {api_key}",
            "X-FP-IntegrationPlatform": INTEGRATION_PLATFORM,
            "X-FP-IntegrationPlatformVersion": get_demisto_version_as_str(),
            "X-FP-IntegrationVersion": INTEGRATION_VERSION,
        }
        validate_params(command, params)
        client = Client(url, headers, verify, proxy, create_relationships, reputation_enrichments_limit, message_max_length)

        COMMAND_TO_FUNCTION: dict = {
            "flashpoint-ignite-intelligence-report-search": get_reports_command,
            "flashpoint-ignite-compromised-credentials-list": flashpoint_ignite_compromised_credentials_list_command,
            "flashpoint-ignite-intelligence-report-get": get_report_by_id_command,
            "flashpoint-ignite-intelligence-related-report-list": related_report_list_command,
            "flashpoint-ignite-event-list": event_list_command,
            "flashpoint-ignite-event-get": event_get_command,
            "flashpoint-ignite-alert-list": alert_list_command,
            "flashpoint-ignite-indicator-get": indicator_get_command,
            "flashpoint-ignite-vulnerability-library-list": vulnerability_library_list_command,
            "flashpoint-ignite-vulnerability-package-list": vulnerability_package_list_command,
            "flashpoint-ignite-vulnerability-get": vulnerability_get_command,
            "flashpoint-ignite-vendor-list": vendor_list_command,
            "flashpoint-ignite-product-list": product_list_command,
            "flashpoint-ignite-vulnerability-list": vulnerability_list_command,
            "cve": cve_command,
        }

        REPUTATION_COMMAND_TO_FUNCTION: dict = {
            "email": email_lookup_command,
            "filename": filename_lookup_command,
            "url": url_lookup_command,
            "domain": domain_lookup_command,
            "file": file_lookup_command,
            "ip": ip_lookup_command,
        }

        if command == "test-module":
            # This is the call made when pressing the integration Test button.
            return_results(test_module(client))  # NOSONAR

        elif command == "fetch-incidents":
            last_run = demisto.getLastRun()
            next_run, incidents = fetch_incidents(client, last_run, params, False)
            demisto.setLastRun(next_run)
            demisto.incidents(incidents)

        elif command == "flashpoint-ignite-common-lookup":
            indicator_value = args.get("indicator")
            if not indicator_value:
                raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("indicator"))
            indicator_list = argToList(indicator_value)
            indicator_list = [indicator.strip() for indicator in indicator_list if indicator.strip()]
            results = []
            if not indicator_list:
                raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format("indicator"))
            for indicator in indicator_list:
                results.append(common_lookup_command(client, indicator))
            return_results(results)

        elif REPUTATION_COMMAND_TO_FUNCTION.get(command):
            if not args.get(command):
                raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format(command))
            indicator_list = argToList(args.get(command))
            indicator_list = [indicator.strip() for indicator in indicator_list if indicator.strip()]
            if "exact_match" in args:
                exact_match = argToBoolean(args.get("exact_match"))
            else:
                exact_match = config_exact_match
            results = []
            if not indicator_list:
                raise ValueError(MESSAGES["MISSING_REQUIRED_ARGS"].format(command))
            for indicator in indicator_list:
                arguments = (client, indicator)
                if exact_match and command in ("ip", "domain", "url", "file"):
                    arguments += (exact_match,)  # type: ignore
                results.append(REPUTATION_COMMAND_TO_FUNCTION[command](*arguments))
            return_results(results)

        elif COMMAND_TO_FUNCTION.get(command):
            return_results(COMMAND_TO_FUNCTION[command](client, args))

        else:
            raise NotImplementedError(f"Command {command} is not implemented.")

    except requests.exceptions.ConnectionError as c:
        """ Caused mostly when URL is altered."""
        return_error(f"Failed to execute {command} command. Error: {str(c)}")

    # Log exceptions and return errors
    except Exception as e:
        return_error(f"Failed to execute {command} command.\nError: \n{str(e)}")


if __name__ in ["__main__", "builtin", "builtins"]:
    main()