Ignite

Use the Ignite integration to reduce business risk. Ignite allows users to ingest alerts and compromised credentials as incident alerts and executes commands such as search intelligence report, ip, url, get events, and more.

Data Enrichment & Threat Intelligence · Flashpoint

Details

IDIgnite
ProviderFlashpoint
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.11879924
Supported ModulesAgentix XSIAM

README

Use the Flashpoint Ignite integration to reduce business risk. Ignite allows users to ingest alerts and compromised credentials as incident alerts and executes commands such as search intelligence report, ip, url, get events, and more.
This integration was integrated and tested with API v1 of Ignite.

Auto Extract Indicator

Both incident types Ignite Alert and Flashpoint Compromised Credentials support the auto extraction feature by default. This feature extracts indicators and enriches their reputations using commands and scripts defined for the indicator type (Refer to Indicator extraction (Cortex XSOAR 6.13) or Indicator extraction (Cortex XSOAR 8 Cloud) or Indicator extraction (Cortex XSOAR 8.7 On-prem) for more details).

If you are upgrading from a Flashpoint integration, please refer to the Migration Guide for guidance.

Configure Flashpoint Ignite on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Flashpoint Ignite.
  3. Click Add instance to create and configure a new integration instance.
  4. To fetch Ignite alerts, refer to the section “Configuration for fetching Ignite Alerts as a Cortex XSOAR Incident”.
  5. To fetch Ignite compromised credentials, refer to the section “Configuration for fetching Ignite Compromised Credentials as a Cortex XSOAR Incident”.
Parameter Description Required
Fetch incidents   False
Incidents Fetch Interval   False
Incident type   False
Server URL Server URL to connect to Ignite. True
API Key API key used for secure communication with the Ignite platform. True
Maximum number of incidents per fetch The maximum limit is 200 for alerts and compromised credentials. False
First fetch time Date or relative timestamp to start fetching the incidents from. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.). False
Fetch Type Whether to fetch the Ignite alerts or the compromised credentials. Defaults to “Compromised Credentials” if nothing selected. False
Severity for Incidents Set the default severity for the incidents using this instance. False
Alert Status Filters the incoming alerts with the provided alert status. False
Alert Origin Filters the incoming alerts with the origin of the alert. False
Alert Sources Filters the incoming alerts with the source of the alert. False
Fetch fresh compromised credentials alerts Adds the ‘is_fresh’ flag to compromised credential queries so it only ingests username/password combinations if they haven’t been seen before. False
Fetch compromised credentials alerts having lowercase in password Filters the incoming compromised credentials alerts with passwords having lowercase letters. False
Fetch compromised credentials alerts having uppercase in password Filters the incoming compromised credentials alerts with passwords having uppercase letters. False
Fetch compromised credentials alerts having numbers in password Filters the incoming compromised credentials alerts with passwords having numbers. False
Fetch compromised credentials alerts having symbol in password Filters the incoming compromised credentials alerts with passwords having symbols. False
Fetch compromised credentials alerts having minimum length of password Filters the incoming compromised credentials alerts with passwords has minimum length. False
Source Reliability Reliability of the source providing the intelligence data. False
Enable Exact Match for IOC Enrichment Whether to use exact matching for indicator values by default in enrichment commands (ip, domain, file, and url). This behavior can be overridden for individual commands using the exact_match argument. False
Reputation commands context limit Maximum number of entries stored per reputation command result for both relationships (e.g. related IPs) and enrichments (e.g. domains, emails, CVEs). Lowering this value improves performance and reduces context size, but may omit some details. Raising it preserves more details at the cost of larger context payloads and potential performance degradation. Default is 50. False
Create relationships Create relationships between indicators as part of enrichment. False
Community search message max length The maximum number of characters retained from the message field of a community search result returned by the ip command. Lowering this value reduces context payload size, while raising it preserves more of the original content. False
Trust any certificate (not secure)   False
Use system proxy settings   False
  1. Click Test to validate the URLs, token, and connection.

Configuration for fetching Ignite Alerts as a Cortex XSOAR Incident

  1. Select Fetches incidents.
  2. Under Classifier, select “N/A”.
  3. Under Incident type, select “Ignite Alert”.
  4. Under Mapper (incoming), select “Ignite Alert - Incoming Mapper” for default mapping.
  5. Enter the connection parameters (Server URL, API key).
  6. Under the Fetch Type, select “Alerts”.
  7. Select “Alert Status” based on your requirement to filter the alerts. By default, it will fetch all status of alerts.
  8. Select “Alert Origin” based on your requirement to filter the alerts. By default, it will fetch all origins of alerts.
  9. Select “Alert Sources” based on your requirement to filter the alerts. By default, it will fetch all sources of alerts.
  10. Select “Severity for Incidents” based on your requirement to set the default severity for the incidents. By default, it will set the Unknown severity for all incidents.
  11. Update “First fetch time” and “Max Fetch Count” based on your requirements.

Configuration for fetching Ignite Compromised Credentials as a Cortex XSOAR Incident

  1. Select Fetches incidents.
  2. Under Classifier, select “N/A”.
  3. Under Incident type, select “Flashpoint Compromised Credentials”.
  4. Under Mapper (incoming), select “Flashpoint Compromised Credentials - Incoming Mapper” for default mapping.
  5. Enter the connection parameters (Server URL, API key).
  6. Under the Fetch Type, select “Compromised Credentials”.
  7. Select “Fetch fresh compromised credentials alerts” so that it only ingests username/password combinations if they haven’t been seen before.
  8. Select “Fetch compromised credentials alerts having lowercase in password” so that it filters the incoming compromised credentials alerts with passwords having lowercase letters.
  9. Select “Fetch compromised credentials alerts having uppercase in password” so that it filters the incoming compromised credentials alerts with passwords having uppercase letters.
  10. Select “Fetch compromised credentials alerts having numbers in password” so that it filters the incoming compromised credentials alerts with passwords having numbers.
  11. Select “Fetch compromised credentials alerts having symbol in password” so that it filters the incoming compromised credentials alerts with passwords having symbols.
  12. Select “Fetch compromised credentials alerts having minimum length of password” so that it filters the incoming compromised credentials alerts with passwords has minimum length.
  13. Update “First fetch time” and “Max Fetch Count” based on your requirements.

Troubleshooting

Error: The maximum records to fetch for the given first fetch can not exceed 10,000

  • The maximum number of records that can be fetched using the first fetch time is limited to 10,000 by the API.
  • To resolve this issue, you can reduce the first fetch time to a shorter time period, ensuring that the total number of records fetched during the specified time falls within the 10,000 limit.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

flashpoint-ignite-intelligence-report-search

Search for the Intelligence Reports using a keyword.

Base Command

flashpoint-ignite-intelligence-report-search

Input

Argument Name Description Required
report_search Search report using keyword or text. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.

Command example

!flashpoint-ignite-intelligence-report-search report_search=ChatGpt

Context Example

{
    "Ignite": {
        "Report": [
            {
                "NotifiedAt": "2024-04-17T19:23:51.870+00:00",
                "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000001",
                "PostedAt": "2024-04-17T19:23:51.870+00:00",
                "ReportId": "00000000000000000001",
                "Summary": "This report covers evolving events that impact the advancement of AI technology and highlights notable developments that impact safety for users and organizations.",
                "Title": "Artificial Intelligence Threat Landscape",
                "UpdatedAt": "2024-04-17T19:23:51.870+00:00"
            }
        ]
    }
}

Human Readable Output

Ignite Intelligence reports related to search: ChatGpt

Top 5 reports:

1) Artificial Intelligence Threat Landscape
Summary: This report covers evolving events that impact the advancement of AI technology and highlights notable developments that impact safety for users and organizations.

Link to Report-search on Ignite platform: https://app.flashpoint.io/cti/intelligence/search?query=ChatGpt

flashpoint-ignite-compromised-credentials-list

Retrieves the compromised credentials based on the filter values provided in the command arguments.

Base Command

flashpoint-ignite-compromised-credentials-list

Input

Argument Name Description Required
start_date Filters the data based on the start date of the breach (UTC). Note: Will consider current time as default for end_date if start_date is initialized.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.		 Optional
end_date Filters the data based on the end date of the breach (UTC). Note: Requires start_date along with the given argument.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.		 Optional
filter_date Filters the compromised credential’s breach data by either created or first observed date.
Note: Requires the argument value for at least ‘start_date’ and ‘end_date’. Possible values are: created_at, first_observed_at.		 Optional
page_size The maximum number of result objects to return per page. Note: The maximum value is 1,000. Default is 50. Optional
page_number Specify a page number to retrieve the compromised credentials. Note: The multiplication of page_size and page_number parameters cannot exceed 10,000. Default is 1. Optional
sort_date Sort the compromised credential’s breach data by either created or first observed date. Note: Will consider ascending as default for sort_order if sort_date is initialized. Possible values are: created_at, first_observed_at. Optional
sort_order Specify the order to sort the data in. Note: Requires sort_date along with the given argument. Possible values are: asc, desc. Optional
is_fresh Whether to fetch the fresh compromised credentials or not. Possible values are: true, false. Optional

Context Output

Path Type Description
Ignite.CompromisedCredential._id String ID of the IoC.
Ignite.CompromisedCredential._source.affected_domain String Affected domain of the IoC.
Ignite.CompromisedCredential._source.basetypes Unknown The array contains the underlying type of the credentials object, in this case [“credential-sighting”].
Ignite.CompromisedCredential._source.body.raw String This is the raw content captured from the breach Flashpoint discovered.
Ignite.CompromisedCredential._source.breach._header String This is the breach header object.
Ignite.CompromisedCredential._source.breach.basetypes Unknown Array containing the underlying base type of the breach object, i.e., [“breach”].
Ignite.CompromisedCredential._source.breach.breach_type String Constant for future use.
Ignite.CompromisedCredential._source.breach.created_at.date-time Date The datetime when the source breach was created, formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.breach.created_at.timestamp Number The UNIX timestamp when the source breach was created.
Ignite.CompromisedCredential._source.breach.first_observed_at.date-time Date Datetime when the source breach was first observed, formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.breach.first_observed_at.timestamp Number The UNIX timestamp when the source breach was first observed.
Ignite.CompromisedCredential._source.breach.fpid String Flashpoint ID of the breach.
Ignite.CompromisedCredential._source.breach.source String Data source of breach (i.e., Analyst Research, CredentialStealer, etc.).
Ignite.CompromisedCredential._source.breach.source_type String Type of source of the breach.
Ignite.CompromisedCredential._source.breach.title String Title of the breach.
Ignite.CompromisedCredential._source.breach.victim String Victim of the breach.
Ignite.CompromisedCredential._source.credential_record_fpid String The Flashpoint ID of the associated record object. Used to retrieve sightings for a credential.
Ignite.CompromisedCredential._source.customer_id String Customer ID of the IoC.
Ignite.CompromisedCredential._source.domain String The domain object extracted off of the email address.
Ignite.CompromisedCredential._source.email String The email address for the compromised credential.
Ignite.CompromisedCredential._source.username String The username for the compromised credential.
Ignite.CompromisedCredential._source.extraction_id String Extraction ID of the IoC.
Ignite.CompromisedCredential._source.extraction_record_id String Extraction record ID of the IoC.
Ignite.CompromisedCredential._source.fpid String The Flashpoint ID of this credentials object.
Ignite.CompromisedCredential.source.header.indexed_at String Timestamp for when this document was indexed into the Flashpoint database.
Ignite.CompromisedCredential.source.header.pipeline_duration String Pipeline duration header information of the IoC.
Ignite.CompromisedCredential._source.is_fresh Boolean “true” if the credential has not been seen before, and it hasn’t been marked “not fresh” by an analyst. (Historical breaches are not “fresh”.).
Ignite.CompromisedCredential._source.last_observed_at.date-time Date If exists, time object for when the credential was previously observed. Datetime object formatted as YYYY-mm-ddTHH:MM:SSZ.
Ignite.CompromisedCredential._source.last_observed_at.timestamp Number The UNIX timestamp when the source breach was first observed.
Ignite.CompromisedCredential._source.password String The password for the credential (in plain text, if possible).
Ignite.CompromisedCredential._source.password_complexity.has_lowercase Boolean Whether lowercase letters are present.
Ignite.CompromisedCredential._source.password_complexity.has_number Boolean Whether numbers are present.
Ignite.CompromisedCredential._source.password_complexity.has_symbol Boolean Whether symbols are present.
Ignite.CompromisedCredential._source.password_complexity.has_uppercase Boolean Whether uppercase letters are present.
Ignite.CompromisedCredential._source.password_complexity.length Number Integer value that represents the number of characters in the password.
Ignite.CompromisedCredential._source.password_complexity.probable_hash_algorithms Unknown List of possible hash algorithms suspected based on the text pattern of the password. (May include values like “MD5”, “SHA-1”, “SHA-256”, “bcrypt”, etc.)
Ignite.CompromisedCredential._source.times_seen Number Integer representing the number of times the credential has been seen at Flashpoint.
Ignite.CompromisedCredential._type String Type of the IoC.
Ignite.CompromisedCredential.matched_queries Unknown Matching queries of the IoC.
Ignite.CompromisedCredential.sort Unknown Sort value of the IoC.

Command example

!flashpoint-ignite-compromised-credentials-list start_date="2 weeks" end_date="1 days" filter_date=created_at is_fresh=true page_number=2 page_size=1 sort_date=created_at sort_order=asc

Context Example

{
    "Ignite": {
        "CompromisedCredential": {
            "_id": "sample_id",
            "_source": {
                "affected_domain": "example",
                "affected_url": "https://dummy_url",
                "basetypes": [
                    "credential-sighting"
                ],
                "body": {
                    "raw": "URL: https://dummy_url\r\nUsername: someone@example.com\r\nPassword: pass_123\r\nApplication: Microsoft_[Edge]_Default"
                },
                "breach": {
                    "basetypes": [
                        "breach"
                    ],
                    "breach_type": "credential",
                    "created_at": {
                        "date-time": "2024-05-10T16:13:33Z",
                        "timestamp": 1715789613
                    },
                    "first_observed_at": {
                        "date-time": "2024-05-10T16:13:34Z",
                        "timestamp": 1715789614
                    },
                    "fpid": "sample_fpid",
                    "source": "Analyst Research",
                    "source_type": "Credential Stealer",
                    "title": "Compromised Users from Redline Stealer Malware \"logs_05_10_2024-160709.zip\" May152024"
                },
                "credential_record_fpid": "sample_credential_record_fpid",
                "customer_id": "sample_customer_id",
                "domain": "example.com",
                "email": "someone@example.com",
                "extraction_id": "sample_extraction_id",
                "extraction_record_id": "sample_extraction_record_id",
                "fpid": "sample_fpid",
                "header_": {
                    "indexed_at": 1715793565,
                    "pipeline_duration": 63883012765
                },
                "is_fresh": true,
                "last_observed_at": {
                    "date-time": "2024-05-10T16:13:34Z",
                    "timestamp": 1715789614
                },
                "password": "pass_123",
                "password_complexity": {
                    "has_lowercase": true,
                    "has_number": true,
                    "has_symbol": true,
                    "has_uppercase": true,
                    "length": 9
                },
                "times_seen": 1,
                "username": "someone@example.com"
            },
            "_type": "_doc",
            "matched_queries": [
                "data.example"
            ],
            "sort": [
                1715789613000
            ]
        }
    }
}

Human Readable Output

Total number of records found: 150

Compromised Credential(s)

FPID Email Username Breach Source Breach Source Type Password Created Date (UTC) First Observed Date (UTC)
sample_fpid someone@example.com someone@example.com Analyst Research Credential Stealer pass_123 May 10, 2024 16:13 May 10, 2024 16:13

flashpoint-ignite-event-list

Searches for events within the specified time period, the Flashpoint report ID, or attack IDs.

Base Command

flashpoint-ignite-event-list

Input

Argument Name Description Required
time_period The time period for the search. Optional
report_fpid The Flashpoint report ID. To retrieve the Flashpoint report ID, run the flashpoint-ignite-intelligence-related-report-list command. Optional
limit The maximum number of records. Default is 10. Optional
attack_ids A comma-separated list of attack IDs for which to search. Attack IDs can be found in event information or on the Ignite platform by filtering events by attack IDs. Optional

Context Output

Path Type Description
Ignite.Event.EventCreatorEmail string The email of the event creator.
Ignite.Event.EventId string The ID of the event.
Ignite.Event.UUID string The UUID of the event.
Ignite.Event.Href string The hyperlink of the event.
Ignite.Event.MalwareDescription string The description of the malware.
Ignite.Event.Name string The name of the event.
Ignite.Event.ObservedTime string The date that the event was triggered.
Ignite.Event.Tags string The tags of the event.

Command example

!flashpoint-ignite-event-list limit="2" attack_ids=T1001

Context Example

{
    "Ignite": {
        "Event": [
            {
                "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000001\" [2024-05-31 03:49:12]",
                "Tags": "mitre:T1001",
                "EventCreatorEmail": "info@flashpoint-intel.com",
                "EventId": "0000000000000000000001",
                "UUID": "00000000-0000-0000-0000-0001",
                "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000001",
                "ObservedTime": "May 31, 2024  04:03",
                "MalwareDescription": "This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack."
            },
            {
                "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000002\" [2024-05-31 00:01:14]",
                "Tags": "mitre:T1001",
                "EventCreatorEmail": "info@flashpoint-intel.com",
                "EventId": "0000000000000000000002",
                "UUID": "00000000-0000-0000-0000-0002",
                "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000002",
                "ObservedTime": "May 31, 2024  01:00",
                "MalwareDescription": "Strike became popular among threat actors as an initial access payload, as well as a second-stage tool threat actors use once access is achieved."
            }
        ]
    }
}

Human Readable Output

Ignite Events

Below are the detail found

Observed time (UTC) Name Tags Malware Description
May 31, 2024 04:03 Observation: strike “0000000000000000000000000000000000000000000000000000000000000001” [2024-05-31 03:49:12] mitre:T1001 This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack.
May 31, 2024 01:00 Observation: strike “0000000000000000000000000000000000000000000000000000000000000002” [2024-05-31 00:01:14] mitre:T1001 Strike became popular among threat actors as an initial access payload, as well as a second-stage tool threat actors use once access is achieved.

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs

flashpoint-ignite-event-get

Retrieves the details of a single event using event FPID or UUID.

Base Command

flashpoint-ignite-event-get

Input

Argument Name Description Required
event_id The FPID or UUID that identifies a particular event. The event ID can be fetched from the output context path (Ignite.Event.EventId) of the flashpoint-ignite-event-list command, or the indicator reputation command response or some other investigation. Required

Context Output

Path Type Description
Ignite.Event.EventCreatorEmail string The email of the event creator.
Ignite.Event.EventId string The ID of the event.
Ignite.Event.UUID string The UUID of the event.
Ignite.Event.Href string The hyperlink of the event.
Ignite.Event.MalwareDescription string The description of the malware.
Ignite.Event.Name string The name of the event.
Ignite.Event.ObservedTime string The date that the event was triggered.
Ignite.Event.Tags string The tags of the event.

Command example

!flashpoint-ignite-event-get event_id=0000000000000000000001

Context Example

{
    "Ignite": {
        "Event": {
            "Name": "Observation: strike \"0000000000000000000000000000000000000000000000000000000000000001\" [2024-05-31 03:49:12]",
            "Tags": "mitre:T1001",
            "EventCreatorEmail": "info@flashpoint-intel.com",
            "EventId": "0000000000000000000001",
            "UUID": "00000000-0000-0000-0000-0001",
            "Href": "https://api.flashpoint.io/technical-intelligence/v1/event/0000000000000000000001",
            "ObservedTime": "May 31, 2024  04:03",
            "MalwareDescription": "This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack."
        }
    }
}

Human Readable Output

Ignite Event details

Below are the detail found

Observed time (UTC) Name Tags Malware Description
May 31, 2024 04:03 Observation: strike “0000000000000000000000000000000000000000000000000000000000000001” [2024-05-31 03:49:12] mitre:T1001 This malicious adoption has caused difficulties in determining whether observed activity is related to an ongoing criminal attack.

flashpoint-ignite-intelligence-report-get

Get single report details using the report id.

Base Command

flashpoint-ignite-intelligence-report-get

Input

Argument Name Description Required
report_id The ID of the report for which the details are to be fetched. The report ID can be retrieved from the output context path (Ignite.Report.ReportId) of the flashpoint-ignite-intelligence-report-search command or some other investigation. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of the report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.
Ignite.Report.Tags string Tags of the report.

Command example

!flashpoint-ignite-intelligence-report-get report_id=00000000000000000001

Context Example

{
    "Ignite": {
        "Report": {
            "NotifiedAt": "2022-02-10T22:25:51.190+00:00",
            "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000001",
            "PostedAt": "2022-02-10T22:25:51.190+00:00",
            "ReportId": "00000000000000000001",
            "Summary": "A weekly update on major developments in XYZ.",
            "Title": "Key Developments: XYZ (February 3-10, 2022)",
            "UpdatedAt": "2022-02-10T22:25:51.190+00:00",
            "Tags": "Energy, Government & Policymakers, XYZ, Law Enforcement & Military, Intelligence Report, Technology & Internet, Right-Wing Extremist, Media & Telecom, Protests, Cyber Threats, Physical Threats, Government, Technology, Right-wing extremism, Media, Direct action and protests, Key Developments: XYZ "
        }
    }
}

Human Readable Output

Ignite Intelligence Report details

Below are the details found

Title Date Published (UTC) Summary Tags
Key Developments: XYZ (February 3-10, 2022) Feb 10, 2022 22:25 A weekly update on major developments in XYZ. Energy, Government & Policymakers, XYZ, Law Enforcement & Military, Intelligence Report, Technology & Internet, Right-Wing Extremist, Media & Telecom, Protests, Cyber Threats, Physical Threats, Government, Technology, Right-wing extremism, Media, Direct action and protests, Key Developments: XYZ

flashpoint-ignite-intelligence-related-report-list

List related reports for a particular report using the report ID.

Base Command

flashpoint-ignite-intelligence-related-report-list

Input

Argument Name Description Required
report_id The report-id of the report of which the related reports are to be fetched. The report id can be known from output context path (Ignite.Report.ReportId) of flashpoint-ignite-intelligence-report-search command or some other investigation. Required

Context Output

Path Type Description
Ignite.Report.NotifiedAt string Notify date of report.
Ignite.Report.PlatformUrl string Platform URL of the report. Used to help redirect the Ignite platform.
Ignite.Report.PostedAt number Posted date of the report.
Ignite.Report.Summary string Summary of the report.
Ignite.Report.Title string Title of the report.
Ignite.Report.UpdatedAt string Last updated date of the report.
Ignite.Report.ReportId string Unique ID of the report.

Command example

!flashpoint-ignite-intelligence-related-report-list report_id=00000000000000000003

Context Example

{
    "Ignite": {
        "Report": [
            {
                "NotifiedAt": "2023-04-13T21:18:35.557+00:00",
                "PlatformUrl": "https://app.flashpoint.io/cti/intelligence/report/00000000000000000003",
                "PostedAt": "2023-04-13T21:18:35.557+00:00",
                "ReportId": "00000000000000000003",
                "Summary": "A weekly report on the major developments in XYZ.              ",
                "Title": "Key Developments: XYZ (April 7-13, 2023)",
                "UpdatedAt": "2023-04-13T21:18:35.557+00:00"
            }
        ]
    }
}

Human Readable Output

Ignite Intelligence related reports

Top 5 related reports:

1) Key Developments: XYZ (April 7-13, 2023)
Summary: A weekly report on the major developments in XYZ.

Link to the given Report on Ignite platform: https://app.flashpoint.io/cti/intelligence/report/00000000000000000001#detail

flashpoint-ignite-alert-list

Retrieves a list of alerts based on the filter values provided in the command arguments.

Base Command

flashpoint-ignite-alert-list

Input

Argument Name Description Required
size The number of alerts to return. Default is 10. Optional
created_after Returns alerts that occurred after the specified date. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc). Optional
created_before Returns alerts that occurred before the specified date. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc). Optional
cursor The cursor to retrieve next page data. Used for pagination only. The value of the cursor can be found from the output context path (Ignite.PageToken.Alert.cursor) or the HR output of the flashpoint-ignite-alert-list command. Optional
status Filter alerts by status. Possible values are: Archived, Starred, Sent, None. Optional
origin Filter alerts by origin. Possible values are: Searches, Assets. Optional
sources Filter alerts by source. Possible values are: Github, Gitlab, Bitbucket, Communities, Images, Marketplaces, Reports, Vulnerabilities. Optional
tags A comma-separated list of alerts filtered by tags. Optional
asset_type Filter alerts by asset type. Optional
asset_ip Filter alerts by asset IP. Optional
asset_ids A comma-separated list of alerts filtered by asset IDs. Optional
query_ids A comma-separated list of alerts filtered by search IDs. Optional

Context Output

Path Type Description
Ignite.Alert.id String The unique identifier for the alert.
Ignite.Alert.resource.id String The identifier for the resource associated with the alert.
Ignite.Alert.resource.basetypes String Base types of the resource related to the alert.
Ignite.Alert.resource.container.container.name String The name of the nested container within the resource that holds the alert.
Ignite.Alert.resource.container.container.native_id String The native identifier for the nested container within the resource.
Ignite.Alert.resource.container.container.title String The title of the nested container within the resource.
Ignite.Alert.resource.container.name String The name of the container that holds the resource associated with the alert.
Ignite.Alert.resource.container.native_id String The native identifier for the container that holds the resource.
Ignite.Alert.resource.container.title String The title of the container that holds the resource associated with the alert.
Ignite.Alert.resource.created_at.date-time String The date and time when the resource associated with the alert was created in ISO 8601 format.
Ignite.Alert.resource.created_at.raw Date The raw timestamp or other date-time representation when the resource was created.
Ignite.Alert.resource.created_at.timestamp Number The UNIX timestamp representing when the resource associated with the alert was created.
Ignite.Alert.resource.media_v2.sha1 String The SHA1 hash of the media file related to the alert.
Ignite.Alert.resource.media_v2.phash String The perceptual hash (pHash) of the media file, used to find visually similar images.
Ignite.Alert.resource.media_v2.media_type String The type of media (e.g., image, video) associated with the alert.
Ignite.Alert.resource.media_v2.mime_type String The MIME type of the media file associated with the alert.
Ignite.Alert.resource.media_v2.storage_uri String The storage URI where the media file related to the alert is located.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.racy Number A score indicating the likelihood that the image contains racy content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.spoof Number A score indicating the likelihood that the image contains spoofed content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.medical Number A score indicating the likelihood that the image contains medical content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.adult Number A score indicating the likelihood that the image contains sexual content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.adult Number A score indicating the likelihood that the image contains adult content.
Ignite.Alert.resource.media_v2.image_enrichment.enrichments.v1.image-analysis.safe_search.violence Number A score indicating the likelihood that the image contains violent content.
Ignite.Alert.resource.title String The title of the resource associated with the alert.
Ignite.Alert.resource.section String The section of the platform or service where the resource is categorized or located.
Ignite.Alert.resource.repo String Repository of the resource related to the alert.
Ignite.Alert.resource.snippet String Snippet of the resource related to the alert.
Ignite.Alert.resource.source String Source of the resource related to the alert.
Ignite.Alert.resource.url String URL of the resource related to the alert.
Ignite.Alert.resource.owner String Owner of the resource related to the alert.
Ignite.Alert.resource.file String File associated with the resource related to the alert.
Ignite.Alert.resource.parent_basetypes String The parent base types that categorize the resource.
Ignite.Alert.resource.site_actor.names.handle String The username or handle of the site actor related to the resource.
Ignite.Alert.resource.site_actor.native_id String The native identifier for the site actor associated with the resource.
Ignite.Alert.resource.sort_date Date The date and time used for sorting the resource, typically the creation or publication date.
Ignite.Alert.resource.site.title String The title of the site or platform associated with the resource.
Ignite.Alert.resource.shodan_host.asn String The ASN (Autonomous System Number) of the Shodan host.
Ignite.Alert.resource.shodan_host.country String The country of the Shodan host.
Ignite.Alert.resource.shodan_host.org String The organization of the Shodan host.
Ignite.Alert.resource.shodan_host.shodan_url String The Shodan URL of the Shodan host.
Ignite.Alert.resource.shodan_host.vulns Unknown The vulnerabilities related to the Shodan host.
Ignite.Alert.reason.id String ID of the reason for the alert.
Ignite.Alert.reason.name String Name of the reason for the alert.
Ignite.Alert.reason.text String Text related to the reason for the alert.
Ignite.Alert.reason.origin String Origin of the reason for the alert.
Ignite.Alert.reason.details.sources String Sources related to the reason for the alert.
Ignite.Alert.reason.details.params Unknown Parameters related to the reason for the alert.
Ignite.Alert.reason.details.params.include.date.end String The end date for the included date range in the alert’s reason details.
Ignite.Alert.reason.details.params.include.date.label String The label describing the included date range in the alert’s reason details.
Ignite.Alert.reason.details.params.include.date.start String The start date for the included date range in the alert’s reason details.
Ignite.Alert.reason.details.type String The type of details related to the reason for the alert.
Ignite.Alert.reason.entity.id String ID of the entity related to the reason for the alert.
Ignite.Alert.reason.entity.name String Name of the entity related to the reason for the alert.
Ignite.Alert.reason.entity.type String Type of the entity related to the reason for the alert.
Ignite.Alert.status String Status of the alert.
Ignite.Alert.generated_at Date Date when the alert was generated.
Ignite.Alert.created_at Date Date when the alert was created.
Ignite.Alert.tags Unknown Tags associated with the alert.
Ignite.Alert.highlights.media_v2.image_enrichment.enrichments.v1.image-analysis.text.value String The text value extracted from the image analysis in the alert’s highlights.
Ignite.Alert.highlights.ports String The highlighted ports related to the alert.
Ignite.Alert.highlights.services String The highlighted services related to the alert.
Ignite.Alert.highlight_text String The highlighted text associated with the alert.
Ignite.Alert.data_type String Data type of the alert.
Ignite.Alert.parent_data_type String Parent data type of the alert.
Ignite.Alert.source String Source of the alert.
Ignite.Alert.is_read Boolean Indicates if the alert has been read.
Ignite.Alert.highlights.body.text/plain String The plain text extracted from the body of the content highlighted in the alert.
Ignite.Alert.reason.details.params.include.ships_from String The shipping origin included in the alert’s reason details.
Ignite.Alert.highlights.snippet String A snippet or excerpt highlighted in the alert.
Ignite.PageToken.Alert.created_after Date Date for filtering alerts created after a specific time.
Ignite.PageToken.Alert.created_before Date Date for filtering alerts created before a specific time.
Ignite.PageToken.Alert.size String Size of the page for pagination.
Ignite.PageToken.Alert.cursor Date Cursor for pagination to retrieve the next set of alerts.
Ignite.PageToken.Alert.name String The name of the command.

Command example

!flashpoint-ignite-alert-list created_after="2024-06-11T05:54:25Z" created_before="2024-06-12T05:54:27Z" size=1

Context Example

{
    "Ignite": {
        "Alert": {
            "id": "00000000-0000-0000-0000-000000000001",
            "resource": {
                "id": "00000000-0000-0000-0000-000000000001",
                "basetypes": [
                    "code",
                    "file",
                    "github",
                    "repository"
                ],
                "file": "2024/06/17/My First Blog/index.html",
                "url": "https://dummyurl.com/naive-gabrie-white",
                "owner": "naive-gabrie-white",
                "source": "github",
                "repo": "naive-gabrie-white.github.io",
                "snippet": "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"facebook,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:..."
            },
            "reason": {
                "id": "00000000-0000-0000-0000-000000000001",
                "name": "fb",
                "text": "facebook",
                "origin": "searches",
                "details": {
                    "sources": [
                        "data_exposure__github",
                        "data_exposure__gitlab",
                        "data_exposure__bitbucket"
                    ]
                },
                "entity": {
                    "id": "000000000000000001",
                    "name": "Crest Data Systems",
                    "type": "organization"
                }
            },
            "generated_at": "2024-06-17T05:54:19Z",
            "created_at": "2024-06-17T05:54:22.158905Z",
            "highlights": {
                "snippet": [
                    "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:..."
                ]
            },
            "highlight_text": "data-image=\"https://i.dummyurl.net/2021/02/24/000000000000001.png\" data-sites=\"<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq\"></div><link rel=\"stylesheet\" href=\"https:...",
            "data_type": "github",
            "source": "data_exposure__github",
            "is_read": false
        },
        {
            "id": "00000000-0000-0000-0000-000000000005",
            "resource": {
                "id": "00000000000000000005",
                "basetypes": [
                    "infrastructure",
                    "internet",
                    "shodan"
                ],
                "source": "shodan",
                "shodan_host": {
                    "asn": "AS0001",
                    "country": "United States",
                    "org": "Company LLC",
                    "shodan_url": "https://www.shodan.io/host/0.0.0.1"
                }
            },
            "reason": {
                "id": "00000000000000000005",
                "name": "Company IP",
                "text": "0.0.0.1",
                "origin": "assets",
                "details": {
                    "type": "ipv4s"
                },
                "entity": {
                    "id": "000000000000000001",
                    "name": "Crest Data Systems",
                    "type": "organization"
                }
            },
            "generated_at": "2024-07-02T16:43:17Z",
            "created_at": "2024-07-02T16:43:37.476237Z",
            "highlights": {
                "ports": [
                    "<x-fp-highlight>53</x-fp-highlight>",
                    "<x-fp-highlight>443</x-fp-highlight>"
                ],
                "services": [
                    "<x-fp-highlight>Unknown Service (Port 01)</x-fp-highlight>",
                    "<x-fp-highlight>Unknown Service (Port 02)</x-fp-highlight>"
                ]
            },
            "highlight_text": "<x-fp-highlight>53</x-fp-highlight>",
            "data_type": "unknown",
            "is_read": false
        },
        "PageToken": {
            "Alert": {
                "created_after": "2024-06-14T05:54:25Z",
                "created_before": "2024-06-17T05:54:25Z",
                "cursor": "1718603662.158905",
                "name": "flashpoint-ignite-alert-list",
                "size": "1"
            }
        }
    }
}

Human Readable Output

Alerts

ID Created at (UTC) Query Source Resource URL Site Title Shodan Host Repository Owner Origin Ports Services Highlight Text
00000000-0000-0000-0000-000000000001 Jun 17, 2024 05:54 facebook data_exposure__github https://dummyurl.com/naive-gabrie-white     naive-gabrie-white.github.io naive-gabrie-white searches     data-image=”https://i.dummyurl.net/2021/02/24/000000000000001.png” data-sites=”<x-fp-highlight>facebook</x-fp-highlight>,twitter,wechat,weibo,qq”><link rel=”stylesheet” href=”https:…>
00000000-0000-0000-0000-000000000005 Jul 02, 2024 16:43 0.0.0.1       asn: AS0001
country: United States
org: Company LLC
shodan_url: https://www.shodan.io/host/0.0.0.1		     assets 53, 443 Unknown Service (Port 01), Unknown Service (Port 02) <x-fp-highlight>53</x-fp-highlight>

To retrieve the next set of result use

created_after = 2024-06-14T05:54:25Z
created_before = 2024-06-17T05:54:25Z
size = 1
cursor = 1718603662.158905

email

Looks up the “Email” type indicator details. The reputation of Email is considered malicious if there’s at least one IoC event in the Ignite database matching the Email indicator.

Base Command

email

Input

Argument Name Description Required
email A comma-separated list of emails. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Email.Event.Href string A list of reference links of the indicator.
Ignite.Email.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Email.Event.Category string The category of the indicator.
Ignite.Email.Event.Fpid string The Flashpoint ID of the indicator.
Ignite.Email.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Email.Event.Type string The indicator type.
Ignite.Email.Event.Uuid string The UUID of the indicator.
Ignite.Email.Event.Comment string The comment that was provided when the indicator was observed.
Account.Description string The description of the indicator.
Account.Email.Name string Name of indicator.

Command Example

!email email="dummy@dummy.com"

Context Example

{
  "DBotScore": {
    "Indicator": "dummy@dummy.com",
    "Type": "email",
    "Vendor": "Ignite",
    "Score": 3
  },
  "Account": {
    "Description": "Found in malicious indicators dataset"
    "Email": {
        "Address": "dummy@dummy.com"
    },
  },
  "Ignite.Email.Event": [
    {
      "EventDetails": {
        "RelatedEvent": [],
        "Tags": ["sample_tags"],
        "attack_ids": [],
        "event_uuid": "dummy_uuid",
        "fpid": "dummy_fpid",
        "href": "https://mock_dummy.com/technical-intelligence/v1/event/00000001",
        "info": "sample info", "reports": [], "timestamp": "00001"
      },
      "Category": "sample_category",
      "Fpid": "dummy_fpid",
      "Href": "https://mock_dummy.com/technical-intelligence/v1/attribute/0000001",
      "Timestamp": "00001",
      "Type": "email",
      "Uuid": "dummy_uuid",
      "Comment": "sample comment"
    }
  ]
}

Human Readable Output

Ignite Email reputation for dummy@dummy.com

Reputation: Malicious

Events in which this IOC observed
Date Observed (UTC) Name Tags
Jan 01, 1970 00:00 sample info sample_tags

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs?sort_date=All%20Time&types=email-dst,email-src,email-src-display-name,email-subject,email&query=%22dummy%40dummy.com%22

filename

Looks up the “Filename” type indicator details. The reputation of Filename is considered malicious if there’s at least one IoC event in the Ignite database matching the Filename indicator.

Base Command

filename

Input

Argument Name Description Required
filename A comma-separated list of filenames. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Filename.Event.Href string A list of reference links of the indicator.
Ignite.Filename.Event.Filename string Filename of the indicator.
Ignite.Filename.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Filename.Event.Category string The category of the indicator.
Ignite.Filename.Event.Fpid string The Ignite ID of the indicator.
Ignite.Filename.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Filename.Event.Type string The indicator type.
Ignite.Filename.Event.Uuid string The UUID of the indicator.
Ignite.Filename.Event.Comment string The comment that was provided when the indicator was observed.
Filename.Malicious.Description string The description of the malicious indicator.
Filename.Malicious.Vendor string Vendor of the malicious filename.
Filename.Name string The filename.
Filename.Description string The description of the indicator.

Command Example

!filename filename="dummy.log"

Context Example

{
  "DBotScore": {
    "Indicator": "dummy.log",
    "Type": "filename",
    "Vendor": "Ignite",
    "Score": 3
  },
  "Filename": {
    "Name": "dummy.log",
    "Malicious": {
      "Vendor": "Ignite",
      "Description": "Found in malicious indicators dataset"
    }
  },
  "Ignite.Filename.Event": [
    {
      "Filename": "dummy.log",
      "Category": "test category",
      "Fpid": "dummy_fpid",
      "Href": "https://mock_dummy.com/technical-intelligence/v1/attribute/00001",
      "Timestamp": "0000000001",
      "Type": "filename",
      "Uuid": "dummy_uuid",
      "EventDetails": {
        "RelatedEvent": [],
        "Tags": [
          "sample_tags"
        ],
        "attack_ids": [],
        "event_uuid": "dummy_uuid",
        "fpid": "dummy_fpid",
        "href": "https://mock_dummy.com/technical-intelligence/v1/event/0001",
        "info": "test info",
        "reports": [],
        "timestamp": "0000000001"
      },
      "Comment": ""
    }
  ]
}

Human Readable Output

Ignite Filename reputation for dummy.log

Reputation: Malicious

Events in which this IOC observed
Date Observed (UTC) Name Tags
Jan 01, 1970 00:00 test info sample_tags

All events and details (ignite): https://mock_dummy.com/cti/malware/iocs?sort_date=All%20Time&types=filename&query=%22dummy.log%22

ip

Looks up the “IP” type indicator details. The reputation of the IP address is decided from the indicator score if it is found in the Ignite IOC database. Alternatively, the IP address is considered suspicious if it matches any one of the community’s peer IP addresses.

Base Command

ip

Input

Argument Name Description Required
ip A comma-separated list of IP addresses. Required
exact_match Whether to perform an exact match on the IP address value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
Ignite.IP.Event.Href string A list of reference links of the indicator.
Ignite.IP.Event.Address string The IP address of the indicator.
Ignite.IP.Event.EventDetails string The event details in which the indicator was observed.
Ignite.IP.Event.Category string The category of the indicator.
Ignite.IP.Event.Fpid string The Ignite ID of the indicator.
Ignite.IP.Event.Timestamp string The time and date that the indicator was observed.
Ignite.IP.Event.Type string The indicator type.
Ignite.IP.Event.Uuid string The UUID of the indicator.
Ignite.IP.Event.Comment string The comment that was provided when the indicator was observed.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.author String The author of the document.
Ignite.IP.author_id String The ID of the author of the document.
Ignite.IP.date Date The date associated with the document.
Ignite.IP.container_id String Unique identifier of the container.
Ignite.IP.container_title String Title of the container.
Ignite.IP.enrichments.bins Number Number of bins associated with the document.
Ignite.IP.enrichments.bitcoin_addresses String Bitcoin addresses associated with the document.
Ignite.IP.enrichments.cve_ids String CVE IDs associated with the document.
Ignite.IP.enrichments.email_addresses String Email addresses associated with the document.
Ignite.IP.enrichments.ethereum_addresses String Ethereum addresses associated with the document.
Ignite.IP.enrichments.ip_addresses String IP addresses associated with the document.
Ignite.IP.enrichments.location.country_code String Country code of the location associated with the document.
Ignite.IP.enrichments.location.name String Name of the location associated with the document.
Ignite.IP.enrichments.location.lat Number Latitude of the location associated with the document.
Ignite.IP.enrichments.location.long Number Longitude of the location associated with the document.
Ignite.IP.enrichments.monero_addresses String Monero addresses associated with the document.
Ignite.IP.enrichments.social_media_handles String Social media handles associated with the document.
Ignite.IP.enrichments.social_media_sites String Social media sites associated with the document.
Ignite.IP.enrichments.translation.language String Language of the translation associated with the document.
Ignite.IP.enrichments.translation.message String Translation message associated with the document.
Ignite.IP.enrichments.url_domains String URL domains associated with the document.
Ignite.IP.first_observed_at Date The first observed date of the document.
Ignite.IP.last_observed_at Date The last observed date of the document.
Ignite.IP.media.id String Unique identifier of the media.
Ignite.IP.media.file_name String File name of the media.
Ignite.IP.media.mime_type String MIME type of the media.
Ignite.IP.media.phash String Perceptual hash of the media.
Ignite.IP.media.safe_search String Safe search value of the media.
Ignite.IP.media.size Number Size of the media.
Ignite.IP.media.sort_date Date Date used for sorting the media.
Ignite.IP.media.storage_uri String Storage URI of the media.
Ignite.IP.media.type String Type of the media.
Ignite.IP.message String Message associated with the document.
Ignite.IP.message_id String ID of the message associated with the document.
Ignite.IP.native_id String Native ID of the document.
Ignite.IP.message_hash String Hash of the message associated with the document.
Ignite.IP.parent_container_title String Title of the parent container.
Ignite.IP.section String Section of the document.
Ignite.IP.section_id String ID of the section.
Ignite.IP.site String The site associated with the document.
Ignite.IP.site_actor_handle String Actor handle of the site associated with the document.
Ignite.IP.site_actor_alias String Actor alias of the site associated with the document.
Ignite.IP.site_actor_url String Actor URL of the site associated with the document.
Ignite.IP.site_actor_username String Actor username of the site associated with the document.
Ignite.IP.site_source_uri String Source URI of the site associated with the document.
Ignite.IP.site_title String Title of the site associated with the document.
Ignite.IP.sort_date Date Date used for sorting the document.
Ignite.IP.source_uri String Source URI of the document.
Ignite.IP.title String Title of the document.
Ignite.IP.title_id String ID of the title.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored at of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string The modified at of IP.
Ignite.IP.created_at string The created at of IP.
Ignite.IP.last_seen_at string The last seen at of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at of IP latest sighting.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.

Command example

!ip ip=0.0.0.1

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.1",
        "Reliability": "B - Usually reliable",
        "Score": 3,
        "Type": "ip",
        "Vendor": "Ignite"
    },
    "IP": {
        "Address": "0.0.0.1",
        "Malicious": {
            "Description": "Found in malicious indicators dataset",
            "Vendor": "Ignite"
        },
        "Relationships": [
            {
                "Relationship": "related-to",
                "EntityA": "0.0.0.1",
                "EntityAType": "IP",
                "EntityB": "dummy_latest_sighting_related_ioc_value_1",
                "EntityBType": "File"
            },
            {
                "Relationship": "related-to",
                "EntityA": "0.0.0.1",
                "EntityAType": "IP",
                "EntityB": "dummy_related_ioc_value_1.com",
                "EntityBType": "Domain"
            }
        ]
    },
    "Ignite": {
        "IP": {
            "id": " dummy_id_123",
            "type": "ipv4",
            "value": "0.0.0.1",
            "href": "https://dummy.href.com",
            "entity_type": "indicator",
            "score": {
                "value": "malicious",
                "last_scored_at": "2025-04-21T06:44:37.633000",
                "raw_score": null
            },
            "modified_at": "2025-04-21T06:44:37.633000",
            "created_at": "2025-04-14T15:28:26.371000",
            "last_seen_at": "2025-04-21T06:34:55.617000",
            "sort_date": "2025-04-21T06:34:55.617000",
            "platform_urls": {
                "ignite": "https://dummy.ignite.com"
            },
            "apt_description": "N/A",
            "external_references": [],
            "hashes": null,
            "malware_description": "dummy_malware_description",
            "mitre_attack_ids": [
                {
                    "id": "dummy_attack_id_123",
                    "name": "dummy_attack_name",
                    "tactics": [
                        "Discovery"
                    ]
                }
            ],
            "relationships": {
                "iocs": [
                    {
                        "id": "dummy_ioc_id_1",
                        "type": "dummy_ioc_type_1",
                        "value": "dummy_ioc_value_1",
                        "href": "https://dummy.ioc.href.com/1"
                    }
                ]
            },
            "sightings": [
                {
                    "source": "dummy_source",
                    "sighted_at": "2025-04-21T06:34:55.617000",
                    "tags": [
                        "dummy_tag_1",
                        "dummy_tag_2",
                        "dummy_tag_3"
                    ],
                    "related_iocs": [
                        {
                            "id": "dummy_related_ioc_id_1",
                            "type": "domain",
                            "value": "dummy_related_ioc_value_1.com",
                            "href": "https://dummy.related_ioc.href.com/1"
                        }
                    ]
                }
            ],
            "latest_sighting": {
                "source": "dummy_latest_sighting_source",
                "sighted_at": "2025-04-21T06:34:55.617000",
                "tags": [
                    "dummy_latest_sighting_tag_1",
                    "dummy_latest_sighting_tag_2",
                    "dummy_latest_sighting_tag_3"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_latest_sighting_related_ioc_id_1",
                        "type": "file",
                        "value": "dummy_latest_sighting_related_ioc_value_1",
                        "href": "https://dummy.latest_sighting.related_ioc.href.com/1"
                    }
                ]
            },
            "total_sightings": 11
        }
    }
}

Human Readable Output

Ignite IP Address reputation for 0.0.0.1

Reputation: Malicious

ID IP Type Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id_123 0.0.0.1 ipv4 dummy_malware_description dummy_latest_sighting_tag_1,
dummy_latest_sighting_tag_2,
dummy_latest_sighting_tag_3,
dummy_tag_1,
dummy_tag_2,
dummy_tag_3		 - type: file
value: dummy_latest_sighting_related_ioc_value_1
- type: domain
value: dummy_related_ioc_value_1.com		 - id: dummy_attack_id_123
name: dummy_attack_name
tactics:
values: Discovery		 Apr 14, 2025 15:28 Apr 21, 2025 06:44 Apr 21, 2025 06:34

Platform Link(ignite): https://dummy.ignite.com

flashpoint-ignite-common-lookup

Looks up details for indicators of types: “URL”, “Domain”, “File Hash”, and “IP”. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

flashpoint-ignite-common-lookup

Input

Argument Name Description Required
indicator List of indicators. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.id string The ID of file.
Ignite.File.type String Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA512 string SHA512 type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type String Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type String Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored time of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string Last time when IP was modified.
Ignite.IP.created_at string The creation time of IP.
Ignite.IP.last_seen_at string The last seen time of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at time of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at time of latest sighting of IP.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.

Command example

!flashpoint-ignite-common-lookup indicator="00000000000000000000000000000001"

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "00000000000000000000000000000001",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "flashpoint_detection",
            "sighted_at": "2025-01-02T01:00:00.000000",
            "tags": [
                "malware:pony",
                "os:windows",
                "source:flashpoint_detection",
                "type:stealer"
            ],
            "related_iocs": [
                {
                    "id": "dummy_id",
                    "type": "file",
                    "value": "00000000000000000000000000000002",
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Type Hashes Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id file md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

flashpoint-ignite-indicator-get

Looks up details for indicators of types “URL”, “Domain”, “File Hash”, and “IP” using their ID. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

flashpoint-ignite-indicator-get

Input

Argument Name Description Required
indicator_id ID of the indicator. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.id string The ID of file.
Ignite.File.type String Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA512 string SHA512 type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.File.historical_tags string The tags of File.
Ignite.File.reports.html string Platform url to access the report of the indicator.
Ignite.File.reports.json string API url of the report of the indicator.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type String Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.Domain.historical_tags string The tags of Domain.
Ignite.Domain.reports.html string Platform url to access the report of the indicator.
Ignite.Domain.reports.json string API url of the report of the indicator.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type String Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.
Ignite.URL.historical_tags string The tags of URL.
Ignite.URL.reports.html string Platform url to access the report of the indicator.
Ignite.URL.reports.json string API url of the report of the indicator.
IP.Address string The IP address.
IP.Malicious.Description string The description of the malicious indicator.
IP.Malicious.Vendor string The vendor used to calculate the severity of the IP address.
IP.Description string The description of the indicator.
IP.Relationships.EntityA string The source of the relationship.
IP.Relationships.EntityB string The destination of the relationship.
IP.Relationships.Relationship string The name of the relationship.
IP.Relationships.EntityAType string The type of the source of the relationship.
IP.Relationships.EntityBType string The type of the destination of the relationship.
Ignite.IP.id String Unique identifier for the document.
Ignite.IP.type String Type of the indicator.
Ignite.IP.value string The value of IP.
Ignite.IP.href string The href of IP.
Ignite.IP.entity_type string The entity type of IP.
Ignite.IP.score.value string The score value of IP.
Ignite.IP.score.last_scored_at string The last scored time of IP.
Ignite.IP.score.raw_score number The raw score of IP.
Ignite.IP.modified_at string Last time when IP was modified.
Ignite.IP.created_at string The creation time of IP.
Ignite.IP.last_seen_at string The last seen time of IP.
Ignite.IP.platform_urls.ignite string The ignite platform url of IP.
Ignite.IP.apt_description string The apt description of IP.
Ignite.IP.external_references.source_name string The source name of external reference.
Ignite.IP.external_references.url string The url of external reference.
Ignite.IP.hashes.md5 string The md5 hash of IP.
Ignite.IP.hashes.sha1 string The sha1 hash of IP.
Ignite.IP.hashes.sha256 string The sha256 hash of IP.
Ignite.IP.malware_description string The malware description of IP.
Ignite.IP.mitre_attack_ids.id string The mitre attack id of IP.
Ignite.IP.mitre_attack_ids.name string The name of mitre attack id.
Ignite.IP.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.IP.relationships.iocs.id string The id of ioc.
Ignite.IP.relationships.iocs.type string The type of ioc.
Ignite.IP.relationships.iocs.value string The value of ioc.
Ignite.IP.relationships.iocs.href string The href of ioc.
Ignite.IP.sightings.source string The source of IP sighting.
Ignite.IP.sightings.sighted_at string The sighted at time of IP.
Ignite.IP.sightings.tags array The tags of IP sighting.
Ignite.IP.sightings.related_iocs.id string The ID of related IOC.
Ignite.IP.sightings.related_iocs.type string The type of related IOC.
Ignite.IP.sightings.related_iocs.value string The value of related IOC.
Ignite.IP.sightings.related_iocs.href string The href of related IOC.
Ignite.IP.latest_sighting.source string The source of IP latest sighting.
Ignite.IP.latest_sighting.sighted_at string The sighted at time of latest sighting of IP.
Ignite.IP.latest_sighting.tags array The tags of IP latest sighting.
Ignite.IP.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.IP.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.IP.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.IP.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.IP.total_sightings integer The total sightings of IP.
Ignite.IP.historical_tags string The tags of IP.
Ignite.IP.reports.html string Platform url to access the report of the indicator.
Ignite.IP.reports.json string API url of the report of the indicator.

Command example

!flashpoint-ignite-indicator-get indicator_id=dummy_id

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "dummy_id",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000002",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            },
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "historical_tags": [
            "malware:pony",
            "os:windows",
            "source:flashpoint_detection",
            "type:stealer"
        ],
        "reports": [
            {
                "html": "https://mock_dummy.com/cti/intelligence/report/report_1",
                "json": "https://mock_dummy.com/finished-intelligence/v1/reports/report_1"
            },
            {
                "html": "https://mock_dummy.com/cti/intelligence/report/report_2",
                "json": "https://mock_dummy.com/finished-intelligence/v1/reports/report_2"
            }
        ]
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Type Hashes Malware Description Tags Related IOCs Hashes Mitre Attack IDs Reports Created At Modified At Last Seen At
dummy_id file md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 - html: https://mock_dummy.com/cti/intelligence/report/report_1
json: https://mock_dummy.com/finished-intelligence/v1/reports/report_1
- html: https://mock_dummy.com/cti/intelligence/report/report_2
json: https://mock_dummy.com/finished-intelligence/v1/reports/report_2		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00  

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

url

Looks up the “URL” type indicator details. The reputation of the URL is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

url

Input

Argument Name Description Required
url A comma-separated list of URLs. Required
exact_match Whether to perform an exact match on the URL value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Url.Event.Href string A list of reference links of the indicator.
Ignite.Url.Event.Url string URL of the indicator.
Ignite.Url.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Url.Event.Category string The category of the indicator.
Ignite.Url.Event.Fpid string The Flashpoint ID of the indicator.
Ignite.Url.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Url.Event.Type string The indicator type.
Ignite.Url.Event.Uuid string The UUID of the indicator.
Ignite.Url.Event.Comment string The comment that was provided when the indicator was observed.
URL.Malicious.Description string The description of the malicious indicator.
URL.Malicious.Vendor string Vendor of the malicious URL.
URL.Data string The URL.
URL.Relationships.EntityA string The source of the relationship.
URL.Relationships.EntityB string The destination of the relationship.
URL.Relationships.Relationship string The name of the relationship.
URL.Relationships.EntityAType string The type of the source of the relationship.
URL.Relationships.EntityBType string The type of the destination of the relationship.
URL.Description string The description of the indicator.
Ignite.URL.id string The ID of URL.
Ignite.URL.type string Type of the indicator.
Ignite.URL.value string The value of URL.
Ignite.URL.href string The href of URL.
Ignite.URL.entity_type string The entity type of URL.
Ignite.URL.score.value string The score value of URL.
Ignite.URL.score.last_scored_at string The last scored time of URL.
Ignite.URL.score.raw_score number The raw score of URL.
Ignite.URL.modified_at string Last time when URL was modified.
Ignite.URL.created_at string The creation time of URL.
Ignite.URL.last_seen_at string The last seen time of URL.
Ignite.URL.sort_date string The sort date of URL.
Ignite.URL.platform_urls.ignite string The ignite platform url of URL.
Ignite.URL.apt_description string The apt description of URL.
Ignite.URL.external_references.source_name string The source name of external reference.
Ignite.URL.external_references.url string The url of external reference.
Ignite.URL.hashes.md5 string The md5 hash of URL.
Ignite.URL.hashes.sha1 string The sha1 hash of URL.
Ignite.URL.hashes.sha256 string The sha256 hash of URL.
Ignite.URL.malware_description string The malware description of URL.
Ignite.URL.mitre_attack_ids.id string The mitre attack id of URL.
Ignite.URL.mitre_attack_ids.name string The name of mitre attack id.
Ignite.URL.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.URL.relationships.iocs.id string The id of ioc.
Ignite.URL.relationships.iocs.type string The type of ioc.
Ignite.URL.relationships.iocs.value string The value of ioc.
Ignite.URL.relationships.iocs.href string The href of ioc.
Ignite.URL.sightings.source string The source of URL sighting.
Ignite.URL.sightings.sighted_at string The sighted at time of URL.
Ignite.URL.sightings.tags array The tags of URL sighting.
Ignite.URL.sightings.related_iocs.id string The ID of related IOC.
Ignite.URL.sightings.related_iocs.type string The type of related IOC.
Ignite.URL.sightings.related_iocs.value string The value of related IOC.
Ignite.URL.sightings.related_iocs.href string The href of related IOC.
Ignite.URL.latest_sighting.source string The source of URL latest sighting.
Ignite.URL.latest_sighting.sighted_at string The sighted at time of latest sighting of URL.
Ignite.URL.latest_sighting.tags array The tags of URL latest sighting.
Ignite.URL.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.URL.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.URL.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.URL.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.URL.total_sightings integer The total sightings of URL.

Command Example

!url url="http://dummy.com"

Context Example

{
    "URL": [
        {
            "Data": "http://dummy.com",
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "http://dummy.com",
                    "EntityAType": "URL",
                    "EntityB": "http://dummyurl.com",
                    "EntityBType": "URL"
                },
                {
                    "Relationship": "related-to",
                    "EntityA": "http://dummy.com",
                    "EntityAType": "URL",
                    "EntityB": "0.0.0.1",
                    "EntityBType": "IP"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "http://dummy.com",
            "Reliability": "B - Usually reliable",
            "Type": "url",
            "Vendor": "Ignite",
            "Score": 2
        }
    ],
    "Ignite.URL": {
        "id": " dummy-id-123",
        "type": "url",
        "value": "http://dummy.com",
        "href": "https://dummy-api.com/dummy-endpoint",
        "entity_type": "indicator",
        "score": {
            "value": "suspicious",
            "last_scored_at": "2025-04-01T00:00:00"
        },
        "modified_at": "2025-04-01T00:00:00",
        "created_at": "2025-04-01T00:00:00",
        "last_seen_at": "2025-04-01T00:00:00",
        "sort_date": "2025-04-01T00:00:00",
        "platform_urls": {
            "ignite": "https://dummy-platform.com/dummy-url"
        },
        "apt_description": "Dummy APT description",
        "malware_description": "Dummy malware description",
        "sightings": [
            {
                "source": "dummy-source",
                "sighted_at": "2025-04-01T00:00:00",
                "tags": [
                    "dummy-tag-1",
                    "dummy-tag-2"
                ],
                "related_iocs": [
                    {
                        "id": "dummy-id-1",
                        "type": "ipv4",
                        "value": "0.0.0.1",
                        "href": "https://dummy-api.com/dummy-endpoint-1"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "dummy-source",
            "sighted_at": "2025-04-01T00:00:00",
            "tags": [
                "dummy_latest_sighting_tag_1",
                "dummy_latest_sighting_tag_2"
            ],
            "related_iocs": [
                {
                    "id": "dummy-id-1",
                    "type": "url",
                    "value": "http://dummyurl.com",
                    "href": "https://dummy-api.com/dummy-endpoint-2"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite URL reputation for http://dummy.com

Reputation: Suspicious

ID URL Malware Description Tags Related IOCs Created At Modified At Last Seen At
dummy-id-123 http://dummy.com Dummy malware description dummy_latest_sighting_tag_1,
dummy_latest_sighting_tag_2,
dummy-tag-1,
dummy-tag-2		 - type: url
value: http://dummyurl.com
- type: ipv4
value: 0.0.0.1		 Apr 01, 2025 00:00 Apr 01, 2025 00:00 Apr 01, 2025 00:00

Platform Link(ignite): https://dummy-platform.com/dummy-url

domain

Looks up the “Domain” type indicator details. The reputation of the domain is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

domain

Input

Argument Name Description Required
domain A comma-separated list of domains. Required
exact_match Whether to perform an exact match on the domain value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Domain.Event.Href string A list of reference links of the indicator.
Ignite.Domain.Event.Domain string The domain of the indicator.
Ignite.Domain.Event.EventDetails string The event details in which the indicator was observed.
Ignite.Domain.Event.Category string The category of the indicator.
Ignite.Domain.Event.Fpid string The Ignite ID of the indicator.
Ignite.Domain.Event.Timestamp string The time and date that the indicator was observed.
Ignite.Domain.Event.Type string The indicator type.
Ignite.Domain.Event.Uuid string The UUID of the indicator.
Ignite.Domain.Event.Comment string The comment that was provided when the indicator was observed.
Ignite.Domain.id string The ID of domain.
Ignite.Domain.type string Type of the indicator.
Ignite.Domain.value string The value of domain.
Ignite.Domain.href string The href of domain.
Ignite.Domain.entity_type string The entity type of domain.
Ignite.Domain.score.value string The score value of domain.
Ignite.Domain.score.last_scored_at string The last scored time of domain.
Ignite.Domain.score.raw_score number The raw score of domain.
Ignite.Domain.modified_at string Last time when domain was modified.
Ignite.Domain.created_at string The creation time of domain.
Ignite.Domain.last_seen_at string The last seen time of domain.
Ignite.Domain.sort_date string The sort date of domain.
Ignite.Domain.platform_urls.ignite string The ignite platform url of domain.
Ignite.Domain.apt_description string The apt description of domain.
Ignite.Domain.external_references.source_name string The source name of external reference.
Ignite.Domain.external_references.url string The url of external reference.
Ignite.Domain.hashes.md5 string The md5 hash of domain.
Ignite.Domain.hashes.sha1 string The sha1 hash of domain.
Ignite.Domain.hashes.sha256 string The sha256 hash of domain.
Ignite.Domain.malware_description string The malware description of domain.
Ignite.Domain.mitre_attack_ids.id string The mitre attack id of domain.
Ignite.Domain.mitre_attack_ids.name string The name of mitre attack id.
Ignite.Domain.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.Domain.relationships.iocs.id string The id of ioc.
Ignite.Domain.relationships.iocs.type string The type of ioc.
Ignite.Domain.relationships.iocs.value string The value of ioc.
Ignite.Domain.relationships.iocs.href string The href of ioc.
Ignite.Domain.sightings.source string The source of domain sighting.
Ignite.Domain.sightings.sighted_at string The sighted at of domain.
Ignite.Domain.sightings.tags array The tags of domain sighting.
Ignite.Domain.sightings.related_iocs.id string The ID of related IOC.
Ignite.Domain.sightings.related_iocs.type string The type of related IOC.
Ignite.Domain.sightings.related_iocs.value string The value of related IOC.
Ignite.Domain.sightings.related_iocs.href string The href of related IOC.
Ignite.Domain.latest_sighting.source string The source of domain latest sighting.
Ignite.Domain.latest_sighting.sighted_at string The sighted at of domain latest sighting.
Ignite.Domain.latest_sighting.tags array The tags of domain latest sighting.
Ignite.Domain.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.Domain.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.Domain.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.Domain.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.Domain.total_sightings integer The total sightings of domain.
Domain.Malicious.Description string The description of the malicious indicator.
Domain.Malicious.Vendor string Vendor of the malicious indicator.
Domain.Name string Name of the domain.
Domain.Description string The description of the indicator.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.

Command example

!domain domain="dummy_domain.com"

Context Example

{
    "DBotScore": [
        {
            "Indicator": "dummy.com",
            "Type": "domain",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Domain": [
        {
            "Name": "dummy.com",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "dummy.com",
                    "EntityAType": "IP",
                    "EntityB": "dummy_value",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "Ignite.Domain": {
        "apt_description": "N/A",
        "created_at": "2025-01-01T01:00:00.000000",
        "entity_type": "indicator",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "id": "dummy_id",
        "last_seen_at": "2025-04-22T11:17:37.981000",
        "latest_sighting": {
            "related_iocs": [
                {
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id_2",
                    "id": "dummy_id_2",
                    "type": "file",
                    "value": "dummy_value"
                }
            ],
            "sighted_at": "2025-01-01T01:00:00.000000",
            "source": "flashpoint_extraction",
            "tags": [
                "extracted_config:true",
                "malware:xworm",
                "source:flashpoint_extraction"
            ]
        },
        "malware_description": "<p>This is dummy description.</p>",
        "modified_at": "2025-01-02T01:00:00.000000",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "score": {
            "last_scored_at": "2025-04-22T11:23:21.569000",
            "value": "malicious"
        },
        "sightings": [
            {
                "related_iocs": [
                    {
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id_3",
                        "id": "dummy_id_3",
                        "type": "file",
                        "value": "dummy_value"
                    }
                ],
                "sighted_at": "2025-04-22T11:17:37.981000",
                "source": "flashpoint_extraction",
                "tags": [
                    "extracted_config:true",
                    "malware:xworm",
                    "source:flashpoint_extraction"
                ]
            }
        ],
        "sort_date": "2025-01-01T01:00:00.000000",
        "total_sightings": 1,
        "type": "domain",
        "value": "dummy_domain.com"
    }
}

Human Readable Output

Ignite Domain reputation for dummy_domain.com

Reputation: Malicious

ID Domain Malware Description Tags Related IOCs Created At Modified At Last Seen At
dummy_id dummy_domain.com This is dummy description. extracted_config:true,
malware:xworm,
source:flashpoint_extraction		 - type: file
value: dummy_value		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

file

Looks up the “File” type indicator details. The reputation of the file is decided from the indicator score if it is found in the Ignite IOC database.

Base Command

file

Input

Argument Name Description Required
file List of files. Required
exact_match Whether to perform an exact match on the file hash value. Possible values are: True, False. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.File.Event.Href string A list of reference links of the indicator.
Ignite.File.Event.MD5 string MD5 file hash of the indicator.
Ignite.File.Event.SHA1 string SHA1 file hash of the indicator.
Ignite.File.Event.SHA256 string SHA256 file hash of the indicator.
Ignite.File.Event.SHA512 string SHA512 file hash of the indicator.
Ignite.File.Event.SSDeep string SSDeep file hash of the indicator.
Ignite.File.Event.EventDetails string The event details in which the indicator was observed.
Ignite.File.Event.Category string The category of the indicator.
Ignite.File.Event.Fpid string The Ignite ID of the indicator.
Ignite.File.Event.Timestamp string The time and date that the indicator was observed.
Ignite.File.Event.Type string The indicator type.
Ignite.File.Event.Uuid string The UUID of the indicator.
Ignite.File.Event.Comment string The comment that was provided when the indicator was observed.
Ignite.File.id string The ID of file.
Ignite.File.type string Type of the indicator.
Ignite.File.value string The value of file.
Ignite.File.href string The href of file.
Ignite.File.entity_type string The entity type of file.
Ignite.File.score.value string The score value of file.
Ignite.File.score.last_scored_at string The last scored time of file.
Ignite.File.score.raw_score number The raw score of file.
Ignite.File.modified_at string Last time when file was modified.
Ignite.File.created_at string The creation time of file.
Ignite.File.last_seen_at string The last seen time of file.
Ignite.File.sort_date string The sort date of file.
Ignite.File.platform_urls.ignite string The ignite platform url of file.
Ignite.File.apt_description string The apt description of file.
Ignite.File.external_references.source_name string The source name of external reference.
Ignite.File.external_references.url string The url of external reference.
Ignite.File.hashes.md5 string The md5 hash of file.
Ignite.File.hashes.sha1 string The sha1 hash of file.
Ignite.File.hashes.sha256 string The sha256 hash of file.
Ignite.File.malware_description string The malware description of file.
Ignite.File.mitre_attack_ids.id string The mitre attack id of file.
Ignite.File.mitre_attack_ids.name string The name of mitre attack id.
Ignite.File.mitre_attack_ids.tactics unknown A list of tactics associated with mitre attack id.
Ignite.File.relationships.iocs.id string The id of ioc.
Ignite.File.relationships.iocs.type string The type of ioc.
Ignite.File.relationships.iocs.value string The value of ioc.
Ignite.File.relationships.iocs.href string The href of ioc.
Ignite.File.sightings.source string The source of file sighting.
Ignite.File.sightings.sighted_at string The sighted at time of file.
Ignite.File.sightings.tags array The tags of file sighting.
Ignite.File.sightings.related_iocs.id string The ID of related IOC.
Ignite.File.sightings.related_iocs.type string The type of related IOC.
Ignite.File.sightings.related_iocs.value string The value of related IOC.
Ignite.File.sightings.related_iocs.href string The href of related IOC.
Ignite.File.latest_sighting.source string The source of file latest sighting.
Ignite.File.latest_sighting.sighted_at string The sighted at time of latest sighting of file.
Ignite.File.latest_sighting.tags array The tags of file latest sighting.
Ignite.File.latest_sighting.related_iocs.id string The ID of related IOC.
Ignite.File.latest_sighting.related_iocs.type string The type of related IOC.
Ignite.File.latest_sighting.related_iocs.value string The value of related IOC.
Ignite.File.latest_sighting.related_iocs.href string The href of related IOC.
Ignite.File.total_sightings integer The total sightings of file.
File.Malicious.Description string The description of the malicious indicator.
File.Malicious.Vendor string Vendor of the malicious file.
File.MD5 string MD5 type file.
File.SHA1 string SHA1 type file.
File.SHA256 string SHA256 type file.
File.SHA512 string SHA512 type file.
File.SSDeep string SSDeep type file.
File.Relationships.EntityA string The source of the relationship.
File.Relationships.EntityB string The destination of the relationship.
File.Relationships.Relationship string The name of the relationship.
File.Relationships.EntityAType string The type of the source of the relationship.
File.Relationships.EntityBType string The type of the destination of the relationship.

Command Example

!file file="00000000000000000000000000000001"

Context Example

{
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "00000000000000000000000000000001"
                },
                {
                    "type": "SHA1",
                    "value": "0000000000000000000000000000000000000001"
                },
                {
                    "type": "SHA256",
                    "value": "0000000000000000000000000000000000000000000000000000000000000001"
                }
            ],
            "MD5": "00000000000000000000000000000001",
            "SHA1": "0000000000000000000000000000000000000001",
            "SHA256": "0000000000000000000000000000000000000000000000000000000000000001",
            "Malicious": {
                "Vendor": "Ignite",
                "Description": "Found in malicious indicators dataset"
            },
            "Relationships": [
                {
                    "Relationship": "related-to",
                    "EntityA": "00000000000000000000000000000001",
                    "EntityAType": "File",
                    "EntityB": "00000000000000000000000000000002",
                    "EntityBType": "File"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "00000000000000000000000000000001",
            "Type": "file",
            "Vendor": "Ignite",
            "Score": 3,
            "Reliability": "B - Usually reliable"
        }
    ],
    "Ignite.File": {
        "id": "dummy_id",
        "type": "file",
        "value": "00000000000000000000000000000001",
        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id",
        "entity_type": "indicator",
        "score": {
            "value": "malicious",
            "last_scored_at": "2025-01-02T01:00:00.000001"
        },
        "modified_at": "2025-01-02T01:00:00.000001",
        "created_at": "2025-01-01T01:00:00.000000",
        "last_seen_at": "2025-01-02T01:00:00.000001",
        "sort_date": "2025-01-02T01:00:00.000001",
        "platform_urls": {
            "ignite": "https://mock_dummy.com/cti/malware/iocs/dummy_id"
        },
        "apt_description": "N/A",
        "hashes": {
            "md5": "00000000000000000000000000000001",
            "sha1": "0000000000000000000000000000000000000001",
            "sha256": "0000000000000000000000000000000000000000000000000000000000000001"
        },
        "malware_description": "dummy description.",
        "mitre_attack_ids": [
            {
                "id": "dummy_mitre_id",
                "name": "dummy name",
                "tactics": [
                    "Defense Evasion"
                ]
            }
        ],
        "sightings": [
            {
                "source": "flashpoint_detection",
                "sighted_at": "2025-01-02T01:00:00.000000",
                "tags": [
                    "malware:pony",
                    "os:windows",
                    "source:flashpoint_detection",
                    "type:stealer"
                ],
                "related_iocs": [
                    {
                        "id": "dummy_id",
                        "type": "file",
                        "value": "00000000000000000000000000000001",
                        "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                    }
                ]
            }
        ],
        "latest_sighting": {
            "source": "flashpoint_detection",
            "sighted_at": "2025-01-02T01:00:00.000000",
            "tags": [
                "malware:pony",
                "os:windows",
                "source:flashpoint_detection",
                "type:stealer"
            ],
            "related_iocs": [
                {
                    "id": "dummy_id",
                    "type": "file",
                    "value": "00000000000000000000000000000001",
                    "href": "https://mock_dummy.com/technical-intelligence/v2/indicators/dummy_id"
                }
            ]
        },
        "total_sightings": 1
    }
}

Human Readable Output

Ignite File reputation for 00000000000000000000000000000001

Reputation: Malicious

ID Hash Type Hashes Malware Description Tags Related IOCs Mitre Attack IDs Created At Modified At Last Seen At
dummy_id md5 md5: 00000000000000000000000000000001
sha1: 0000000000000000000000000000000000000001
sha256: 0000000000000000000000000000000000000000000000000000000000000001		 dummy description. malware:pony,
os:windows,
source:flashpoint_detection,
type:stealer		 - type: file
value: 00000000000000000000000000000002		 - id: dummy_mitre_id
name: dummy name
tactics:
values: Defense Evasion		 Jan 01, 2025 01:00 Jan 02, 2025 01:00 Jan 02, 2025 01:00

Platform Link(ignite): https://mock_dummy.com/cti/malware/iocs/dummy_id

flashpoint-ignite-vulnerability-get

Retrieves detailed information about a specific vulnerability by its Flashpoint ID.

Base Command

flashpoint-ignite-vulnerability-get

Input

Argument Name Description Required
id The Flashpoint ID of the vulnerability to retrieve. Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE, for example: CVE-2015-1653.
CVE.CVSS String The CVSS of the CVE, for example: 10.0.
CVE.Version String The version of the CVE, for example: 3.0.
CVE.Vector String The vector of the CVE, for example: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N.
CVE.Table String The table of the CVE.
CVE.Published Date The timestamp of when the CVE was published.
CVE.Modified Date The timestamp of when the CVE was last modified.
CVE.Description String A description of the CVE.
CVE.Tags String The tags of the CVE.
CVE.VulnerableProducts String The vulnerable products of the CVE.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.timelines.vendor_response_time String The time taken for vendor response.
Ignite.Vulnerability.timelines.time_to_patch String The time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_patch String The total time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.time_unpatched String The time the vulnerability remained unpatched.
Ignite.Vulnerability.timelines.time_to_exploit String The time taken to exploit the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_exploit String The total time taken to exploit the vulnerability.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.cve_id String The CVE ID associated with the social risk score.
Ignite.Vulnerability.scores.social_risk_scores.numeric_score Number A numeric social risk score.
Ignite.Vulnerability.scores.social_risk_scores.categorical_score String A categorical social risk score.
Ignite.Vulnerability.scores.social_risk_scores.score_date Date The date when the social risk score was calculated.
Ignite.Vulnerability.scores.social_risk_scores.todays_tweets Number The number of tweets today about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.total_tweets Number The total number of tweets about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.unique_users Number The number of unique users discussing the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.alternate_vulndb_id String An alternate VulnDB ID.
Ignite.Vulnerability.changelog.created_at Date The date when the changelog entry was created.
Ignite.Vulnerability.changelog.description String The description of the changelog entry.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.nvd_additional_information.cve_id String The CVE ID from NVD.
Ignite.Vulnerability.nvd_additional_information.summary String The summary from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.cwe_id String The CWE identifier from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.name String The name of the CWE from NVD.
Ignite.Vulnerability.nvd_additional_information.references.name String The name of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.references.url String The URL of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_vector String The CVSS v2 access vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_complexity String The CVSS v2 access complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.authentication String The CVSS v2 authentication from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.integrity_impact String The CVSS v2 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.availability_impact Number The CVSS v2 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_vector String The CVSS v3 attack vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_complexity String The CVSS v3 attack complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.privileges_required String The CVSS v3 privileges required from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.user_interaction String The CVSS v3 user interaction from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.scope String The CVSS v3 scope from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.integrity_impact String The CVSS v3 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.availability_impact String The CVSS v3 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.score Number The CVSS v3 score from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.vector_string String The CVSS v3 vector string from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.version String The CVSS v3 version from NVD.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.creditees.name String The name of the individual or organization credited.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score String The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.
Ignite.Vulnerability.products.id Number The ID of the affected product.
Ignite.Vulnerability.products.name String The name of the affected product.
Ignite.Vulnerability.products.vendor_id Number The vendor ID of the affected product.
Ignite.Vulnerability.products.vendor String The vendor name of the affected product.
Ignite.Vulnerability.products.versions.id Number The ID of the product version.
Ignite.Vulnerability.products.versions.vulndb_version_id Number The VulnDB version ID.
Ignite.Vulnerability.products.versions.name String The name of the product version.
Ignite.Vulnerability.products.versions.affected String A string indicating whether the product version is affected.
Ignite.Vulnerability.products.versions.all_prior_versions_affected Boolean A boolean indicating whether all prior versions are affected.
Ignite.Vulnerability.products.versions.cpes.name String The CPE (Common Platform Enumeration) name.
Ignite.Vulnerability.products.versions.cpes.source String The source of the CPE.

Command Example

!flashpoint-ignite-vulnerability-get id="123456"

Context Example

{
    "CVE": [
        {
            "CVSS": {
                "Score": 9.2,
                "Table": [
                    {
                        "metrics": "score",
                        "value": 9.2
                    },
                    {
                        "metrics": "threat_score",
                        "value": 8.5
                    },
                    {
                        "metrics": "source",
                        "value": "http://nvd.nist.gov"
                    },
                    {
                        "metrics": "generated_at",
                        "value": "2024-01-15T00:00:00Z"
                    },
                    {
                        "metrics": "updated_at",
                        "value": "2024-06-15T10:30:00Z"
                    },
                    {
                        "metrics": "cve_id",
                        "value": "CVE-2024-0001"
                    },
                    {
                        "metrics": "vector_string",
                        "value": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                    },
                    {
                        "metrics": "version",
                        "value": "4.0"
                    },
                    {
                        "metrics": "attack_vector",
                        "value": "NETWORK"
                    },
                    {
                        "metrics": "attack_complexity",
                        "value": "LOW"
                    },
                    {
                        "metrics": "attack_requirements",
                        "value": "NONE"
                    },
                    {
                        "metrics": "privileges_required",
                        "value": "NONE"
                    },
                    {
                        "metrics": "user_interaction",
                        "value": "NONE"
                    },
                    {
                        "metrics": "exploit_maturity",
                        "value": "PROOF_OF_CONCEPT"
                    },
                    {
                        "metrics": "vulnerable_system_confidentiality_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_integrity_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_availability_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "subsequent_system_confidentiality_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_integrity_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_availability_impact",
                        "value": "NONE"
                    }
                ],
                "Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "Version": "4.0"
            },
            "Description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "ID": "CVE-2024-0002",
            "Modified": "2024-06-15T10:30:00Z",
            "Published": "2024-01-01T00:00:00Z",
            "Tags": [
                "test",
                "dummy",
                "critical"
            ],
            "VulnerableProducts": [
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*"
                },
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2024-0002",
            "Score": 0,
            "Type": "cve",
            "Vendor": "Ignite"
        }
    ],
    "Ignite": {
        "Vulnerability": {
            "id": 123456,
            "cve_ids": [
                "CVE-2024-0001",
                "CVE-2024-0002"
            ],
            "title": "Dummy Vulnerability Title for Testing",
            "keywords": "test, dummy, vulnerability",
            "description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "solution": "Apply the latest security patch or upgrade to version 2.0 or higher.",
            "technical_description": "Technical details about the dummy vulnerability for testing.",
            "timelines": {
                "published_at": "2024-01-01T00:00:00Z",
                "last_modified_at": "2024-06-15T10:30:00Z",
                "exploit_published_at": "2024-02-10T00:00:00Z",
                "discovered_at": "2023-12-15T00:00:00Z",
                "disclosed_at": "2024-01-05T00:00:00Z",
                "vendor_informed_at": "2023-12-20T00:00:00Z",
                "vendor_acknowledged_at": "2023-12-22T00:00:00Z",
                "solution_provided_at": "2024-01-30T00:00:00Z",
                "exploited_in_the_wild_at": "2024-03-01T00:00:00Z",
                "vendor_response_time": "2 days",
                "time_to_patch": "25 days",
                "total_time_to_patch": "46 days",
                "time_unpatched": "30 days, 0:00:00",
                "time_to_exploit": "40 days, 0:00:00",
                "total_time_to_exploit": "75 days"
            },
            "scores": {
                "epss_score": 0.75,
                "epss_v1_score": 0.68,
                "ransomware_score": 0.45,
                "severity": "Critical",
                "social_risk_scores": [
                    {
                        "cve_id": "CVE-2024-0001",
                        "numeric_score": 8.5,
                        "categorical_score": "High",
                        "score_date": "2024-06-15T10:30:00Z",
                        "todays_tweets": 25,
                        "total_tweets": 150,
                        "unique_users": 75
                    }
                ]
            },
            "vuln_status": "Active",
            "changelog": [
                {
                    "created_at": "2024-06-15T10:30:00Z",
                    "description": "Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to \"Affected\""
                },
                {
                    "created_at": "2024-05-20T14:20:00Z",
                    "description": "Initial vulnerability entry created"
                }
            ],
            "cwes": [
                {
                    "cwe_id": "CWE-79",
                    "name": "Improper Neutralization of Input During Web Page Generation"
                },
                {
                    "cwe_id": "CWE-89",
                    "name": "SQL Injection"
                }
            ],
            "exploits": [
                {
                    "value": "http://www.exploit-db.com/exploits/99999",
                    "type": "Exploit Database"
                },
                {
                    "value": "http://packetstormsecurity.com/files/dummy-exploit",
                    "type": "Packet Storm"
                }
            ],
            "exploits_count": 2,
            "ext_references": [
                {
                    "value": "12345",
                    "type": "Snort Signature ID",
                    "created_at": "2024-01-15T00:00:00Z",
                    "description": "Dummy Snort signature for testing",
                    "url": "http://www.snort.org/sid/12345"
                },
                {
                    "value": "TEST-2024-001",
                    "type": "Security Advisory",
                    "created_at": "2024-01-10T00:00:00Z",
                    "description": "Test security advisory reference",
                    "url": "http://security.example.com/advisory/TEST-2024-001"
                }
            ],
            "nvd_additional_information": [
                {
                    "cve_id": "CVE-2024-0001",
                    "summary": "Dummy vulnerability summary from NVD for testing purposes. This describes a hypothetical security issue in a test application.",
                    "cwes": [
                        {
                            "cwe_id": "CWE-79",
                            "name": "Cross-site Scripting"
                        }
                    ],
                    "references": [
                        {
                            "name": "99999",
                            "url": "http://www.securityfocus.com/bid/99999"
                        },
                        {
                            "name": "TEST-ADV-2024",
                            "url": "http://security.example.com/advisory/test"
                        }
                    ],
                    "cvss_v2s": [
                        {
                            "access_vector": "NETWORK",
                            "access_complexity": "LOW",
                            "authentication": "NONE",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5
                        }
                    ],
                    "cvss_v3s": [
                        {
                            "attack_vector": "NETWORK",
                            "attack_complexity": "LOW",
                            "privileges_required": "NONE",
                            "user_interaction": "PARTIAL",
                            "scope": "PARTIAL",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5,
                            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                            "version": "3.1"
                        }
                    ]
                }
            ],
            "classifications": [
                {
                    "name": "location_remote",
                    "longname": "Remote / Network Access",
                    "description": "This vulnerability can be exploited remotely over a network."
                },
                {
                    "name": "access_complexity_low",
                    "longname": "Low Access Complexity",
                    "description": "Exploitation requires minimal specialized access or circumstances."
                }
            ],
            "creditees": [
                {
                    "name": "Test Security Researcher"
                },
                {
                    "name": "Dummy Research Team"
                }
            ],
            "cvss_v2s": [
                {
                    "access_vector": "NETWORK",
                    "access_complexity": "LOW",
                    "authentication": "NONE",
                    "confidentiality_impact": "COMPLETE",
                    "integrity_impact": "COMPLETE",
                    "availability_impact": "COMPLETE",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 10.0,
                    "calculated_cvss_base_score": 10.0
                }
            ],
            "cvss_v3s": [
                {
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "scope": "CHANGED",
                    "confidentiality_impact": "HIGH",
                    "integrity_impact": "HIGH",
                    "availability_impact": "HIGH",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 9.8,
                    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                    "version": "3.1",
                    "remediation_level": "Official Fix",
                    "report_confidence": "Confirmed",
                    "exploit_code_maturity": "Proof-of-Concept",
                    "temporal_score": "8.9",
                    "updated_at": "2024-06-15T10:30:00Z"
                }
            ],
            "cvss_v4s": [
                {
                    "score": 9.2,
                    "threat_score": 8.5,
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "updated_at": "2024-06-15T10:30:00Z",
                    "cve_id": "CVE-2024-0001",
                    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "version": "4.0",
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "attack_requirements": "NONE",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "exploit_maturity": "PROOF_OF_CONCEPT",
                    "vulnerable_system_confidentiality_impact": "HIGH",
                    "vulnerable_system_integrity_impact": "HIGH",
                    "vulnerable_system_availability_impact": "HIGH",
                    "subsequent_system_confidentiality_impact": "NONE",
                    "subsequent_system_integrity_impact": "NONE",
                    "subsequent_system_availability_impact": "NONE"
                }
            ],
            "tags": [
                "test",
                "dummy",
                "critical"
            ],
            "products": [
                {
                    "id": 99999,
                    "name": "Dummy Test Application",
                    "versions": [
                        {
                            "id": 88888,
                            "vulndb_version_id": 77777,
                            "name": "1.0",
                            "affected": "Affected",
                            "all_prior_versions_affected": true,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        },
                        {
                            "id": 88889,
                            "vulndb_version_id": 77778,
                            "name": "1.5",
                            "affected": "Affected",
                            "all_prior_versions_affected": false,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        }
                    ],
                    "vendor_id": 12345,
                    "vendor": "Test Vendor Corporation"
                }
            ]
        }
    }
}

Human Readable Output

Ignite FP-VULN-123456 Vulnerability Details for: CVE-2024-0001, CVE-2024-0002

Vulnerability Information

ID Title Status Keywords Description Solution Technical Description Exploits Count Tags Creditees
123456 Dummy Vulnerability Title for Testing Active test, dummy, vulnerability This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application. Apply the latest security patch or upgrade to version 2.0 or higher. Technical details about the dummy vulnerability for testing. 2 test, dummy, critical - name: Test Security Researcher
- name: Dummy Research Team

Score Information

EPSS Score EPSS v1 Score Ransomware Score Severity Social Risk Scores
0.75 0.68 0.45 Critical - cve_id: CVE-2024-0001
numeric_score: 8.5
categorical_score: High
score_date: 2024-06-15T10:30:00Z
todays_tweets: 25
total_tweets: 150
unique_users: 75

Timeline Information

Published At Last Modified At Discovered At Disclosed At Vendor Informed At Vendor Acknowledged At Solution Provided At Exploited In The Wild At Vendor Response Time Time To Patch Total Time To Patch Time Unpatched Time To Exploit Total Time To Exploit
2024-01-01T00:00:00Z 2024-06-15T10:30:00Z 2023-12-15T00:00:00Z 2024-01-05T00:00:00Z 2023-12-20T00:00:00Z 2023-12-22T00:00:00Z 2024-01-30T00:00:00Z 2024-03-01T00:00:00Z 2 days 25 days 46 days 30 days, 0:00:00 40 days, 0:00:00 75 days

CVSS v2 Scores

Score Source Generated At CVE ID Calculated CVSS Base Score Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
10.0 http://nvd.nist.gov 2024-01-15T00:00:00Z CVE-2024-0001 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE

CVSS v3 Scores

Score Vector String Source Version Updated At Generated At CVE ID Temporal Score Calculated CVSS Base Score Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability Impact Remediation Level Report Confidence Exploit Code Maturity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H http://nvd.nist.gov 3.1 2024-06-15T10:30:00Z 2024-01-15T00:00:00Z CVE-2024-0001 8.9 N/A NETWORK LOW NONE NONE CHANGED HIGH HIGH HIGH Official Fix Confirmed Proof-of-Concept

CVSS v4 Score

Score Vector String Threat Score Source Version Generated At Updated At CVE ID Attack Vector Attack Complexity Attack Requirements Privileges Required User Interaction Exploit Maturity Vulnerable System Confidentiality Impact Vulnerable System Integrity Impact Vulnerable System Availability Impact Subsequent System Confidentiality Impact Subsequent System Integrity Impact Subsequent System Availability Impact
9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.5 http://nvd.nist.gov 4.0 2024-01-15T00:00:00Z 2024-06-15T10:30:00Z CVE-2024-0001 NETWORK LOW NONE NONE NONE PROOF_OF_CONCEPT HIGH HIGH HIGH NONE NONE NONE

Affected Products

Product ID Product Vendor ID Vendor Versions
99999 Dummy Test Application 12345 Test Vendor Corporation - id: 88888
vulndb_version_id: 77777
name: 1.0
affected: Affected
all_prior_versions_affected: true
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.0:::::::
_source: Official
- id: 88889
vulndb_version_id: 77778
name: 1.5
affected: Affected
all_prior_versions_affected: false
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.5:::::::
_source: Official

External References

Value Type URL Description Created At
12345 Snort Signature ID http://www.snort.org/sid/12345 Dummy Snort signature for testing 2024-01-15T00:00:00Z
TEST-2024-001 Security Advisory http://security.example.com/advisory/TEST-2024-001 Test security advisory reference 2024-01-10T00:00:00Z

CWES

CWE ID Name Source CVE IDs
CWE-79 Improper Neutralization of Input During Web Page Generation N/A N/A
CWE-89 SQL Injection N/A N/A

Exploits

Value Type
http://www.exploit-db.com/exploits/99999 Exploit Database
http://packetstormsecurity.com/files/dummy-exploit Packet Storm

Changelog

Created At Description
2024-06-15T10:30:00Z Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to “Affected”
2024-05-20T14:20:00Z Initial vulnerability entry created

cve

Retrieves detailed information about a specific CVE by its CVE ID.

Base Command

cve

Input

Argument Name Description Required
cve List of CVEs. Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE, for example: CVE-2015-1653.
CVE.CVSS String The CVSS of the CVE, for example: 10.0.
CVE.Version String The version of the CVE, for example: 3.0.
CVE.Vector String The vector of the CVE, for example: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N.
CVE.Table String The table of the CVE.
CVE.Published Date The timestamp of when the CVE was published.
CVE.Modified Date The timestamp of when the CVE was last modified.
CVE.Description String A description of the CVE.
CVE.Tags String The tags of the CVE.
CVE.VulnerableProducts String The vulnerable products of the CVE.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Reliability string The reliability of the vendor.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.timelines.vendor_response_time String The time taken for vendor response.
Ignite.Vulnerability.timelines.time_to_patch String The time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_patch String The total time taken to patch the vulnerability.
Ignite.Vulnerability.timelines.time_unpatched String The time the vulnerability remained unpatched.
Ignite.Vulnerability.timelines.time_to_exploit String The time taken to exploit the vulnerability.
Ignite.Vulnerability.timelines.total_time_to_exploit String The total time taken to exploit the vulnerability.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.cve_id String The CVE ID associated with the social risk score.
Ignite.Vulnerability.scores.social_risk_scores.numeric_score Number A numeric social risk score.
Ignite.Vulnerability.scores.social_risk_scores.categorical_score String A categorical social risk score.
Ignite.Vulnerability.scores.social_risk_scores.score_date Date The date when the social risk score was calculated.
Ignite.Vulnerability.scores.social_risk_scores.todays_tweets Number The number of tweets today about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.total_tweets Number The total number of tweets about the vulnerability.
Ignite.Vulnerability.scores.social_risk_scores.unique_users Number The number of unique users discussing the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.alternate_vulndb_id String An alternate VulnDB ID.
Ignite.Vulnerability.changelog.created_at Date The date when the changelog entry was created.
Ignite.Vulnerability.changelog.description String The description of the changelog entry.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.nvd_additional_information.cve_id String The CVE ID from NVD.
Ignite.Vulnerability.nvd_additional_information.summary String The summary from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.cwe_id String The CWE identifier from NVD.
Ignite.Vulnerability.nvd_additional_information.cwes.name String The name of the CWE from NVD.
Ignite.Vulnerability.nvd_additional_information.references.name String The name of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.references.url String The URL of the NVD reference.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_vector String The CVSS v2 access vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.access_complexity String The CVSS v2 access complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.authentication String The CVSS v2 authentication from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.integrity_impact String The CVSS v2 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v2s.availability_impact Number The CVSS v2 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_vector String The CVSS v3 attack vector from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.attack_complexity String The CVSS v3 attack complexity from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.privileges_required String The CVSS v3 privileges required from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.user_interaction String The CVSS v3 user interaction from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.scope String The CVSS v3 scope from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.integrity_impact String The CVSS v3 integrity impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.availability_impact String The CVSS v3 availability impact from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.score Number The CVSS v3 score from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.vector_string String The CVSS v3 vector string from NVD.
Ignite.Vulnerability.nvd_additional_information.cvss_v3s.version String The CVSS v3 version from NVD.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.creditees.name String The name of the individual or organization credited.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score String The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.
Ignite.Vulnerability.products.id Number The ID of the affected product.
Ignite.Vulnerability.products.name String The name of the affected product.
Ignite.Vulnerability.products.vendor_id Number The vendor ID of the affected product.
Ignite.Vulnerability.products.vendor String The vendor name of the affected product.
Ignite.Vulnerability.products.versions.id Number The ID of the product version.
Ignite.Vulnerability.products.versions.vulndb_version_id Number The VulnDB version ID.
Ignite.Vulnerability.products.versions.name String The name of the product version.
Ignite.Vulnerability.products.versions.affected String A string indicating whether the product version is affected.
Ignite.Vulnerability.products.versions.all_prior_versions_affected Boolean A boolean indicating whether all prior versions are affected.
Ignite.Vulnerability.products.versions.cpes.name String The CPE (Common Platform Enumeration) name.
Ignite.Vulnerability.products.versions.cpes.source String The source of the CPE.

Command Example

!cve cve="CVE-2024-0002"

Context Example

{
    "CVE": [
        {
            "CVSS": {
                "Score": 9.2,
                "Table": [
                    {
                        "metrics": "score",
                        "value": 9.2
                    },
                    {
                        "metrics": "threat_score",
                        "value": 8.5
                    },
                    {
                        "metrics": "source",
                        "value": "http://nvd.nist.gov"
                    },
                    {
                        "metrics": "generated_at",
                        "value": "2024-01-15T00:00:00Z"
                    },
                    {
                        "metrics": "updated_at",
                        "value": "2024-06-15T10:30:00Z"
                    },
                    {
                        "metrics": "cve_id",
                        "value": "CVE-2024-0001"
                    },
                    {
                        "metrics": "vector_string",
                        "value": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                    },
                    {
                        "metrics": "version",
                        "value": "4.0"
                    },
                    {
                        "metrics": "attack_vector",
                        "value": "NETWORK"
                    },
                    {
                        "metrics": "attack_complexity",
                        "value": "LOW"
                    },
                    {
                        "metrics": "attack_requirements",
                        "value": "NONE"
                    },
                    {
                        "metrics": "privileges_required",
                        "value": "NONE"
                    },
                    {
                        "metrics": "user_interaction",
                        "value": "NONE"
                    },
                    {
                        "metrics": "exploit_maturity",
                        "value": "PROOF_OF_CONCEPT"
                    },
                    {
                        "metrics": "vulnerable_system_confidentiality_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_integrity_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "vulnerable_system_availability_impact",
                        "value": "HIGH"
                    },
                    {
                        "metrics": "subsequent_system_confidentiality_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_integrity_impact",
                        "value": "NONE"
                    },
                    {
                        "metrics": "subsequent_system_availability_impact",
                        "value": "NONE"
                    }
                ],
                "Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "Version": "4.0"
            },
            "Description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "ID": "CVE-2024-0002",
            "Modified": "2024-06-15T10:30:00Z",
            "Published": "2024-01-01T00:00:00Z",
            "Tags": [
                "test",
                "dummy",
                "critical"
            ],
            "VulnerableProducts": [
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*"
                },
                {
                    "CPE": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*"
                }
            ]
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2024-0002",
            "Score": 0,
            "Type": "cve",
            "Vendor": "Ignite"
        }
    ],
    "Ignite": {
        "Vulnerability": {
            "id": 123456,
            "cve_ids": [
                "CVE-2024-0001",
                "CVE-2024-0002"
            ],
            "title": "Dummy Vulnerability Title for Testing",
            "keywords": "test, dummy, vulnerability",
            "description": "This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application.",
            "solution": "Apply the latest security patch or upgrade to version 2.0 or higher.",
            "technical_description": "Technical details about the dummy vulnerability for testing.",
            "timelines": {
                "published_at": "2024-01-01T00:00:00Z",
                "last_modified_at": "2024-06-15T10:30:00Z",
                "exploit_published_at": "2024-02-10T00:00:00Z",
                "discovered_at": "2023-12-15T00:00:00Z",
                "disclosed_at": "2024-01-05T00:00:00Z",
                "vendor_informed_at": "2023-12-20T00:00:00Z",
                "vendor_acknowledged_at": "2023-12-22T00:00:00Z",
                "solution_provided_at": "2024-01-30T00:00:00Z",
                "exploited_in_the_wild_at": "2024-03-01T00:00:00Z",
                "vendor_response_time": "2 days",
                "time_to_patch": "25 days",
                "total_time_to_patch": "46 days",
                "time_unpatched": "30 days, 0:00:00",
                "time_to_exploit": "40 days, 0:00:00",
                "total_time_to_exploit": "75 days"
            },
            "scores": {
                "epss_score": 0.75,
                "epss_v1_score": 0.68,
                "ransomware_score": 0.45,
                "severity": "Critical",
                "social_risk_scores": [
                    {
                        "cve_id": "CVE-2024-0001",
                        "numeric_score": 8.5,
                        "categorical_score": "High",
                        "score_date": "2024-06-15T10:30:00Z",
                        "todays_tweets": 25,
                        "total_tweets": 150,
                        "unique_users": 75
                    }
                ]
            },
            "vuln_status": "Active",
            "changelog": [
                {
                    "created_at": "2024-06-15T10:30:00Z",
                    "description": "Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to \"Affected\""
                },
                {
                    "created_at": "2024-05-20T14:20:00Z",
                    "description": "Initial vulnerability entry created"
                }
            ],
            "cwes": [
                {
                    "cwe_id": "CWE-79",
                    "name": "Improper Neutralization of Input During Web Page Generation"
                },
                {
                    "cwe_id": "CWE-89",
                    "name": "SQL Injection"
                }
            ],
            "exploits": [
                {
                    "value": "http://www.exploit-db.com/exploits/99999",
                    "type": "Exploit Database"
                },
                {
                    "value": "http://packetstormsecurity.com/files/dummy-exploit",
                    "type": "Packet Storm"
                }
            ],
            "exploits_count": 2,
            "ext_references": [
                {
                    "value": "12345",
                    "type": "Snort Signature ID",
                    "created_at": "2024-01-15T00:00:00Z",
                    "description": "Dummy Snort signature for testing",
                    "url": "http://www.snort.org/sid/12345"
                },
                {
                    "value": "TEST-2024-001",
                    "type": "Security Advisory",
                    "created_at": "2024-01-10T00:00:00Z",
                    "description": "Test security advisory reference",
                    "url": "http://security.example.com/advisory/TEST-2024-001"
                }
            ],
            "nvd_additional_information": [
                {
                    "cve_id": "CVE-2024-0001",
                    "summary": "Dummy vulnerability summary from NVD for testing purposes. This describes a hypothetical security issue in a test application.",
                    "cwes": [
                        {
                            "cwe_id": "CWE-79",
                            "name": "Cross-site Scripting"
                        }
                    ],
                    "references": [
                        {
                            "name": "99999",
                            "url": "http://www.securityfocus.com/bid/99999"
                        },
                        {
                            "name": "TEST-ADV-2024",
                            "url": "http://security.example.com/advisory/test"
                        }
                    ],
                    "cvss_v2s": [
                        {
                            "access_vector": "NETWORK",
                            "access_complexity": "LOW",
                            "authentication": "NONE",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5
                        }
                    ],
                    "cvss_v3s": [
                        {
                            "attack_vector": "NETWORK",
                            "attack_complexity": "LOW",
                            "privileges_required": "NONE",
                            "user_interaction": "PARTIAL",
                            "scope": "PARTIAL",
                            "confidentiality_impact": "PARTIAL",
                            "integrity_impact": "PARTIAL",
                            "availability_impact": "PARTIAL",
                            "score": 7.5,
                            "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                            "version": "3.1"
                        }
                    ]
                }
            ],
            "classifications": [
                {
                    "name": "location_remote",
                    "longname": "Remote / Network Access",
                    "description": "This vulnerability can be exploited remotely over a network."
                },
                {
                    "name": "access_complexity_low",
                    "longname": "Low Access Complexity",
                    "description": "Exploitation requires minimal specialized access or circumstances."
                }
            ],
            "creditees": [
                {
                    "name": "Test Security Researcher"
                },
                {
                    "name": "Dummy Research Team"
                }
            ],
            "cvss_v2s": [
                {
                    "access_vector": "NETWORK",
                    "access_complexity": "LOW",
                    "authentication": "NONE",
                    "confidentiality_impact": "COMPLETE",
                    "integrity_impact": "COMPLETE",
                    "availability_impact": "COMPLETE",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 10.0,
                    "calculated_cvss_base_score": 10.0
                }
            ],
            "cvss_v3s": [
                {
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "scope": "CHANGED",
                    "confidentiality_impact": "HIGH",
                    "integrity_impact": "HIGH",
                    "availability_impact": "HIGH",
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "cve_id": "CVE-2024-0001",
                    "score": 9.8,
                    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                    "version": "3.1",
                    "remediation_level": "Official Fix",
                    "report_confidence": "Confirmed",
                    "exploit_code_maturity": "Proof-of-Concept",
                    "temporal_score": "8.9",
                    "updated_at": "2024-06-15T10:30:00Z"
                }
            ],
            "cvss_v4s": [
                {
                    "score": 9.2,
                    "threat_score": 8.5,
                    "source": "http://nvd.nist.gov",
                    "generated_at": "2024-01-15T00:00:00Z",
                    "updated_at": "2024-06-15T10:30:00Z",
                    "cve_id": "CVE-2024-0001",
                    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "version": "4.0",
                    "attack_vector": "NETWORK",
                    "attack_complexity": "LOW",
                    "attack_requirements": "NONE",
                    "privileges_required": "NONE",
                    "user_interaction": "NONE",
                    "exploit_maturity": "PROOF_OF_CONCEPT",
                    "vulnerable_system_confidentiality_impact": "HIGH",
                    "vulnerable_system_integrity_impact": "HIGH",
                    "vulnerable_system_availability_impact": "HIGH",
                    "subsequent_system_confidentiality_impact": "NONE",
                    "subsequent_system_integrity_impact": "NONE",
                    "subsequent_system_availability_impact": "NONE"
                }
            ],
            "tags": [
                "test",
                "dummy",
                "critical"
            ],
            "products": [
                {
                    "id": 99999,
                    "name": "Dummy Test Application",
                    "versions": [
                        {
                            "id": 88888,
                            "vulndb_version_id": 77777,
                            "name": "1.0",
                            "affected": "Affected",
                            "all_prior_versions_affected": true,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.0:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        },
                        {
                            "id": 88889,
                            "vulndb_version_id": 77778,
                            "name": "1.5",
                            "affected": "Affected",
                            "all_prior_versions_affected": false,
                            "cpes": [
                                {
                                    "name": "cpe:2.3:a:testvendor:dummyapp:1.5:*:*:*:*:*:*:*",
                                    "source": "Official"
                                }
                            ]
                        }
                    ],
                    "vendor_id": 12345,
                    "vendor": "Test Vendor Corporation"
                }
            ]
        }
    }
}

Human Readable Output

Ignite CVE Details for: CVE-2024-0001, CVE-2024-0002

Vulnerability Information

ID Title Status Keywords Description Solution Technical Description Exploits Count Tags Creditees
123456 Dummy Vulnerability Title for Testing Active test, dummy, vulnerability This is a dummy vulnerability description for testing purposes. It describes a hypothetical security flaw in a test application. Apply the latest security patch or upgrade to version 2.0 or higher. Technical details about the dummy vulnerability for testing. 2 test, dummy, critical - name: Test Security Researcher
- name: Dummy Research Team

Score Information

EPSS Score EPSS v1 Score Ransomware Score Severity Social Risk Scores
0.75 0.68 0.45 Critical - cve_id: CVE-2024-0001
numeric_score: 8.5
categorical_score: High
score_date: 2024-06-15T10:30:00Z
todays_tweets: 25
total_tweets: 150
unique_users: 75

Timeline Information

Published At Last Modified At Discovered At Disclosed At Vendor Informed At Vendor Acknowledged At Solution Provided At Exploited In The Wild At Vendor Response Time Time To Patch Total Time To Patch Time Unpatched Time To Exploit Total Time To Exploit
2024-01-01T00:00:00Z 2024-06-15T10:30:00Z 2023-12-15T00:00:00Z 2024-01-05T00:00:00Z 2023-12-20T00:00:00Z 2023-12-22T00:00:00Z 2024-01-30T00:00:00Z 2024-03-01T00:00:00Z 2 days 25 days 46 days 30 days, 0:00:00 40 days, 0:00:00 75 days

CVSS v2 Scores

Score Source Generated At CVE ID Calculated CVSS Base Score Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
10.0 http://nvd.nist.gov 2024-01-15T00:00:00Z CVE-2024-0001 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE

CVSS v3 Scores

Score Vector String Source Version Updated At Generated At CVE ID Temporal Score Calculated CVSS Base Score Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability Impact Remediation Level Report Confidence Exploit Code Maturity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H http://nvd.nist.gov 3.1 2024-06-15T10:30:00Z 2024-01-15T00:00:00Z CVE-2024-0001 8.9 N/A NETWORK LOW NONE NONE CHANGED HIGH HIGH HIGH Official Fix Confirmed Proof-of-Concept

CVSS v4 Score

Score Vector String Threat Score Source Version Generated At Updated At CVE ID Attack Vector Attack Complexity Attack Requirements Privileges Required User Interaction Exploit Maturity Vulnerable System Confidentiality Impact Vulnerable System Integrity Impact Vulnerable System Availability Impact Subsequent System Confidentiality Impact Subsequent System Integrity Impact Subsequent System Availability Impact
9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.5 http://nvd.nist.gov 4.0 2024-01-15T00:00:00Z 2024-06-15T10:30:00Z CVE-2024-0001 NETWORK LOW NONE NONE NONE PROOF_OF_CONCEPT HIGH HIGH HIGH NONE NONE NONE

Affected Products

Product ID Product Vendor ID Vendor Versions
99999 Dummy Test Application 12345 Test Vendor Corporation - id: 88888
vulndb_version_id: 77777
name: 1.0
affected: Affected
all_prior_versions_affected: true
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.0:::::::
_source: Official
- id: 88889
vulndb_version_id: 77778
name: 1.5
affected: Affected
all_prior_versions_affected: false
cpes:
- name: cpe:2.3:a:testvendor:dummyapp:1.5:::::::
_source: Official

External References

Value Type URL Description Created At
12345 Snort Signature ID http://www.snort.org/sid/12345 Dummy Snort signature for testing 2024-01-15T00:00:00Z
TEST-2024-001 Security Advisory http://security.example.com/advisory/TEST-2024-001 Test security advisory reference 2024-01-10T00:00:00Z

CWES

CWE ID Name Source CVE IDs
CWE-79 Improper Neutralization of Input During Web Page Generation N/A N/A
CWE-89 SQL Injection N/A N/A

Exploits

Value Type
http://www.exploit-db.com/exploits/99999 Exploit Database
http://packetstormsecurity.com/files/dummy-exploit Packet Storm

Changelog

Created At Description
2024-06-15T10:30:00Z Dummy Product Application version 1.5.0 by Test Vendor: Affected Status set to “Affected”
2024-05-20T14:20:00Z Initial vulnerability entry created

flashpoint-ignite-vulnerability-list

List Vulnerabilities using provided filters.

Base Command

flashpoint-ignite-vulnerability-list

Input

Argument Name Description Required
vulnerability_ids Filter by the vulnerability IDs assigned by Flashpoint. Supports comma-separated values.

Example: 463513, FP-VULN-463512.		 Optional
updated_after Get vulnerabilities that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get vulnerabilities that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
disclosed_after Get vulnerabilities that were disclosed after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
disclosed_before Get vulnerabilities that were disclosed before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
published_after Get vulnerabilities that were published after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
published_before Get vulnerabilities that were published before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
last_touched_after Get vulnerabilities that were last touched after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
last_touched_before Get vulnerabilities that were last touched before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
ransomware_scores Filter by Ransomware score. Possible values are: Critical, High, Medium, Low. Optional
attack_types Filter by Attack type classification. Possible values are: Authentication Management, Cryptographic, Infrastructure, Input Manipulation, Misconfiguration, Man-In-The-Middle (MITM), Other, Race Condition, Attack Type Unknown. Optional
severities Filter by severity, which is calculated based on CVSS values. Possible values are: Critical, High, Medium, Low, Informational. Optional
products Filter by associated product names (case-insensitive). Optional
vendors Filter by associated vendor names (case-insensitive). Optional
cwe_ids Filter by CWE IDs assigned by Mitre. Optional
min_cvssv2_score Filter by lower limit of the CVSSv2 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv2_score Filter by upper limit of the CVSSv2 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
min_cvssv3_score Filter by lower limit of the CVSSv3 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv3_score Filter by upper limit of the CVSSv3 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
min_cvssv4_score Filter by lower limit of the CVSSv4 score. Prioritizes Flashpoint generated scores when possible. Example value 7.0

Note: Value must be a float between 0 and 10.		 Optional
max_cvssv4_score Filter by upper limit of the CVSSv4 score. Prioritizes Flashpoint generated scores when possible. Example value 10.0

Note: Value must be a float between 0 and 10.		 Optional
ref_types Filter by reference types. Possible values are: Bug Tracker, Bugtraq ID, CERT, CERT VU, CIAC Advisory, CVE ID, D2 Elliot, DISA IAVA, Exploit Activity, Exploit Database, Flashpoint, Generic Exploit URL, Generic Informational URL, Immunity CANVAS, Immunity CANVAS (D2ExploitPack), Immunity CANVAS (White Phosphorus), ISS X-Force ID, Japan Vulnerability Notes, Keyword, Mail List Post, Metasploit URL, Microsoft Knowledge Base Article, Microsoft Security Bulletin, Nessus Script ID, News Article, Nikto Item ID, Other Advisory URL, Other Solution URL, OVAL ID, Packet Storm, RedHat RHSA, Related VulnDB ID, SCIP VulDB ID, Secunia Advisory ID, Security Tracker, Snort Signature ID, Tenable PVS, US-CERT Cyber Security Alert, Vendor Specific Advisory URL, Vendor Specific Solution URL, Vendor URL, Vendor Specific News/Changelog Entry, VUPEN Advisory. Optional
ref_values Filter by reference values. Use with Reference Types to filter by specific reference type. Optional
locations Filter by location type classification. Possible values are: Context Dependent, Dial-up Access Required, Local Access Required, Legacy: Local / Remote, Mobile Phone / Hand-held Device, Physical Access Required, Remote / Network Access, Location Unknown, Wireless Vector. Optional
min_epss_score Filter by lower limit of the EPSS v3 score. Example value 0.5

Note: Value must be a float between 0 and 1.		 Optional
max_epss_score Filter by upper limit of the EPSS v3 score. Example value 1.0

Note: Value must be a float between 0 and 1.		 Optional
tags Filter vulnerabilities by tags. Optional
size Number of vulnerabilities to return per page. Maximum value: 1000. Default is 10. Optional
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
sort_by Specify the field used to sort the vulnerabilities. Possible values are: ID, Severity, Title, CVSSv3 Score, Published At. Default is Published At. Optional
sort_order Specify the order used to sort the vulnerabilities. Possible values are: Asc, Desc. Default is Desc. Optional

Context Output

Path Type Description
Ignite.Vulnerability.id Number The unique identifier of the vulnerability.
Ignite.Vulnerability.cve_ids Unknown A list of CVE IDs associated with the vulnerability.
Ignite.Vulnerability.title String The title of the vulnerability.
Ignite.Vulnerability.keywords String A list of keywords associated with the vulnerability.
Ignite.Vulnerability.description String The description of the vulnerability.
Ignite.Vulnerability.solution String The solution or remediation steps for the vulnerability.
Ignite.Vulnerability.technical_description String The technical description of the vulnerability.
Ignite.Vulnerability.timelines.published_at Date The date when the vulnerability was published.
Ignite.Vulnerability.timelines.last_modified_at Date The date when the vulnerability was last modified.
Ignite.Vulnerability.timelines.exploit_published_at Date The date when the exploit was published.
Ignite.Vulnerability.timelines.discovered_at Date The date when the vulnerability was discovered.
Ignite.Vulnerability.timelines.disclosed_at Date The date when the vulnerability was disclosed.
Ignite.Vulnerability.timelines.vendor_informed_at Date The date when the vendor was informed.
Ignite.Vulnerability.timelines.vendor_acknowledged_at Date The date when the vendor acknowledged the vulnerability.
Ignite.Vulnerability.timelines.third_party_solution_provided_at Date The date when a third-party solution was provided.
Ignite.Vulnerability.timelines.solution_provided_at Date The date when a solution was provided.
Ignite.Vulnerability.timelines.exploited_in_the_wild_at Date The date when the vulnerability was exploited in the wild.
Ignite.Vulnerability.scores.epss_score Number An EPSS (Exploit Prediction Scoring System) score.
Ignite.Vulnerability.scores.cvssv3_score Number A CVSS v3 score.
Ignite.Vulnerability.scores.epss_v1_score Number An EPSS version 1 score.
Ignite.Vulnerability.scores.ransomware_score Number A ransomware score.
Ignite.Vulnerability.scores.severity String The severity level of the vulnerability.
Ignite.Vulnerability.vuln_status String The status of the vulnerability.
Ignite.Vulnerability.cwes.cwe_id String The CWE identifier.
Ignite.Vulnerability.cwes.name String The name of the CWE.
Ignite.Vulnerability.ext_references.value String A value of the external reference.
Ignite.Vulnerability.ext_references.type String The type of external reference.
Ignite.Vulnerability.ext_references.created_at Date The date when the external reference was created.
Ignite.Vulnerability.ext_references.description String The description of the external reference.
Ignite.Vulnerability.ext_references.url String The URL of the external reference.
Ignite.Vulnerability.classifications.name String The name of the classification.
Ignite.Vulnerability.classifications.longname String The long name of the classification.
Ignite.Vulnerability.classifications.description String The description of the classification.
Ignite.Vulnerability.exploits.value String An exploit URL or identifier.
Ignite.Vulnerability.exploits.type String The type of exploit (e.g., Exploit Database).
Ignite.Vulnerability.exploits_count Number The count of exploits associated with the vulnerability.
Ignite.Vulnerability.cvss_v2s.access_vector String The CVSS v2 access vector.
Ignite.Vulnerability.cvss_v2s.access_complexity String The CVSS v2 access complexity.
Ignite.Vulnerability.cvss_v2s.authentication String The CVSS v2 authentication.
Ignite.Vulnerability.cvss_v2s.confidentiality_impact String The CVSS v2 confidentiality impact.
Ignite.Vulnerability.cvss_v2s.integrity_impact String The CVSS v2 integrity impact.
Ignite.Vulnerability.cvss_v2s.availability_impact String The CVSS v2 availability impact.
Ignite.Vulnerability.cvss_v2s.source String The source of the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.generated_at Date The date when the CVSS v2 score was generated.
Ignite.Vulnerability.cvss_v2s.cve_id String The CVE ID associated with the CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.score Number The CVSS v2 score.
Ignite.Vulnerability.cvss_v2s.calculated_cvss_base_score Number A calculated CVSS v2 base score.
Ignite.Vulnerability.cvss_v3s.attack_vector String The CVSS v3 attack vector.
Ignite.Vulnerability.cvss_v3s.attack_complexity String The CVSS v3 attack complexity.
Ignite.Vulnerability.cvss_v3s.privileges_required String The CVSS v3 privileges required.
Ignite.Vulnerability.cvss_v3s.user_interaction String The CVSS v3 user interaction.
Ignite.Vulnerability.cvss_v3s.scope String The CVSS v3 scope.
Ignite.Vulnerability.cvss_v3s.confidentiality_impact String The CVSS v3 confidentiality impact.
Ignite.Vulnerability.cvss_v3s.integrity_impact String The CVSS v3 integrity impact.
Ignite.Vulnerability.cvss_v3s.availability_impact String The CVSS v3 availability impact.
Ignite.Vulnerability.cvss_v3s.source String The source of the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.generated_at Date The date when the CVSS v3 score was generated.
Ignite.Vulnerability.cvss_v3s.cve_id String The CVE ID associated with the CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.score Number The CVSS v3 score.
Ignite.Vulnerability.cvss_v3s.calculated_cvss_base_score Number A calculated CVSS v3 base score.
Ignite.Vulnerability.cvss_v3s.vector_string String The CVSS v3 vector string.
Ignite.Vulnerability.cvss_v3s.version String The CVSS v3 version.
Ignite.Vulnerability.cvss_v3s.remediation_level String The CVSS v3 remediation level.
Ignite.Vulnerability.cvss_v3s.report_confidence String The CVSS v3 report confidence.
Ignite.Vulnerability.cvss_v3s.exploit_code_maturity String The CVSS v3 exploit code maturity.
Ignite.Vulnerability.cvss_v3s.temporal_score Number The CVSS v3 temporal score.
Ignite.Vulnerability.cvss_v3s.updated_at Date The date when the CVSS v3 score was updated.
Ignite.Vulnerability.cvss_v4s.score Number The CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.threat_score Number The CVSS v4 threat score.
Ignite.Vulnerability.cvss_v4s.source String The source of the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.generated_at Date The date when the CVSS v4 score was generated.
Ignite.Vulnerability.cvss_v4s.updated_at Date The date when the CVSS v4 score was updated.
Ignite.Vulnerability.cvss_v4s.cve_id String The CVE ID associated with the CVSS v4 score.
Ignite.Vulnerability.cvss_v4s.vector_string String The CVSS v4 vector string.
Ignite.Vulnerability.cvss_v4s.version String The CVSS v4 version.
Ignite.Vulnerability.cvss_v4s.attack_vector String The CVSS v4 attack vector.
Ignite.Vulnerability.cvss_v4s.attack_complexity String The CVSS v4 attack complexity.
Ignite.Vulnerability.cvss_v4s.attack_requirements String The CVSS v4 attack requirements.
Ignite.Vulnerability.cvss_v4s.privileges_required String The CVSS v4 privileges required.
Ignite.Vulnerability.cvss_v4s.user_interaction String The CVSS v4 user interaction.
Ignite.Vulnerability.cvss_v4s.exploit_maturity String The CVSS v4 exploit maturity.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_confidentiality_impact String The CVSS v4 vulnerable system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_integrity_impact String The CVSS v4 vulnerable system integrity impact.
Ignite.Vulnerability.cvss_v4s.vulnerable_system_availability_impact String The CVSS v4 vulnerable system availability impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_confidentiality_impact String The CVSS v4 subsequent system confidentiality impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_integrity_impact String The CVSS v4 subsequent system integrity impact.
Ignite.Vulnerability.cvss_v4s.subsequent_system_availability_impact String The CVSS v4 subsequent system availability impact.
Ignite.Vulnerability.products.id Number The unique numeric identifier assigned by Flashpoint for a single product.
Ignite.Vulnerability.products.name String The product name.
Ignite.Vulnerability.vendors.id Number The unique numeric identifier assigned by Flashpoint for a single vendor.
Ignite.Vulnerability.vendors.name String The vendor name.
Ignite.Vulnerability.tags String The tags associated with the vulnerability.

Command Example

!flashpoint-ignite-vulnerability-list attack_types=”Attack Type Unknown” from=2 locations=”Context Dependent” min_cvssv2_score=9 products=”Squid” ransomware_scores=Critical ref_types=”D2 Elliot” sort_order=Asc sort_by=”ID” severities=Informational

Context Example

[
    {
        "id": 1,
        "cve_ids": [
            "CVE-2020-101010"
        ],
        "title": "Dummy Vulnerability Title for Testing",
        "keywords": "",
        "description": "Dummy Vulnerability Description for Testing",
        "solution": "Dummy Solution for Testing",
        "technical_description": "Dummy Technical Description for Testing",
        "timelines": {
            "published_at": "2026-02-28T01:07:11Z",
            "last_modified_at": "2026-02-28T01:17:13Z",
            "exploit_published_at": "2025-12-21T00:00:00Z",
            "disclosed_at": "2025-12-21T00:00:00Z",
            "solution_provided_at": "2025-12-21T00:00:00Z"
        },
        "scores": {
            "severity": "Medium",
            "cvssv3_score": 5.4,
            "epss_score": 0.00039,
            "epss_v1_score": 0.0166211,
            "ransomware_score": "High"
        },
        "vuln_status": "Active",
        "cwes": [
            {
                "cwe_id": 79,
                "name": "Dummy CWE Name for Testing",
                "source": "nvd",
                "cve_ids": "CVE-2025-70091"
            }
        ],
        "exploits_count": 0,
        "ext_references": [
            {
                "value": "https://github.com/opensourcepos/opensourcepos/commit/01010101",
                "type": "Vendor Specific Solution URL",
                "url": "https://github.com/opensourcepos/opensourcepos/commit/01010101",
                "created_at": "2026-01-13T21:40:34Z"
            }
        ],
        "cvss_v2s": [
            {
                "access_vector": "NETWORK",
                "access_complexity": "LOW",
                "authentication": "SINGLE_INSTANCE",
                "confidentiality_impact": "NONE",
                "integrity_impact": "PARTIAL",
                "availability_impact": "NONE",
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54Z",
                "score": 4.0
            }
        ],
        "cvss_v3s": [
            {
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "privileges_required": "LOW",
                "user_interaction": "REQUIRED",
                "scope": "CHANGED",
                "confidentiality_impact": "LOW",
                "integrity_impact": "LOW",
                "availability_impact": "NONE",
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54Z",
                "score": 5.4,
                "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/:U/RC:C",
                "version": "3.1",
                "remediation_level": "UNAVAILABLE",
                "report_confidence": "CONFIRMED",
                "exploit_code_maturity": "FUNCTIONAL",
                "temporal_score": 5.3,
                "updated_at": "2026-02-28T01:07:11Z"
            }
        ],
        "cvss_v4s": [
            {
                "score": 5.1,
                "threat_score": 5.1,
                "source": "Flashpoint",
                "generated_at": "2026-02-25T22:31:54.998000Z",
                "updated_at": "2026-02-25T22:31:55.195000Z",
                "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A",
                "version": "4.0",
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "attack_requirements": "NONE",
                "privileges_required": "LOW",
                "user_interaction": "PASSIVE",
                "exploit_maturity": "ATTACKED",
                "vulnerable_system_confidentiality_impact": "LOW",
                "vulnerable_system_integrity_impact": "LOW",
                "vulnerable_system_availability_impact": "NONE",
                "subsequent_system_confidentiality_impact": "LOW",
                "subsequent_system_integrity_impact": "LOW",
                "subsequent_system_availability_impact": "NONE"
            }
        ],
        "tags": [
            "oss"
        ],
        "products": [
            {
                "id": 1903500,
                "name": "dummy product"
            }
        ],
        "vendors": [
            {
                "id": 1884569,
                "name": "dummy vendor"
            }
        ]
    },
    {
        "id": 2,
        "cve_ids": [
            "CVE-2025-101010"
        ],
        "title": "Dummy Title for Testing2",
        "keywords": "",
        "description": "Dummy Description for Testing2",
        "solution": "Dummy Solution for Testing2",
        "technical_description": "Dummy Technical Description for Testing2",
        "timelines": {
            "published_at": "2026-02-28T01:02:30Z",
            "last_modified_at": "2026-02-28T01:12:33Z",
            "exploit_published_at": "2026-01-04T00:00:00Z",
            "disclosed_at": "2026-01-04T00:00:00Z",
            "vendor_informed_at": "2025-11-01T00:00:00Z",
            "solution_provided_at": "2026-01-04T00:00:00Z"
        },
        "scores": {
            "severity": "High",
            "cvssv3_score": 7.5,
            "epss_score": 0.00128,
            "epss_v1_score": 0.0226512,
            "ransomware_score": "Low"
        },
        "vuln_status": "Active",
        "cwes": [
            {
                "cwe_id": 1,
                "name": "dummy cwe name",
                "source": "flashpoint"
            }
        ],
        "exploits_count": 0,
        "ext_references": [
            {
                "value": "https://github.com/issue/1xxx",
                "type": "Bug Tracker",
                "url": "https://github.com/issue/2xxx",
                "created_at": "2026-02-12T15:45:49Z"
            }
        ],
        "classifications": [
            {
                "name": "dummy classifications",
                "longname": "dummy longname",
                "description": "dummy description"
            }
        ],
        "cvss_v2s": [
            {
                "access_vector": "NETWORK",
                "access_complexity": "LOW",
                "authentication": "NONE",
                "confidentiality_impact": "NONE",
                "integrity_impact": "NONE",
                "availability_impact": "COMPLETE",
                "source": "Flashpoint",
                "generated_at": "2026-02-27T18:40:31Z",
                "score": 7.8
            }
        ],
        "cvss_v3s": [
            {
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "privileges_required": "NONE",
                "user_interaction": "NONE",
                "scope": "UNCHANGED",
                "confidentiality_impact": "NONE",
                "integrity_impact": "NONE",
                "availability_impact": "HIGH",
                "source": "Flashpoint",
                "generated_at": "2026-02-27T18:40:31Z",
                "score": 7.5,
                "vector_string": "CVSS:3.1/AV:N/AC:L/E:F/RL:O/RC:C",
                "version": "3.1",
                "remediation_level": "OFFICIAL_FIX",
                "report_confidence": "CONFIRMED",
                "exploit_code_maturity": "FUNCTIONAL",
                "temporal_score": 7.0,
                "updated_at": "2026-02-28T01:02:30Z"
            }
        ],
        "cvss_v4s": [
            {
                "score": 8.7,
                "threat_score": 8.7,
                "source": "Flashpoint",
                "generated_at": "2026-02-28T01:02:25.362000Z",
                "updated_at": "2026-02-28T01:02:25.392000Z",
                "vector_string": "CVSS:4.0/AV:N/AC:L/SA:N/E:A",
                "version": "4.0",
                "attack_vector": "NETWORK",
                "attack_complexity": "LOW",
                "attack_requirements": "NONE",
                "privileges_required": "NONE",
                "user_interaction": "NONE",
                "exploit_maturity": "ATTACKED",
                "vulnerable_system_confidentiality_impact": "NONE",
                "vulnerable_system_integrity_impact": "NONE",
                "vulnerable_system_availability_impact": "HIGH",
                "subsequent_system_confidentiality_impact": "NONE",
                "subsequent_system_integrity_impact": "NONE",
                "subsequent_system_availability_impact": "NONE"
            }
        ],
        "tags": [
            "oss"
        ],
        "products": [
            {
                "id": 7483660,
                "name": "dummy product2"
            }
        ],
        "vendors": [
            {
                "id": 7441495,
                "name": "dummy vendor2"
            }
        ]
    }
]

Human Readable Output

Total number of vulnerabilities found: 4

Vulnerability List

ID CVE IDs Title Description Solution Vulnerability Status Severity EPSS Score Ransomware Score Published At Last Modified At Tags CVSS v2 CVSS v3 CVSS v4 Products CWEs Exploits Count
FP-VULN-1, link CVE-2020-101010 Dummy Vulnerability Title for Testing Dummy Vulnerability Description for Testing Dummy Solution for Testing Active Medium 0.00039 High 2026-02-28T01:07:11Z 2026-02-28T01:17:13Z oss - access_vector: NETWORK
access_complexity: LOW
authentication: SINGLE_INSTANCE
confidentiality_impact: NONE
integrity_impact: PARTIAL
availability_impact: NONE
source: Flashpoint
generated_at: 2026-02-25T22:31:54Z
cve_id: null
score: 4.0
calculated_cvss_base_score: null		 - attack_vector: NETWORK
attack_complexity: LOW
privileges_required: LOW
user_interaction: REQUIRED
scope: CHANGED
confidentiality_impact: LOW
integrity_impact: LOW
availability_impact: NONE
source: Flashpoint
generated_at: 2026-02-25T22:31:54Z
cve_id: null
score: 5.4
calculated_cvss_base_score: null
vector_string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/:U/RC:C
version: 3.1
remediation_level: UNAVAILABLE
report_confidence: CONFIRMED
exploit_code_maturity: FUNCTIONAL
temporal_score: 5.3
updated_at: 2026-02-28T01:07:11Z		 - score: 5.1
threat_score: 5.1
source: Flashpoint
generated_at: 2026-02-25T22:31:54.998000Z
updated_at: 2026-02-25T22:31:55.195000Z
cve_id: null
vector_string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A
version: 4.0
attack_vector: NETWORK
attack_complexity: LOW
attack_requirements: NONE
privileges_required: LOW
user_interaction: PASSIVE
exploit_maturity: ATTACKED
vulnerable_system_confidentiality_impact: LOW
vulnerable_system_integrity_impact: LOW
vulnerable_system_availability_impact: NONE
subsequent_system_confidentiality_impact: LOW
subsequent_system_integrity_impact: LOW
subsequent_system_availability_impact: NONE		 - id: 1903500
name: dummy product		 - cwe_id: 79
name: Dummy CWE Name for Testing
source: nvd
cve_ids: CVE-2025-70091		 0
FP-VULN-2, link CVE-2025-101010 Dummy Title for Testing2 Dummy Description for Testing2 Dummy Solution for Testing2 Active High 0.00128 Low 2026-02-28T01:02:30Z 2026-02-28T01:12:33Z oss - access_vector: NETWORK
access_complexity: LOW
authentication: NONE
confidentiality_impact: NONE
integrity_impact: NONE
availability_impact: COMPLETE
source: Flashpoint
generated_at: 2026-02-27T18:40:31Z
cve_id: null
score: 7.8
calculated_cvss_base_score: null		 - attack_vector: NETWORK
attack_complexity: LOW
privileges_required: NONE
user_interaction: NONE
scope: UNCHANGED
confidentiality_impact: NONE
integrity_impact: NONE
availability_impact: HIGH
source: Flashpoint
generated_at: 2026-02-27T18:40:31Z
cve_id: null
score: 7.5
calculated_cvss_base_score: null
vector_string: CVSS:3.1/AV:N/AC:L/E:F/RL:O/RC:C
version: 3.1
remediation_level: OFFICIAL_FIX
report_confidence: CONFIRMED
exploit_code_maturity: FUNCTIONAL
temporal_score: 7.0
updated_at: 2026-02-28T01:02:30Z		 - score: 8.7
threat_score: 8.7
source: Flashpoint
generated_at: 2026-02-28T01:02:25.362000Z
updated_at: 2026-02-28T01:02:25.392000Z
cve_id: null
vector_string: CVSS:4.0/AV:N/AC:L/SA:N/E:A
version: 4.0
attack_vector: NETWORK
attack_complexity: LOW
attack_requirements: NONE
privileges_required: NONE
user_interaction: NONE
exploit_maturity: ATTACKED
vulnerable_system_confidentiality_impact: NONE
vulnerable_system_integrity_impact: NONE
vulnerable_system_availability_impact: HIGH
subsequent_system_confidentiality_impact: NONE
subsequent_system_integrity_impact: NONE
subsequent_system_availability_impact: NONE		 - id: 7483660
name: dummy product2		 - cwe_id: 1
name: dummy cwe name
source: flashpoint
cve_ids: null		 0

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-vulnerability-library-list

Retrieves a list of libraries that are affected by a particular vulnerability.

Base Command

flashpoint-ignite-vulnerability-library-list

Input

Argument Name Description Required
vulnerability_id The Flashpoint vulnerability ID. Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of libraries to return per page. Maximum value: 1000. Default is 10. Optional
sort_by Specify the field used to sort the libraries. Possible values are: ID, Name. Default is ID. Optional
sort_order Specify the order to sort the libraries. Possible values are: Asc, Desc. Default is Asc. Optional
library_ids Flashpoint library ID(s) to filter by. Supports a comma-separated values. Optional
library_name The library name to filter by (case-insensitive). Optional
query Search libraries by namespace, name, version, type, etc. Optional

Context Output

Path Type Description
Ignite.Library.id Number The unique identifier of the library.
Ignite.Library.namespace String The namespace of the library.
Ignite.Library.name String The name of the library.
Ignite.Library.version String The version of the library.
Ignite.Library.qualifiers String The qualifiers of the library.
Ignite.Library.subpath String The subpath of the library.
Ignite.Library.type String The type of the library (e.g., pypi, npm, maven).
Ignite.Library.purl String The package URL of the library.
Ignite.Library.affected Boolean Whether the library is affected by the vulnerability.
Ignite.Library.constructed_purl String The constructed package URL of the library including name and version.

Command Example

!flashpoint-ignite-vulnerability-library-list vulnerability_id=101010 sort=id sort_order=asc from=2 name="dummy_name" query="1.11" size=2

Context Example

{
    "Ignite": {
        "Library": [
            {
                "id": 1010,
                "namespace": "-",
                "name": "dummy_name",
                "version": "1.11.112",
                "qualifiers": "-",
                "subpath": "-",
                "type": "pypi",
                "purl": "pkg:pypi",
                "affected": true,
                "constructed_purl": "pkg:pypi/dummy_name@1.11.112"
            },
            {
                "id": 101010,
                "namespace": "-",
                "name": "dummy_name",
                "version": "1.111.123",
                "qualifiers": "-",
                "subpath": "-",
                "type": "pypi",
                "purl": "pkg:pypi",
                "affected": true,
                "constructed_purl": "pkg:pypi/dummy_name@1.111.123"
            }
        ]
    }
}

Human Readable Output

Total number of libraries found: 2

Vulnerability Libraries

ID Name Version Type Namespace Package URL Affected
1010 dummy_name 1.11.112 pypi - pkg:pypi/dummy_name@1.11.112 true
101010 dummy_name 1.111.123 pypi - pkg:pypi/dummy_name@1.111.123 true

flashpoint-ignite-vulnerability-package-list

Retrieves a list of packages that are affected by a particular vulnerability.

Base Command

flashpoint-ignite-vulnerability-package-list

Input

Argument Name Description Required
vulnerability_id The Flashpoint vulnerability ID. Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of packages to return per page. Maximum value: 1000. Default is 10. Optional
sort_by Specify the field used to sort the packages. Possible values are: ID, Name. Default is ID. Optional
sort_order Specify the order to sort the packages. Possible values are: Asc, Desc. Default is Asc. Optional
package_ids Flashpoint package ID(s) to filter by. Supports comma-separated integer values. Optional
package_name The package name to filter by (case-insensitive). Optional
query Search packages by name, version, operating system, etc. Optional

Context Output

Path Type Description
Ignite.Package.id Number The unique identifier of the package.
Ignite.Package.name String The name of the package.
Ignite.Package.version String The version of the package.
Ignite.Package.filename String The filename of the package.
Ignite.Package.os String The operating system associated with the package.
Ignite.Package.os_version String The version of the operating system.
Ignite.Package.os_arch String The architecture of the operating system.
Ignite.Package.purl String The Package URL (purl) of the package.
Ignite.Package.operator String The operator indicating the version constraint relationship.
Ignite.Package.affected Boolean Whether the package is affected by the vulnerability.

Command Example

!flashpoint-ignite-vulnerability-package-list vulnerability_id=101010 sort_by=id sort_order=asc query="Debian GNU/Linux" size=2

Context Example

{
    "Ignite": {
        "Package": [
            {
                "id": 10000,
                "name": "dummy_package_1",
                "version": "1.0.0",
                "filename": "dummy_file_name_1",
                "os": "Debian GNU/Linux",
                "os_version": "10.1",
                "os_arch": "all",
                "purl": "pkg:deb/debian/dummy_package_1@1.0.0?distro=10.1",
                "operator": "=",
                "affected": true
            },
            {
                "id": 10001,
                "name": "dummy_package_2",
                "version": "2.0.0",
                "filename": "dummy_file_name_2",
                "os": "Debian GNU/Linux",
                "os_version": "10.1",
                "os_arch": "all",
                "purl": "pkg:deb/debian/dummy_package_2@2.0.0?distro=10.1",
                "operator": "<",
                "affected": false
            }
        ]
    }
}

Human Readable Output

Total number of packages found: 4

Vulnerability Packages

ID Package Version Filename OS OS Version OS Architecture Package URL Affected
10000 dummy_package_1 1.0.0 dummy_file_name_1 Debian GNU/Linux 10.1 all pkg:deb/debian/dummy_package_1@1.0.0?distro=10.1 true
10001 dummy_package_2 2.0.0 dummy_file_name_2 Debian GNU/Linux 10.1 all pkg:deb/debian/dummy_package_2@2.0.0?distro=10.1 false

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-vendor-list

List vendors using provided filters.

Base Command

flashpoint-ignite-vendor-list

Input

Argument Name Description Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of packages to return per page. Maximum value: 1000. Default is 10. Optional
vendor_ids Flashpoint vendor ID(s) to filter by. Supports comma-separated integer values. Optional
vendor_name The vendor name to filter by (case-insensitive). Optional
updated_after Get vendors that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get vendors that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional

Context Output

Path Type Description
Ignite.Vendor.id Number The unique identifier of the vendor.
Ignite.Vendor.name String The name of the vendor.

Command Example

!flashpoint-ignite-vendor-list size=2

Context Example

{
    "Ignite": {
        "Vendor": [
            {
                "id": 1001,
                "name": "Vendor Alpha"
            },
            {
                "id": 1002,
                "name": "Vendor Beta"
            }
        ]
    }
}

Human Readable Output

Total number of vendors found: 4

Vendor List

ID Name
1001 Vendor Alpha
1002 Vendor Beta

To retrieve the next set of result use, from = 2, size = 2

flashpoint-ignite-product-list

List products using provided filters.

Base Command

flashpoint-ignite-product-list

Input

Argument Name Description Required
from The offset to retrieve next page data. Used for pagination only. Default is 0. Optional
size Number of products to return per page. Maximum value: 1000. Default is 10. Optional
product_ids Flashpoint product ID(s) to filter by. Supports comma-separated integer values. Optional
product_name The product name to filter by (case-insensitive). Optional
vendor_ids Flashpoint vendor ID(s) to filter by. Supports comma-separated integer values. Optional
updated_after Get products that were updated after the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional
updated_before Get products that were updated before the specified date or relative timestamp.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.		 Optional

Context Output

Path Type Description
Ignite.Product.id Number The unique identifier of the product.
Ignite.Product.name String The name of the product.
Ignite.Product.vendor.id Number The unique identifier of the vendor associated with the product.
Ignite.Product.vendor.name String The name of the vendor associated with the product.
Ignite.Product.versions List List of versions associated with the product.

Command example

!flashpoint-ignite-product-list size=2

Context Example

{
    "Ignite": {
        "Product": [
            {
                "id": 10001,
                "name": "dummy product1",
                "vendor": {
                    "id": 1,
                    "name": "dummy vendor1"
                },
                "versions": [
                    {
                        "id": 1641849,
                        "vulndb_version_id": 11704,
                        "name": "1.1.4"
                    }
                ]
            },
            {
                "id": 10002,
                "name": "dummy product2",
                "vendor": {
                    "id": 2,
                    "name": "dummy vendor2"
                },
                "versions": [
                    {
                        "id": 1824886,
                        "vulndb_version_id": 11921,
                        "name": "1.6.6"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

Total number of products found: 5

Product List

Product ID Product Name Vendor ID Vendor Name
10001 dummy product1 1 dummy vendor1
10002 dummy product2 2 dummy vendor2

To retrieve the next set of result use, from = 2, size = 2

Migration Guide

Note:
For fetching incidents, set the First Fetch time to the previous integration’s Incidents Fetch Interval time. This might create duplicate alerts, but it will ensure that no alert data is lost.

Migrated Commands

Some of the previous integration’s commands have been migrated to new commands. Below is the table showing the commands that have been migrated to the new ones.

Flashpoint Command Migrated Ignite Command
ip ip
domain domain
url url
file file
flashpoint-search-intelligence-reports flashpoint-ignite-intelligence-report-search
flashpoint-get-single-intelligence-report flashpoint-ignite-intelligence-report-get
flashpoint-get-related-reports flashpoint-ignite-intelligence-related-report-list
flashpoint-get-single-event flashpoint-ignite-event-get
flashpoint-get-events flashpoint-ignite-event-list
flashpoint-common-lookup flashpoint-ignite-common-lookup
flashpoint-alert-list flashpoint-ignite-alert-list
flashpoint-compromised-credentials-list flashpoint-ignite-compromised-credentials-list

Deprecated Commands

Some of the previous integration’s commands have been deprecated from the Flashpoint API side. Below is the table showing the commands that have been deprecated for which, there is no replacement available.

Deprecated Command
flashpoint-get-forum-details
flashpoint-get-forum-room-details
flashpoint-get-forum-user-details
flashpoint-get-forum-post-details
flashpoint-search-forum-sites
flashpoint-search-forum-posts
filename
email

Configuration parameters

  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • url — Server URL (required)
  • credentials — (required)
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • fetch_type — Fetch Type
  • severity — Severity for Incidents
  • status — Alert Status
  • origin — Alert Origin
  • sources — Alert Sources
  • is_fresh_compromised_credentials — Fetch fresh compromised credentials alerts
  • password_has_lowercase — Fetch compromised credentials alerts having lowercase in password
  • password_has_uppercase — Fetch compromised credentials alerts having uppercase in password
  • password_has_number — Fetch compromised credentials alerts having numbers in password
  • password_has_symbol — Fetch compromised credentials alerts having symbol in password
  • password_min_length — Fetch compromised credentials alerts having minimum length of password
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • create_relationships — Create relationships
  • ioc_enrichment_exact_match — Enable Exact Match for IOC Enrichment
  • reputation_enrichments_limit — Reputation commands context limit
  • message_max_length — Community search message max length
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (22)

  • cve

    Retrieves detailed information about a specific CVE by its CVE ID.

  • domain

    Looks up the "Domain" type indicator details. The reputation of the domain is decided from the indicator score if it is found in the Ignite IOC database.

  • email Deprecated

    Looks up the "Email" type indicator details. The reputation of Email is considered malicious if there's at least one IoC event in the Ignite database matching the Email indicator.

  • file

    Looks up the "File" type indicator details. The reputation of the file is decided from the indicator score if it is found in the Ignite IOC database.

  • filename Deprecated

    Looks up the "Filename" type indicator details. The reputation of Filename is considered malicious if there's at least one IoC event in the Ignite database matching the Filename indicator.

  • flashpoint-ignite-alert-list

    Retrieves a list of alerts based on the filter values provided in the command arguments.

  • flashpoint-ignite-common-lookup

    Looks up details for indicators of types: "URL", "Domain", "File Hash", and "IP". The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

  • flashpoint-ignite-compromised-credentials-list

    Retrieves the compromised credentials based on the filter values provided in the command arguments.

  • flashpoint-ignite-event-get

    Retrieves the details of a single event using event FPID or UUID.

  • flashpoint-ignite-event-list

    Searches for events within the specified time period, the Flashpoint report ID, or attack IDs.

  • flashpoint-ignite-indicator-get

    Looks up details for indicators of types "URL", "Domain", "File Hash", and "IP" using their ID. The reputation of the indicator is decided from the indicator score if it is found in the Ignite IOC database.

  • flashpoint-ignite-intelligence-related-report-list

    List related reports for a particular report using the report ID.

  • flashpoint-ignite-intelligence-report-get

    Get single report details using the report id.

  • flashpoint-ignite-intelligence-report-search

    Search for the Intelligence Reports using a keyword.

  • flashpoint-ignite-product-list

    List products using provided filters.

  • flashpoint-ignite-vendor-list

    List vendors using provided filters.

  • flashpoint-ignite-vulnerability-get

    Retrieves detailed information about a specific vulnerability by its Flashpoint ID.

  • flashpoint-ignite-vulnerability-library-list

    Retrieves a list of libraries that are affected by a particular vulnerability.

  • flashpoint-ignite-vulnerability-list

    List Vulnerabilities using provided filters.

  • flashpoint-ignite-vulnerability-package-list

    Retrieves a list of packages that are affected by a particular vulnerability.

  • ip

    Looks up the "IP" type indicator details. The reputation of the IP address is decided from the indicator score if it is found in the Ignite IOC database. Alternatively, the IP address is considered suspicious if it matches any one of the community's peer IP addresses.

  • url

    Looks up the "URL" type indicator details. The reputation of the URL is decided from the indicator score if it is found in the Ignite IOC database.

Source

Ignite.py Ignite_test.py Ignite.yml Ignite_description.md
Download History Raw 
"""Ignite Test File."""

import json
import os.path
import re
from datetime import timedelta
from unittest.mock import patch

import Ignite
import pytest
from CommonServerPython import DemistoException, get_current_time
from Ignite import (
    DATE_FORMAT,
    DEFAULT_SEVERITY,
    LIBRARY_AND_PACKAGE_SORT_VALUES,
    MESSAGES,
    URL_SUFFIX,
    Client,
    demisto,
    main,
    remove_space_from_args,
    OUTPUT_PREFIX,
    MAX_PRODUCT,
    MAX_PAGE_SIZE,
    SORT_DATE_VALUES,
    SORT_ORDER_VALUES,
    FILTER_DATE_VALUES,
    IS_FRESH_VALUES,
    MAX_FETCH_LIMIT,
    MAX_ALERTS_LIMIT,
    ALERT_STATUS_VALUES,
    ALERT_ORIGIN_VALUES,
    OUTPUT_KEY_FIELD,
    VULNERABILITY_SORT_MAPPING,
    vulnerability_get_command,
    vendor_list_command,
    product_list_command,
    vulnerability_list_command,
    cve_command,
    DEFAULT_REPUTATION_CONTEXT_LIMIT,
    DEFAULT_MESSAGE_MAX_LENGTH,
    MESSAGE_TRUNCATION_SUFFIX,
    create_relationships_list_for_community_search,
    ip_lookup_command,
    truncate_message,
    get_resource_url,
    prepare_incidents_from_alerts_data,
)

""" CONSTANTS """

API_KEY = "api_key"
MOCK_URL = "https://mock_dummy.com"
BASIC_PARAMS = {"url": MOCK_URL, "credentials": {"password": API_KEY}}
CURRENT_TIME = get_current_time()
CURRENT_TIME_STRING = CURRENT_TIME.strftime(DATE_FORMAT)
CURRENT_TIME_PLUS_ONE = CURRENT_TIME + timedelta(days=1)
CURRENT_TIME_PLUS_ONE_STRING = CURRENT_TIME_PLUS_ONE.strftime(DATE_FORMAT)

MESSAGES.update(
    {
        "NO_SERVER_URL_PROVIDED": "Please provide the Server URL.",
        "NO_CREDENTIALS_PROVIDED": "Please provide the API Key.",
    }
)

""" UTILITY FUNCTIONS AND FIXTURES """


def util_load_json(path: str) -> dict:
    """Load a json to python dict."""
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def util_load_text_data(path: str) -> str:
    """Load a text file."""
    with open(path, encoding="utf-8") as f:
        return f.read()


@pytest.fixture
def mock_client():
    """Mock a client object with required data to mock."""
    client = Client(MOCK_URL, {}, False, None, True)
    return client


""" TEST CASES """


def test_test_module(mock_client, requests_mock):
    """Test test_module."""
    from Ignite import test_module

    response = util_load_json("test_data/ip_lookup_reputation.json")
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}?size=1', json=response, status_code=200)

    assert test_module(client=mock_client) == "ok"


@patch("Ignite.return_results")
def test_test_module_using_main_function(mock_return, requests_mock, mocker):
    """
    Test case scenario for successful execution of test_module through main function.

    Given:
       - mocked client
    When:
       - Calling `test_module` function
    Then:
       - Returns an ok message
    """
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json={}, status_code=200)

    params = {**BASIC_PARAMS, "isFetch": True}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="test-module")

    main()
    assert mock_return.call_args.args[0] == "ok"


@pytest.mark.parametrize(
    "params, err_msg",
    [
        ({}, MESSAGES["NO_SERVER_URL_PROVIDED"]),
        ({"url": " "}, MESSAGES["NO_SERVER_URL_PROVIDED"]),
        ({"url": " url ", "cluster_id": " cluster_id "}, MESSAGES["NO_CREDENTIALS_PROVIDED"]),
        ({"url": " url ", "cluster_id": " cluster_id ", "credentials": {}}, MESSAGES["NO_CREDENTIALS_PROVIDED"]),
        ({"url": " url ", "cluster_id": " cluster_id ", "credentials": {"password": " "}}, MESSAGES["NO_CREDENTIALS_PROVIDED"]),
        (
            {**BASIC_PARAMS.copy(), "isFetch": True, "first_fetch": CURRENT_TIME_PLUS_ONE_STRING},
            MESSAGES["INVALID_FETCH_TIME"].format(CURRENT_TIME_PLUS_ONE_STRING),
        ),
        (
            {**BASIC_PARAMS.copy(), "isFetch": True, "max_fetch": MAX_FETCH_LIMIT + 1},
            MESSAGES["INVALID_MAX_FETCH"].format(MAX_FETCH_LIMIT + 1),
        ),
        (
            {**BASIC_PARAMS.copy(), "isFetch": True, "fetch_type": "Alerts", "max_fetch": MAX_FETCH_LIMIT + 1},
            MESSAGES["INVALID_MAX_FETCH"].format(MAX_FETCH_LIMIT + 1),
        ),
    ],
)
def test_test_module_when_invalid_params_provided(params, err_msg, mocker, capfd):
    """
    Test case scenario for execution of test_module when invalid argument provided.

    Given:
        - Params for test_module.
    When:
        - Calling `test_module` function.
    Then:
        - Returns a valid error message.
    """
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "exit", return_value=None)
    mocker.patch.object(demisto, "command", return_value="test-module")

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert err_msg in return_error.call_args[0][0]


@pytest.mark.parametrize(
    "status_code, err_msg",
    [
        (400, MESSAGES["INVALID_ARGUMENT_RESPONSE"]),
        (401, MESSAGES["INVALID_API_KEY"]),
        (521, MESSAGES["TEST_CONNECTIVITY_FAILED"]),
        (403, MESSAGES["TEST_CONNECTIVITY_FAILED"]),
        (404, MESSAGES["NO_RECORD_FOUND"]),
    ],
)
def test_test_module_invalid_response(requests_mock, mock_client, status_code, err_msg):
    """
    Test case scenario for the execution of test_module with invalid response with the different status code.

    Given:
       - mocked client
    When:
       - Calling `test_module` function
    Then:
       - Returns exception
    """
    from Ignite import test_module

    response = {"message": "invalid_response"}
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}?size=1', json=response, status_code=status_code)

    with pytest.raises(DemistoException) as err:
        test_module(mock_client)

    err_msg = err_msg + response.get("message") if status_code == 400 else err_msg
    if status_code in (403, 521):
        err_msg += json.dumps(response)
    assert MESSAGES["STATUS_CODE"].format(status_code, err_msg) == str(err.value)


def test_test_module_invalid_json_response(requests_mock, mock_client):
    """
    Test case scenario for the execution of test_module with invalid json response.

    Given:
       - mocked client
    When:
       - Calling `test_module` function
    Then:
       - Returns exception
    """
    from Ignite import test_module

    response = "invalid_response"
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}?size=1', text=response, status_code=200)

    with pytest.raises(DemistoException) as err:
        test_module(mock_client)

    assert MESSAGES["STATUS_CODE"].format(200, MESSAGES["INVALID_JSON_OBJECT"].format(response)) == str(err.value)


def test_fetch_incidents_when_valid_incidents_return(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {}

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    incidents_response = util_load_json("test_data/incidents_compromised_credentials.json")

    params: dict = {
        "fetch_type": "",
        "first_fetch": "2024-05-16T10:22:38Z",
        "is_fresh_compromised_credentials": "true",
        "password_has_lowercase": "true",
        "password_has_number": "true",
        "max_fetch": 1,
    }
    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params=params)

    END_TIME = next_run.get("end_time")
    expected_next_run = {
        "fetch_count": 1,
        "fetch_sum": 1,
        "total": 31,
        "end_time": END_TIME,
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
        "start_time": "2024-05-16T10:22:38Z",
    }

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_when_params_not_provided_and_last_run_provided(mocker, mock_client, requests_mock):
    """
    Test case scenario of fetch_incidents for fetch compromised credentials when params not provided and last run is provided.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "fetch_count": 1,
        "start_time": "2024-05-16T10:22:38Z",
        "total": 31,
        "fetch_sum": 30,
        "end_time": "2024-05-30T19:42:05Z",
        "last_timestamp": 1617219726,
    }

    expected_next_run = {
        "fetch_count": 0,
        "start_time": "2021-03-31T19:42:05Z",
        "total": None,
        "fetch_sum": 0,
        "end_time": "2024-05-30T19:42:05Z",
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
    }

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    incidents_response = util_load_json("test_data/incidents_compromised_credentials.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)
    mocker.patch.object(demisto, "command", return_value="fetch-incidents")
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={"max_fetch": 201})

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_when_invalid_arguments_provided(mock_client):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials when invalid arguments provided.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Raise error message.
    """
    from Ignite import fetch_incidents

    error_message = MESSAGES["INVALID_MAX_FETCH"].format("0")
    with pytest.raises(DemistoException) as error:
        fetch_incidents(client=mock_client, last_run={}, params={"max_fetch": 0})

    assert str(error.value) == error_message


def test_fetch_incidents_when_max_product_exceed_total_limit(mock_client, requests_mock):
    from Ignite import fetch_incidents

    mock_response: dict = util_load_json("test_data/fetch_incidents_with_check_max_product.json")

    error_message = MESSAGES["TIME_RANGE_ERROR"].format("10005")
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)

    with pytest.raises(ValueError) as error:
        fetch_incidents(client=mock_client, last_run={"total": 10005}, params={})

    assert str(error.value) == error_message


def test_fetch_incidents_to_check_duplicates_compromised_credentials(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials to check duplicate records in response.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "fetch_count": 1,
        "start_time": "2024-05-16T10:22:38Z",
        "total": 31,
        "fetch_sum": 30,
        "end_time": "2024-05-30T19:42:05Z",
        "hit_ids": ["sample_id_2"],
    }

    expected_next_run = {
        "fetch_count": 0,
        "start_time": "2021-03-31T19:42:05Z",
        "total": None,
        "fetch_sum": 0,
        "end_time": "2024-05-30T19:42:05Z",
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1", "sample_id_2"],
        "last_timestamp": 1617219725,
    }

    mock_response: dict = util_load_json("test_data/fetch_incidents_compromised_credentials_check_duplicate.json")

    incidents_response = util_load_json("test_data/incidents_compromised_credentials.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={})

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_compromised_credentials_when_email_not_present(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials when email not provided in response.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "fetch_count": 1,
        "start_time": "2024-05-16T10:22:38Z",
        "total": 31,
        "fetch_sum": 30,
        "end_time": "2024-05-30T19:42:05Z",
        "last_timestamp": 1617219725,
        "hit_ids": [],
    }

    expected_next_run = {
        "fetch_count": 0,
        "start_time": "2021-03-31T19:42:05Z",
        "total": None,
        "fetch_sum": 0,
        "end_time": "2024-05-30T19:42:05Z",
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
    }

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    del mock_response["hits"]["hits"][0]["_source"]["email"]
    incidents_response = util_load_json("test_data/incidents_compromised_credentials_when_email_not_present.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={})

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_compromised_credentials_when_email_and_username_not_present(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for compromised credentials when email and username not present.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "fetch_count": 1,
        "start_time": "2024-05-16T10:22:38Z",
        "total": 31,
        "fetch_sum": 30,
        "end_time": "2024-05-30T19:42:05Z",
        "last_timestamp": 1617219725,
        "hit_ids": [],
    }

    expected_next_run = {
        "fetch_count": 0,
        "start_time": "2021-03-31T19:42:05Z",
        "total": None,
        "fetch_sum": 0,
        "end_time": "2024-05-30T19:42:05Z",
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
    }

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    del mock_response["hits"]["hits"][0]["_source"]["email"]
    del mock_response["hits"]["hits"][0]["_source"]["username"]
    incidents_response = util_load_json("test_data/incidents_compromised_credentials_when_email_username_not_present.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={})

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_compromised_credentials_when_fpid_not_present(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials when fpid not provided in response.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "fetch_count": 1,
        "start_time": "2024-05-16T10:22:38Z",
        "total": 31,
        "fetch_sum": 30,
        "end_time": "2024-05-30T19:42:05Z",
    }

    expected_next_run = {
        "fetch_count": 0,
        "start_time": "2021-03-31T19:42:05Z",
        "total": None,
        "fetch_sum": 0,
        "end_time": "2024-05-30T19:42:05Z",
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
    }

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    del mock_response["hits"]["hits"][0]["_source"]["email"]
    del mock_response["hits"]["hits"][0]["_source"]["username"]
    del mock_response["hits"]["hits"][0]["_source"]["fpid"]

    incidents_response = util_load_json("test_data/incidents_compromised_credentials_when_fpid_not_present.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={})

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_get_reports_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-search command.

    Given:
       - command arguments for get_reports_command
    When:
       - Calling `get_reports_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_reports_command

    get_reports = util_load_json("test_data/get_reports_success.json")
    get_reports_context = util_load_json("test_data/get_reports_success_context.json")
    with open("test_data/get_reports_success_hr.md") as file:
        hr_output_for_reports = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["REPORT_SEARCH"]}?query=report_search&limit=5', json=get_reports, status_code=200)

    resp = get_reports_command(mock_client, {"report_search": "report_search"})

    assert resp.outputs_prefix == OUTPUT_PREFIX["REPORT"]
    assert resp.outputs_key_field == OUTPUT_KEY_FIELD["REPORT_ID"]
    assert resp.readable_output == hr_output_for_reports
    assert resp.outputs == get_reports_context
    assert resp.raw_response == get_reports


def test_get_reports_command_success_when_empty_response(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-search command with empty response.

    Given:
       - command arguments for get_reports_command
    When:
       - Calling `get_reports_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_reports_command

    get_reports_empty_data = util_load_json("test_data/get_reports_success_empty_response.json")
    with open("test_data/get_reports_success_empty_response_hr.md") as file:
        hr_output_for_reports = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["REPORT_SEARCH"]}?query=report_search&limit=5', json=get_reports_empty_data, status_code=200
    )

    resp = get_reports_command(mock_client, {"report_search": "report_search"})

    assert resp.readable_output == hr_output_for_reports
    assert resp.raw_response == get_reports_empty_data


def test_get_reports_command_when_invalid_argument(mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-search command
    when invalid argument provided.
    Given:
       - command arguments for get_reports_command
    When:
       - Calling `get_reports_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_reports_command

    args = {"report_search": " "}
    with pytest.raises(ValueError) as err:
        get_reports_command(mock_client, remove_space_from_args(args))

    assert str(err.value) == MESSAGES["MISSING_REQUIRED_ARGS"].format("report_search")


def test_event_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of event_list_command function.

    Given:
        - command arguments for event_list_command
    When:
        - Calling `event_list_command` function
    Then:
        - Returns a valid output
    """
    from Ignite import event_list_command

    mock_response_events = util_load_json("test_data/event_list_2_response.json")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["EVENT_LIST"]}', json=mock_response_events, status_code=200)

    resp = event_list_command(
        mock_client, args={"time_period": "1 month", "limit": 2, "attack_ids": "T1001", "report_fpid": "0000000000000000000001"}
    )

    output_list_events = util_load_json("test_data/event_list_2_output.json")

    hr_output_for_events = util_load_text_data("test_data/event_list_2_hr.md")

    assert resp.outputs_prefix == OUTPUT_PREFIX["EVENT"]
    assert resp.outputs_key_field == OUTPUT_KEY_FIELD["EVENT_ID"]
    assert resp.readable_output == hr_output_for_events
    assert resp.outputs == output_list_events
    assert resp.raw_response == mock_response_events


def test_event_list_command_no_result(requests_mock, mock_client):
    """
    Test case scenario with no results execution of event_list_command function.

    Given:
        - command arguments for event_list_command
    When:
        - Calling `event_list_command` function
    Then:
        - Returns a valid output
    """
    from Ignite import event_list_command

    mock_response_events = []

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["EVENT_LIST"]}', json=mock_response_events, status_code=200)

    resp = event_list_command(mock_client, args={})

    assert resp.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("events")
    assert resp.raw_response == mock_response_events


@pytest.mark.parametrize(
    "args,error_message",
    [
        ({"limit": "10001"}, MESSAGES["LIMIT_ERROR"].format("10001", MAX_PRODUCT)),
        ({"limit": "-1"}, MESSAGES["LIMIT_ERROR"].format("-1", MAX_PRODUCT)),
        ({"limit": "0"}, MESSAGES["LIMIT_ERROR"].format("0", MAX_PRODUCT)),
    ],
)
def test_event_list_command_with_invalid_args(args, error_message, mock_client):
    """
    Test case scenario for execution of event_list_command with invalid arguments provided.

    Given:
        - arguments for event_list_command.
    When:
        - Calling `event_list_command` function.
    Then:
        - Returns a valid error message.
    """
    from Ignite import event_list_command

    with pytest.raises(DemistoException) as error:
        event_list_command(mock_client, args=args)

    assert str(error.value) == error_message


def test_event_get_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of event_get_command function.

    Given:
        - command arguments for event_get_command
    When:
        - Calling `event_get_command` function
    Then:
        - Returns a valid output
    """
    from Ignite import event_get_command

    mock_response_events = util_load_json("test_data/event_get_response.json")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["EVENT_GET"].format("1")}', json=mock_response_events, status_code=200)

    resp = event_get_command(mock_client, args={"event_id": "1"})

    output_list_events = util_load_json("test_data/event_get_output.json")

    hr_output_for_events = util_load_text_data("test_data/event_get_hr.md")

    assert resp.outputs_prefix == OUTPUT_PREFIX["EVENT"]
    assert resp.outputs_key_field == OUTPUT_KEY_FIELD["EVENT_ID"]
    assert resp.readable_output == hr_output_for_events
    assert resp.outputs == output_list_events
    assert resp.raw_response == mock_response_events


def test_event_get_command_no_result(requests_mock, mock_client):
    """
    Test case scenario with no results execution of event_get_command function.

    Given:
        - command arguments for event_get_command
    When:
        - Calling `event_get_command` function
    Then:
        - Returns a valid output
    """
    from Ignite import event_get_command

    mock_response_events = []

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["EVENT_GET"].format("1")}', json=mock_response_events, status_code=200)

    resp = event_get_command(mock_client, args={"event_id": "1"})

    assert resp.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("event")
    assert resp.raw_response == mock_response_events


def test_event_get_command_with_empty_argument(mock_client):
    """
    Test case scenario for the execution of event_get_command with empty argument.

    Given:
       - mocked client
    When:
       - Calling `event_get_command` function
    Then:
       - Returns exception
    """
    from Ignite import event_get_command

    with pytest.raises(DemistoException) as err:
        event_get_command(mock_client, args={})

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("event_id") in str(err.value)


def test_flashpoint_ignite_compromised_credentials_command_with_arguments(requests_mock, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-compromised-credentials-list with arguments provided.

    Given:
        - mocked client
    When:
        - Calling `flashpoint_ignite_compromised_credentials_list_command` function.
    Then:
        - Returns valid command output
    """
    from Ignite import flashpoint_ignite_compromised_credentials_list_command

    args = {
        "end_date": "now",
        "filter_date": "first_observed_at",
        "is_fresh": "true",
        "page_number": "1",
        "page_size": "1",
        "sort_date": "created_at",
        "sort_order": "asc",
        "start_date": "3 years",
    }

    mock_response: dict = util_load_json(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)),
            "test_data/get_compromised_credentials_list.json",
        )
    )

    with open(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)),
            "test_data/get_compromised_credentials_hr_output.md",
        )
    ) as file:
        hr_output = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response["raw_response"], status_code=200)
    response = flashpoint_ignite_compromised_credentials_list_command(client=mock_client, args=args)

    assert response.raw_response == mock_response["raw_response"]
    assert response.outputs_prefix == OUTPUT_PREFIX["COMPROMISED_CREDENTIALS"]
    assert response.outputs_key_field == "_id"
    assert response.outputs == mock_response["outputs"]
    assert response.readable_output == hr_output


def test_flashpoint_ignite_compromised_credentials_with_no_response(mock_client, requests_mock):
    """
    Test case scenario for execution of flashpoint-ignite-compromised-credentials-list with no response.

    Given:
        - mocked client
    When:
        - Calling `flashpoint_ignite_compromised_credentials_list_command` function.
    Then:
        - Returns valid command output
    """
    from Ignite import flashpoint_ignite_compromised_credentials_list_command

    mock_response: dict = {}

    args = {
        "end_date": "now",
        "filter_date": "created_at",
        "is_fresh": "false",
        "page_number": "1",
        "page_size": "1",
        "sort_date": "first_observed_at",
        "sort_order": "asc",
        "start_date": "now",
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    response = flashpoint_ignite_compromised_credentials_list_command(client=mock_client, args=args)

    assert response.readable_output == "No compromised credentials were found for the given argument(s)."
    assert response.raw_response == mock_response


@pytest.mark.parametrize(
    "args,error_message",
    [
        ({"page_size": "1001"}, MESSAGES["PAGE_SIZE_ERROR"].format("1001", MAX_PAGE_SIZE)),
        ({"page_size": "-1"}, MESSAGES["PAGE_SIZE_ERROR"].format("-1", MAX_PAGE_SIZE)),
        ({"page_number": "-1"}, MESSAGES["PAGE_NUMBER_ERROR"].format("-1")),
        ({"sort_order": "abc"}, MESSAGES["SORT_ORDER_ERROR"].format("abc", SORT_ORDER_VALUES)),
        ({"page_size": "1000", "page_number": "100"}, MESSAGES["PRODUCT_ERROR"].format(MAX_PRODUCT, 100000)),
        ({"end_date": "2 days"}, MESSAGES["START_DATE_ERROR"]),
        ({"sort_date": "updated_at"}, MESSAGES["SORT_DATE_ERROR"].format("updated_at", SORT_DATE_VALUES)),
        ({"start_date": "2 days"}, MESSAGES["MISSING_FILTER_DATE_ERROR"]),
        ({"is_fresh": "wrong", "sort_date": "created_at"}, MESSAGES["IS_FRESH_ERROR"].format("wrong", IS_FRESH_VALUES)),
        ({"filter_date": "updated_at"}, MESSAGES["FILTER_DATE_ERROR"].format("updated_at", FILTER_DATE_VALUES)),
        ({"sort_order": "asc"}, MESSAGES["MISSING_SORT_DATE_ERROR"]),
    ],
)
def test_flashpoint_ignite_compromised_credentials_with_invalid_args(args, error_message, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-compromised-credentials-list with invalid arguments provided.

    Given:
        - arguments for flashpoint_ignite_compromised_credentials_list_command.
    When:
        - Calling `flashpoint_ignite_compromised_credentials_list_command` function.
    Then:
        - Returns a valid error message.
    """
    from Ignite import flashpoint_ignite_compromised_credentials_list_command

    with pytest.raises(ValueError) as error:
        flashpoint_ignite_compromised_credentials_list_command(mock_client, args=args)

    assert str(error.value) == error_message


def test_get_report_by_id_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-get command.

    Given:
       - command arguments for  get_report_by_id_command
    When:
       - Calling ` get_report_by_id_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_report_by_id_command

    get_report = util_load_json("test_data/get_report_by_id_success.json")
    get_report_context = util_load_json("test_data/get_report_by_id_success_context.json")
    with open("test_data/get_report_by_id_success_hr.md") as file:
        hr_output_for_report = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["GET_REPORT_BY_ID"].format("0000000000000000000001")}', json=get_report, status_code=200
    )

    resp = get_report_by_id_command(mock_client, {"report_id": "0000000000000000000001"})

    assert resp.outputs_prefix == OUTPUT_PREFIX["REPORT"]
    assert resp.outputs_key_field == OUTPUT_KEY_FIELD["REPORT_ID"]
    assert resp.readable_output == hr_output_for_report
    assert resp.outputs == get_report_context
    assert resp.raw_response == get_report


def test_get_report_by_id_command_when_report_not_found(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-get command when report not found.

    Given:
       - command arguments for  get_report_by_id_command
    When:
       - Calling ` get_report_by_id_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_report_by_id_command

    get_report_invalid_id = util_load_json("test_data/get_report_by_id_when_report_not_found.json")

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["GET_REPORT_BY_ID"].format("0000000000000000000001")}',
        json=get_report_invalid_id,
        status_code=404,
    )

    with pytest.raises(DemistoException) as err:
        get_report_by_id_command(mock_client, {"report_id": "0000000000000000000001"})

    assert str(err.value) == MESSAGES["STATUS_CODE"].format(404, MESSAGES["NO_RECORD_FOUND"])


def test_get_report_by_id_command_when_invalid_argument(mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-report-get command
    when invalid argument provided.
    Given:
       - command arguments for get_report_by_id_command
    When:
       - Calling `get_report_by_id_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import get_report_by_id_command

    args = {"report_id": " "}
    with pytest.raises(ValueError) as err:
        get_report_by_id_command(mock_client, remove_space_from_args(args))

    assert str(err.value) == MESSAGES["MISSING_REQUIRED_ARGS"].format("report_id")


def test_related_report_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-related-report-list command.

    Given:
       - command arguments for related_report_list_command
    When:
       - Calling `related_report_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import related_report_list_command

    related_report_lists = util_load_json("test_data/related_report_list_success.json")
    related_report_lists_context = util_load_json("test_data/related_report_list_success_context.json")
    with open("test_data/hr_output_for_related_report_list_success.md") as file:
        hr_output_for_related_reports = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["RELATED_REPORT_LIST"].format("0000000000000000000001")}?limit=5',
        json=related_report_lists,
        status_code=200,
    )

    resp = related_report_list_command(mock_client, {"report_id": "0000000000000000000001"})

    assert resp.outputs_prefix == OUTPUT_PREFIX["REPORT"]
    assert resp.outputs_key_field == OUTPUT_KEY_FIELD["REPORT_ID"]
    assert resp.readable_output == hr_output_for_related_reports
    assert resp.outputs == related_report_lists_context
    assert resp.raw_response == related_report_lists


def test_related_report_list_command_success_when_empty_response(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-related-report-list command with empty response.

    Given:
       - command arguments for related_report_list_command
    When:
       - Calling `related_report_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import related_report_list_command

    related_report_lists_empty_data = util_load_json("test_data/related_report_list_success_empty_response.json")
    with open("test_data/hr_output_for_related_report_list_success_empty_response.md") as file:
        hr_output_for_related_reports = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["RELATED_REPORT_LIST"].format("0000000000000000000001")}?limit=5',
        json=related_report_lists_empty_data,
        status_code=200,
    )

    resp = related_report_list_command(mock_client, {"report_id": "0000000000000000000001"})

    assert resp.readable_output == hr_output_for_related_reports
    assert resp.raw_response == related_report_lists_empty_data


def test_related_report_list_command_when_report_not_found(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-related-report-list
    command when report not found.

    Given:
       - command arguments for  related_report_list_command
    When:
       - Calling ` related_report_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import related_report_list_command

    report_invalid_id = util_load_json("test_data/get_report_by_id_when_report_not_found.json")

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["RELATED_REPORT_LIST"].format("0000000000000000000001")}?limit=5',
        json=report_invalid_id,
        status_code=404,
    )

    with pytest.raises(DemistoException) as err:
        related_report_list_command(mock_client, {"report_id": "0000000000000000000001"})

    assert str(err.value) == MESSAGES["STATUS_CODE"].format(404, MESSAGES["NO_RECORD_FOUND"])


def test_related_report_list_command_when_invalid_argument(mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-intelligence-related-report-list command
    when invalid argument provided.
    Given:
       - command arguments for related_report_list_command
    When:
       - Calling `related_report_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import related_report_list_command

    args = {"report_id": " "}
    with pytest.raises(ValueError) as err:
        related_report_list_command(mock_client, remove_space_from_args(args))

    assert str(err.value) == MESSAGES["MISSING_REQUIRED_ARGS"].format("report_id")


@patch("demistomock.results")
def test_email(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of email command through main function
    when it returns reputation about given email address.

    Given:
       - mocked client
    When:
       - Calling `email_lookup_command` function
    Then:
       - Returns list of command results.
    """

    email_reputation = util_load_json("test_data/email_reputation.json")
    email_reputation_context = util_load_json("test_data/email_reputation_context.json")
    with open("test_data/hr_output_for_email_reputation.md") as file:
        hr_output_for_email_reputation = file.read()
    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query=%2Btype%3A%28%22email-dst%22%2C%20"
        f"%22email-src%22%2C%20%22email-src-display-name%22%2C%20%22email-subject%22%2C%20"
        f"%22email%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy%40dummy.com%22",
        json=email_reputation,
        status_code=200,
    )
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"email": "dummy@dummy.com"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="email")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert hr_output_for_email_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert email_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert email_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_email_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of email command through main function
    when Ignite do not have data about that email address.

    Given:
       - mocked client
    When:
       - Calling `email_lookup_command` function
    Then:
       - Returns list of command results.
    """

    email_reputation = util_load_json("test_data/email_reputation_empty.json")
    email_reputation_context = util_load_json("test_data/email_reputation_context_empty.json")
    with open("test_data/hr_output_for_email_reputation_empty.md") as file:
        hr_output_for_email_reputation = file.read()

    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query=%2Btype%3A%28%22email-dst%22%2C%20"
        f"%22email-src%22%2C%20%22email-src-display-name%22%2C%20%22email-subject%22%2C%20"
        f"%22email%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy2%40dummy.com%22",
        json=email_reputation,
        status_code=200,
    )

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"email": "dummy2@dummy.com"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="email")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert hr_output_for_email_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert email_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert email_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_filename(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of filename command through main function
    when it returns reputation about given filename.

    Given:
       - mocked client
    When:
       - Calling `filename_lookup_command` function
    Then:
       - Returns list of command results.
    """

    filename_reputation = util_load_json("test_data/filename_reputation.json")
    filename_reputation_context = util_load_json("test_data/filename_reputation_context.json")
    with open("test_data/filename_reputation_hr.md") as file:
        filename_reputation_hr = file.read()

    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query="
        f"%2Btype%3A%28%22filename%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy.log%22",
        json=filename_reputation,
        status_code=200,
    )
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"filename": "dummy.log"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="filename")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert filename_reputation_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert filename_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert filename_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_filename_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of filename command through main function
    when Ignite do not have data about that filename.

    Given:
       - mocked client
    When:
       - Calling `filename_lookup_command` function
    Then:
       - Returns list of command results.
    """
    filename_reputation = util_load_json("test_data/filename_reputation_empty.json")
    filename_reputation_context = util_load_json("test_data/filename_reputation_context_empty.json")
    with open("test_data/filename_reputation_empty_hr.md") as file:
        filename_reputation_empty_hr = file.read()

    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query="
        f"%2Btype%3A%28%22filename%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy2.log%22",
        json=filename_reputation,
        status_code=200,
    )

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"filename": "dummy2.log"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="filename")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert filename_reputation_empty_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert filename_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert filename_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_email_ignores_exact_match(mock_return, requests_mock, mocker, exact_match):
    """
    Test that exact_match argument has no effect on the email command.

    Given:
       - exact_match is True or False in command args
    When:
       - Calling `email_lookup_command` via main function
    Then:
       - The outbound query value is not double-wrapped in quotes and the
         response/context is unchanged regardless of exact_match.
    """
    email_reputation = util_load_json("test_data/email_reputation.json")
    email_reputation_context = util_load_json("test_data/email_reputation_context.json")
    with open("test_data/hr_output_for_email_reputation.md") as file:
        hr_output_for_email_reputation = file.read()

    email_value = "dummy@dummy.com"
    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query=%2Btype%3A%28%22email-dst%22%2C%20"
        f"%22email-src%22%2C%20%22email-src-display-name%22%2C%20%22email-subject%22%2C%20"
        f"%22email%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy%40dummy.com%22",
        json=email_reputation,
        status_code=200,
    )
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"email": email_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="email")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    last_request = requests_mock.last_request
    query = last_request.qs["query"][0]
    # The guard must drop exact_match for email; value must appear with exactly one layer of quotes
    assert f'keyword:"{email_value}"' in query
    assert f'keyword:""{email_value}' not in query

    assert hr_output_for_email_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert email_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert email_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_filename_ignores_exact_match(mock_return, requests_mock, mocker, exact_match):
    """
    Test that exact_match argument has no effect on the filename command.

    Given:
       - exact_match is True or False in command args
    When:
       - Calling `filename_lookup_command` via main function
    Then:
       - The outbound query value is not double-wrapped in quotes and the
         response/context is unchanged regardless of exact_match.
    """
    filename_reputation = util_load_json("test_data/filename_reputation.json")
    filename_reputation_context = util_load_json("test_data/filename_reputation_context.json")
    with open("test_data/filename_reputation_hr.md") as file:
        filename_reputation_hr = file.read()

    filename_value = "dummy.log"
    requests_mock.get(
        f"{MOCK_URL}/technical-intelligence/v1/simple?query="
        f"%2Btype%3A%28%22filename%22%29%20%2Bvalue.%5C%2A.keyword%3A%22dummy.log%22",
        json=filename_reputation,
        status_code=200,
    )
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"filename": filename_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="filename")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    last_request = requests_mock.last_request
    query = last_request.qs["query"][0]
    # The guard must drop exact_match for filename; value must appear with exactly one layer of quotes
    assert f'keyword:"{filename_value}"' in query
    assert f'keyword:""{filename_value}' not in query

    assert filename_reputation_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert filename_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert filename_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_domain_lookup_command_success(mock_return, requests_mock, mocker, exact_match):
    """
    Test case for successful execution of domain look up command through main function
    when it returns reputation about given domain indicator.

    Given:
       - mocked client
    When:
       - Calling `domain_lookup_command` function
    Then:
       - Returns list of command results.
    """

    domain_lookup_reputation = util_load_json("test_data/domain_lookup_reputation.json")
    domain_lookup_reputation_context = util_load_json("test_data/domain_lookup_reputation_context.json")
    with open("test_data/hr_output_for_domain_lookup_reputation.md") as file:
        hr_output_for_domain_lookup_reputation = file.read()

    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'

    requests_mock.get(url, json=domain_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    domain_value = "dummy_domain.com"
    args = {"domain": domain_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="domain")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    last_request = requests_mock.last_request
    domain_value = f'"{domain_value}"' if exact_match else domain_value
    assert last_request.qs["ioc_value"] == [domain_value]

    assert hr_output_for_domain_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert domain_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert domain_lookup_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize(
    "config_exact_match, arg_exact_match, expected_quoted",
    [
        (True, None, True),
        (True, False, False),
        (False, True, True),
    ],
)
def test_domain_lookup_command_config_exact_match(
    mock_return, requests_mock, mocker, config_exact_match, arg_exact_match, expected_quoted
):
    """
    Test case scenario for exact_match precedence:
    - config-level exact_match is used when argument is not provided.
    - command argument takes precedence over config when provided.

    Given:
       - Various combinations of config-level and argument-level exact_match
    When:
       - Calling `domain_lookup_command` via main function
    Then:
       - exact_match resolves correctly based on precedence rules.
    """
    domain_lookup_reputation = util_load_json("test_data/domain_lookup_reputation.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=domain_lookup_reputation, status_code=200)

    domain_value = "dummy_domain.com"
    args: dict = {"domain": domain_value}
    if arg_exact_match is not None:
        args["exact_match"] = arg_exact_match

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable", "ioc_enrichment_exact_match": config_exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="domain")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    expected_value = f'"{domain_value}"' if expected_quoted else domain_value
    assert requests_mock.last_request.qs["ioc_value"] == [expected_value]


@patch("demistomock.results")
def test_domain_lookup_command_success_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of domain look up command through main function
    when it returns empty reputation about given domain indicator.

    Given:
       - mocked client
    When:
       - Calling `domain_lookup_command` function
    Then:
       - Returns list of command results.
    """

    domain_lookup_empty_reputation_context = util_load_json("test_data/domain_lookup_empty_reputation_context.json")
    with open("test_data/hr_output_for_domain_lookup_empty_reputation.md") as file:
        hr_output_for_domain_lookup_reputation = file.read()

    response = util_load_json("test_data/domain_lookup_v2_empty_response.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'

    requests_mock.get(url, json=response, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"domain": "dummy_domain.com"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="domain")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_domain_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert domain_lookup_empty_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert mock_return.call_args.args[0].get("Contents") == response


def test_domain_lookup_command_when_invalid_value_is_provided(mocker):
    """
    Test case for successful execution of domain look up command through main function
    when domain indicator's value is blank.

    Given:
       - mocked client
    When:
       - Calling `domain_lookup_command` function
    Then:
       - Returns list of command results.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"domain": " "}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="domain")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("domain") in return_error.call_args[0][0]


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_ip_lookup_command_success(mock_return, requests_mock, mocker, exact_match):
    """
    Test case for successful execution of ip look up command through main function
    when it returns reputation about given ip indicator.

    Given:
       - mocked client
    When:
       - Calling `ip_lookup_command` function
    Then:
       - Returns list of command results.
    """

    ip_lookup_reputation = util_load_json("test_data/ip_lookup_reputation.json")
    ip_lookup_reputation_context = util_load_json("test_data/ip_lookup_reputation_context.json")
    with open("test_data/hr_output_for_ip_lookup_reputation.md") as file:
        hr_output_for_ip_lookup_reputation = file.read()

    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=ip_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    ip_value = "0.0.0.1"
    args = {"ip": ip_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="ip")
    mocker.patch.object(demisto, "args", return_value=args)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    main()

    last_request = requests_mock.last_request
    ip_value = f'"{ip_value}"' if exact_match else ip_value
    assert last_request.qs["ioc_value"] == [ip_value]

    assert hr_output_for_ip_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert ip_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert ip_lookup_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize(
    "config_exact_match, arg_exact_match, expected_quoted",
    [
        (True, None, True),
        (True, False, False),
        (False, True, True),
    ],
)
def test_ip_lookup_command_config_exact_match(
    mock_return, requests_mock, mocker, config_exact_match, arg_exact_match, expected_quoted
):
    """
    Test case scenario for exact_match precedence:
    - config-level exact_match is used when argument is not provided.
    - command argument takes precedence over config when provided.

    Given:
       - Various combinations of config-level and argument-level exact_match
    When:
       - Calling `ip_lookup_command` via main function
    Then:
       - exact_match resolves correctly based on precedence rules.
    """
    ip_lookup_reputation = util_load_json("test_data/ip_lookup_reputation.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=ip_lookup_reputation, status_code=200)

    ip_value = "0.0.0.1"
    args: dict = {"ip": ip_value}
    if arg_exact_match is not None:
        args["exact_match"] = arg_exact_match

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable", "ioc_enrichment_exact_match": config_exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="ip")
    mocker.patch.object(demisto, "args", return_value=args)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)

    main()

    expected_value = f'"{ip_value}"' if expected_quoted else ip_value
    assert requests_mock.last_request.qs["ioc_value"] == [expected_value]


@patch("demistomock.results")
def test_ip_lookup_command_community_search_success(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of ip look up command through main function
    when it returns reputation about given ip indicator.

    Given:
       - mocked client
    When:
       - Calling `ip_lookup_command` function
    Then:
       - Returns list of command results.
    """

    empty_response = util_load_json("test_data/ip_lookup_reputation_v2_empty_response.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=empty_response, status_code=200)

    ip_lookup_community_search_reputation = util_load_json("test_data/ip_lookup_community_search_reputation.json")
    ip_lookup_community_search_reputation_context = util_load_json("test_data/ip_lookup_community_search_reputation_context.json")
    with open("test_data/hr_output_for_ip_lookup_community_search_reputation.md") as file:
        hr_output_for_ip_lookup_community_search_reputation = file.read()

    community_search_url = f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}'
    requests_mock.post(community_search_url, json=ip_lookup_community_search_reputation, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"ip": "0.0.0.1"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="ip")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_ip_lookup_community_search_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert ip_lookup_community_search_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert ip_lookup_community_search_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_ip_lookup_command_success_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of ip look up command through main function
    when it returns empty reputation about given ip indicator.

    Given:
       - mocked client
    When:
       - Calling `ip_lookup_command` function
    Then:
       - Returns list of command results.
    """

    ip_lookup_empty_reputation_context = util_load_json("test_data/ip_lookup_empty_reputation_context.json")
    with open("test_data/hr_output_for_ip_lookup_empty_reputation.md") as file:
        hr_output_for_ip_lookup_reputation = file.read()

    empty_response = util_load_json("test_data/ip_lookup_reputation_v2_empty_response.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=empty_response, status_code=200)

    ip_lookup_community_search_empty_reputation = util_load_json("test_data/ip_lookup_community_search_empty_reputation.json")
    community_search_url = f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}'
    requests_mock.post(community_search_url, json=ip_lookup_community_search_empty_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"ip": "0.0.0.1"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="ip")
    mocker.patch.object(demisto, "args", return_value=args)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)

    main()

    assert hr_output_for_ip_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert ip_lookup_empty_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert mock_return.call_args.args[0].get("Contents") == empty_response


@pytest.mark.parametrize(
    "args, error_msg",
    [
        ({"ip": "dummy.com"}, MESSAGES["INVALID_IP_ADDRESS"].format("dummy.com")),
        ({"ip": " "}, MESSAGES["MISSING_REQUIRED_ARGS"].format("ip")),
    ],
)
def test_ip_lookup_command_when_invalid_value_is_provided(mocker, args, error_msg, capfd):
    """
    Test case for successful execution of ip look up command through main function
    when ip indicator's value is invalid.

    Given:
       - mocked client
    When:
       - Calling `ip_lookup_command` function
    Then:
       - Returns list of command results.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}

    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="ip")
    mocker.patch.object(demisto, "args", return_value=args)
    return_error = mocker.patch.object(Ignite, "return_error")

    capfd.close()
    main()

    assert error_msg in return_error.call_args[0][0]


@patch("demistomock.results")
def test_common_lookup_command_success(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of common look up command through main function
    when it returns reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """

    common_lookup_reputation = util_load_json("test_data/common_lookup_reputation.json")
    common_lookup_reputation_context = util_load_json("test_data/common_lookup_reputation_context.json")
    with open("test_data/hr_output_for_common_lookup_reputation.md") as file:
        hr_output_for_common_lookup_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=common_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": "00000000000000000000000000000001"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_common_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert common_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert common_lookup_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_common_lookup_command_success_when_indicator_type_is_ipv4(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of common look up command through main function
    when it returns reputation about given ip indicator.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """

    common_lookup_reputation = util_load_json("test_data/common_lookup_ipv4_reputation.json")
    common_lookup_reputation_context = util_load_json("test_data/common_lookup_ipv4_reputation_context.json")
    with open("test_data/hr_output_for_common_lookup_ipv4_reputation.md") as file:
        hr_output_for_common_lookup_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=common_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": "0.0.0.0"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_common_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert common_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert common_lookup_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_common_lookup_command_success_when_indicator_type_is_ipv6(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of common look up command through main function
    when it returns reputation about given ip indicator.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """

    common_lookup_reputation = util_load_json("test_data/common_lookup_ipv6_reputation.json")
    common_lookup_reputation_context = util_load_json("test_data/common_lookup_ipv6_reputation_context.json")
    with open("test_data/hr_output_for_common_lookup_ipv6_reputation.md") as file:
        hr_output_for_common_lookup_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=common_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": "0:0:0:0:0:0:0:0"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_common_lookup_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert common_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert common_lookup_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_common_lookup_command_when_custom_indicator_provided(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of flashpoint-ignite-common-lookup command through main function
    when it returns reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """

    indicator_reputation = util_load_json("test_data/common_lookup_custom_indicator_reputation.json")
    indicator_reputation_context = util_load_json("test_data/common_lookup_custom_indicator_reputation_context.json")
    with open("test_data/hr_output_for_common_lookup_custom_indicator_reputation.md") as file:
        hr_output_for_indicator_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=indicator_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": "dummy_value"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_indicator_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert indicator_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert indicator_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_common_lookup_command_success_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of common look up command through main function
    when it returns empty reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """

    common_lookup_reputation = util_load_json("test_data/common_lookup_reputation_empty.json")
    common_lookup_reputation_context = util_load_json("test_data/common_lookup_reputation_context_empty.json")
    with open("test_data/hr_output_for_common_lookup_empty_response.md") as file:
        hr_output_for_common_lookup_empty_response = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=common_lookup_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": "dummy@dummy.com"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_common_lookup_empty_response == mock_return.call_args.args[0].get("HumanReadable")
    assert common_lookup_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert common_lookup_reputation == mock_return.call_args.args[0].get("Contents")


def test_common_lookup_command_when_invalid_value_is_provided(mocker):
    """
    Test case for successful execution of common look up command through main function
    when indicator's value is blank.

    Given:
       - mocked client
    When:
       - Calling `common_lookup_command` function
    Then:
       - Returns list of command results.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator": " "}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-common-lookup")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("indicator") in return_error.call_args[0][0]


@patch("demistomock.results")
def test_indicator_get_command_success(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of flashpoint-ignite-indicator-get command through main function
    when it returns reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `indicator_get_command` function
    Then:
       - Returns list of command results.
    """

    indicator_reputation = util_load_json("test_data/indicator_reputation.json")
    indicator_reputation_context = util_load_json("test_data/indicator_reputation_context.json")
    with open("test_data/hr_output_for_indicator_reputation.md") as file:
        hr_output_for_indicator_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}/dummy_id', json=indicator_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator_id": "dummy_id"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-indicator-get")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_indicator_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert indicator_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert indicator_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_indicator_get_command_when_custom_indicator_provided(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of flashpoint-ignite-indicator-get command through main function
    when it returns reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `indicator_get_command` function
    Then:
       - Returns list of command results.
    """

    indicator_reputation = util_load_json("test_data/custom_indicator_reputation.json")
    indicator_reputation_context = util_load_json("test_data/custom_indicator_reputation_context.json")
    with open("test_data/hr_output_for_custom_indicator_reputation.md") as file:
        hr_output_for_indicator_reputation = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}/dummy_id', json=indicator_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator_id": "dummy_id"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-indicator-get")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert hr_output_for_indicator_reputation == mock_return.call_args.args[0].get("HumanReadable")
    assert indicator_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert indicator_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
def test_indicator_get_command_success_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of flashpoint-ignite-indicator-get command through main function
    when it returns empty reputation about given indicator.

    Given:
       - mocked client
    When:
       - Calling `indicator_get_command` function
    Then:
       - Returns list of command results.
    """

    with open("test_data/hr_output_for_indicator_empty_response.md") as file:
        hr_output_for_indicator_empty_response = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}/dummy_id', json={}, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator_id": "dummy_id"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-indicator-get")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert mock_return.call_args.args[0].get("HumanReadable") == hr_output_for_indicator_empty_response
    assert mock_return.call_args.args[0].get("EntryContext") == {}
    assert mock_return.call_args.args[0].get("Contents") == {}


def test_indicator_get_command_when_invalid_value_is_provided(mocker):
    """
    Test case for  execution of flashpoint-ignite-indicator-get command through main function
    when indicator's value is blank.

    Given:
       - mocked client
    When:
       - Calling `indicator_get_command` function
    Then:
       - raises error.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"indicator_id": " "}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-indicator-get")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("indicator_id") in return_error.call_args[0][0]


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_url_lookup_command_success(mock_return, requests_mock, mocker, exact_match):
    """
    Test case for successful execution of url lookup command through main function
    when it returns reputation about given url.

    Given:
       - mocked client
    When:
       - Calling `url_lookup_command` function
    Then:
       - Returns list of command results.
    """

    url_reputation = util_load_json("test_data/url_reputation.json")
    url_reputation_context = util_load_json("test_data/url_reputation_context.json")
    with open("test_data/url_reputation_hr.md") as file:
        url_reputation_hr = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=url_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    url_value = "http://dummy.com"
    args = {"url": url_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="url")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    last_request = requests_mock.last_request
    url_value = f'"{url_value}"' if exact_match else url_value
    assert last_request.qs["ioc_value"] == [url_value]

    assert url_reputation_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert url_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert url_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize(
    "config_exact_match, arg_exact_match, expected_quoted",
    [
        (True, None, True),
        (True, False, False),
        (False, True, True),
    ],
)
def test_url_lookup_command_config_exact_match(
    mock_return, requests_mock, mocker, config_exact_match, arg_exact_match, expected_quoted
):
    """
    Test case scenario for exact_match precedence:
    - config-level exact_match is used when argument is not provided.
    - command argument takes precedence over config when provided.

    Given:
       - Various combinations of config-level and argument-level exact_match
    When:
       - Calling `url_lookup_command` via main function
    Then:
       - exact_match resolves correctly based on precedence rules.
    """
    url_reputation = util_load_json("test_data/url_reputation.json")
    mock_url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(mock_url, json=url_reputation, status_code=200)

    url_value = "https://dummy_url.com"
    args: dict = {"url": url_value}
    if arg_exact_match is not None:
        args["exact_match"] = arg_exact_match

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable", "ioc_enrichment_exact_match": config_exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="url")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    expected_value = f'"{url_value}"' if expected_quoted else url_value
    assert requests_mock.last_request.qs["ioc_value"] == [expected_value]


@patch("demistomock.results")
def test_url_lookup_command_success_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of url lookup command through main function
    when Ignite do not have data about that url.

    Given:
       - mocked client
    When:
       - Calling `url_lookup_command` function
    Then:
       - Returns list of command results.
    """

    url_reputation = util_load_json("test_data/url_reputation_empty.json")
    url_reputation_context = util_load_json("test_data/url_reputation_context_empty.json")
    with open("test_data/url_reputation_hr_empty.md") as file:
        url_reputation_hr = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=url_reputation, status_code=200)

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"url": "http://dummy2.com"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="url")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert url_reputation_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert url_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert url_reputation == mock_return.call_args.args[0].get("Contents")


def test_url_lookup_command_when_invalid_value_is_provided(mocker):
    """
    Test case for successful execution of url lookup command through main function
    when url indicator's value is blank.

    Given:
       - mocked client
    When:
       - Calling `url_lookup_command` function
    Then:
       - Returns list of command results.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"url": " "}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="url")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("url") in return_error.call_args[0][0]


@patch("demistomock.results")
@pytest.mark.parametrize("exact_match", [True, False])
def test_file_lookup_command_success(mock_return, requests_mock, mocker, exact_match):
    """
    Test case for successful execution of file command through main function
    when it returns reputation about given file.

    Given:
       - mocked client
    When:
       - Calling `file_lookup_command` function
    Then:
       - Returns list of command results.
    """

    file_reputation = util_load_json("test_data/file_reputation.json")
    file_reputation_context = util_load_json("test_data/file_reputation_context.json")
    with open("test_data/file_reputation_hr.md") as file:
        file_reputation_hr = file.read()

    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=file_reputation, status_code=200)
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    file_value = "00000000000000000000000000000001"
    args = {"file": file_value, "exact_match": exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="file")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    last_request = requests_mock.last_request
    file_value = f'"{file_value}"' if exact_match else file_value
    assert last_request.qs["ioc_value"] == [file_value]

    assert file_reputation_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert file_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert file_reputation == mock_return.call_args.args[0].get("Contents")


@patch("demistomock.results")
@pytest.mark.parametrize(
    "config_exact_match, arg_exact_match, expected_quoted",
    [
        (True, None, True),
        (True, False, False),
        (False, True, True),
    ],
)
def test_file_lookup_command_config_exact_match(
    mock_return, requests_mock, mocker, config_exact_match, arg_exact_match, expected_quoted
):
    """
    Test case scenario for exact_match precedence:
    - config-level exact_match is used when argument is not provided.
    - command argument takes precedence over config when provided.

    Given:
       - Various combinations of config-level and argument-level exact_match
    When:
       - Calling `file_lookup_command` via main function
    Then:
       - exact_match resolves correctly based on precedence rules.
    """
    file_reputation = util_load_json("test_data/file_reputation.json")
    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=file_reputation, status_code=200)

    file_value = "00000000000000000000000000000001"
    args: dict = {"file": file_value}
    if arg_exact_match is not None:
        args["exact_match"] = arg_exact_match

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable", "ioc_enrichment_exact_match": config_exact_match}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="file")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    expected_value = f'"{file_value}"' if expected_quoted else file_value
    assert requests_mock.last_request.qs["ioc_value"] == [expected_value]


@patch("demistomock.results")
def test_file_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of file command through main function
    when Ignite do not have data about that file.

    Given:
       - mocked client
    When:
       - Calling `file_lookup_command` function
    Then:
       - Returns list of command results.
    """
    file_reputation = util_load_json("test_data/file_reputation_empty.json")
    file_reputation_context = util_load_json("test_data/file_reputation_context_empty.json")
    with open("test_data/file_reputation_empty_hr.md") as file:
        file_reputation_empty_hr = file.read()

    url = f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}'
    requests_mock.get(url, json=file_reputation, status_code=200)

    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"file": "10000000000000000000000000000000"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="file")
    mocker.patch.object(demisto, "args", return_value=args)

    main()
    assert file_reputation_empty_hr == mock_return.call_args.args[0].get("HumanReadable")
    assert file_reputation_context == mock_return.call_args.args[0].get("EntryContext")
    assert file_reputation == mock_return.call_args.args[0].get("Contents")


def test_file_lookup_command_when_invalid_value_is_provided(mocker):
    """
    Test case for unsuccessful execution of file look up command through main function
    when file indicator's value is blank.

    Given:
       - mocked client
    When:
       - Calling `file_lookup_command` function
    Then:
       - Returns list of command results.
    """
    params = {**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"}
    args = {"file": " "}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="file")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("file") in return_error.call_args[0][0]


def test_fetch_incidents_alerts_success(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch alerts.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {}

    mock_response: dict = util_load_json("test_data/fetch_alerts.json")

    incidents_response = util_load_json("test_data/incidents_alerts.json")

    params: dict = {"fetch_type": "Alerts", "first_fetch": "2024-06-14T06:17:17Z", "max_fetch": 4}

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=mock_response, status_code=200)

    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params=params)

    END_TIME = next_run.get("before_time")

    expected_next_run = {
        "after_time": "2024-06-14T06:17:17Z",
        "before_time": END_TIME,
        "cursor": "1718788282.118454",
        "alert_ids": [
            "00000000-0000-0000-0000-000000000001",
            "00000000-0000-0000-0000-000000000002",
            "00000000-0000-0000-0000-000000000003",
            "00000000-0000-0000-0000-000000000004",
            "00000000-0000-0000-0000-000000000005",
            "00000000-0000-0000-0000-000000000006",
        ],
    }

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_alerts_when_params_not_provided_and_last_run_provided(mocker, mock_client, requests_mock):
    """
    Test case scenario of fetch_incidents for fetch alerts when params not provided and last run is provided.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "after_time": "2024-06-14T06:17:17Z",
        "before_time": "2024-06-17T06:17:17Z",
        "alert_ids": ["00000000-0000-0000-0000-000000000000"],
    }

    mock_response: dict = util_load_json("test_data/fetch_alerts.json")

    incidents_response = util_load_json("test_data/incidents_alerts.json")

    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)
    mocker.patch.object(demisto, "command", return_value="fetch-incidents")
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=mock_response, status_code=200)

    next_run, incidents = fetch_incidents(
        client=mock_client, last_run=last_run, params={"max_fetch": 201, "fetch_type": "Alerts"}
    )

    END_TIME = next_run.get("before_time")

    expected_next_run = {
        "after_time": "2024-06-14T06:17:17Z",
        "before_time": END_TIME,
        "cursor": "1718788282.118454",
        "alert_ids": [
            "00000000-0000-0000-0000-000000000000",
            "00000000-0000-0000-0000-000000000001",
            "00000000-0000-0000-0000-000000000002",
            "00000000-0000-0000-0000-000000000003",
            "00000000-0000-0000-0000-000000000004",
            "00000000-0000-0000-0000-000000000005",
            "00000000-0000-0000-0000-000000000006",
        ],
    }
    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_alerts_to_check_duplicates_incidents(mock_client, requests_mock):
    """
    Test case scenario of fetch_incidents for fetch alerts to check duplicate records in response. .

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid command output.
    """
    from Ignite import fetch_incidents

    last_run = {
        "after_time": "2024-06-14T06:17:17Z",
        "before_time": "2024-06-17T06:17:17Z",
        "alert_ids": [
            "00000000-0000-0000-0000-000000000001",
            "00000000-0000-0000-0000-000000000002",
            "00000000-0000-0000-0000-000000000003",
            "00000000-0000-0000-0000-000000000004",
            "00000000-0000-0000-0000-000000000005",
            "00000000-0000-0000-0000-000000000006",
        ],
    }

    mock_response: dict = util_load_json("test_data/fetch_alerts.json")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=mock_response, status_code=200)

    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params={"max_fetch": 1, "fetch_type": "Alerts"})

    END_TIME = next_run.get("before_time")

    expected_next_run = {
        "after_time": "2024-06-14T06:17:17Z",
        "before_time": END_TIME,
        "cursor": "1718788282.118454",
        "alert_ids": [
            "00000000-0000-0000-0000-000000000001",
            "00000000-0000-0000-0000-000000000002",
            "00000000-0000-0000-0000-000000000003",
            "00000000-0000-0000-0000-000000000004",
            "00000000-0000-0000-0000-000000000005",
            "00000000-0000-0000-0000-000000000006",
        ],
    }
    assert incidents == []
    assert next_run == expected_next_run


def test_fetch_incidents_alerts_when_invalid_arguments_provided(mock_client):
    """
    Test case scenario for execution of fetch_incidents for fetch alerts when invalid arguments provided.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Raise error message.
    """
    from Ignite import fetch_incidents

    error_message = MESSAGES["INVALID_MAX_FETCH"].format("0")
    with pytest.raises(DemistoException) as error:
        fetch_incidents(client=mock_client, last_run={}, params={"max_fetch": 0, "fetch_type": "Alerts"})

    assert str(error.value) == error_message


def test_test_module_with_fetch_incidents_alerts(requests_mock, mock_client):
    """
    Test case scenario for execution of fetch_incident when is_test is true.

    Given:
        - mock client
    When:
        - Calling `fetch_incident` function
    Then:
        - Returns a valid output
    """
    from Ignite import fetch_incidents

    mock_response: dict = util_load_json("test_data/fetch_alerts.json")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=mock_response, status_code=200)

    next_run, incidents = fetch_incidents(
        client=mock_client, last_run={}, params={"max_fetch": 2, "fetch_type": "Alerts"}, is_test=True
    )

    assert next_run == {}
    assert incidents == []


def test_alert_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-alert-list command.

    Given:
       - command arguments for alert_list_command
    When:
       - Calling `alert_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import alert_list_command

    alerts = util_load_json("test_data/alert_list_success.json")
    alert_list_context = util_load_json("test_data/alert_list_success_context.json")
    with open("test_data/alert_list_success_hr.md") as file:
        hr_output_for_alerts = file.read()

    token_context = util_load_json("test_data/token_success_context.json")
    with open("test_data/token_success_hr.md") as file:
        hr_output_for_token = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=alerts, status_code=200)

    args = {"size": "4", "created_at": "2024-06-11T05:54:25Z", "created_before": "2024-06-12T05:54:25Z"}
    actual_response = alert_list_command(mock_client, args)

    assert actual_response[0].outputs_prefix == OUTPUT_PREFIX["ALERT"]
    assert actual_response[0].outputs_key_field == "id"
    assert actual_response[0].readable_output == hr_output_for_alerts
    assert actual_response[0].outputs == alert_list_context
    assert actual_response[0].raw_response == alerts

    assert actual_response[1].outputs_prefix == OUTPUT_PREFIX["TOKEN"]
    assert actual_response[1].outputs_key_field == "name"
    assert actual_response[1].readable_output == hr_output_for_token
    assert actual_response[1].outputs == token_context


def test_alert_list_command_success_when_next_is_null(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-alert-list command when next is null.

    Given:
       - command arguments for alert_list_command
    When:
       - Calling `alert_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import alert_list_command

    alerts = util_load_json("test_data/alert_list_success_next_is_null.json")
    alert_list_context = util_load_json("test_data/alert_list_success_context_next_is_null.json")
    with open("test_data/alert_list_success_next_is_null_hr.md") as file:
        hr_output_for_alerts = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=alerts, status_code=200)

    args = {
        "cursor": "0",
        "tags": "tags1,tags2",
        "sources": "source1,source2",
        "asset_ids": "asset1,asset2",
        "query_ids": "query1,query2",
        "asset_type": "assert_type",
    }
    actual_response = alert_list_command(mock_client, args)

    assert actual_response[0].outputs_prefix == OUTPUT_PREFIX["ALERT"]
    assert actual_response[0].outputs_key_field == "id"
    assert actual_response[0].readable_output == hr_output_for_alerts
    assert actual_response[0].outputs == alert_list_context
    assert actual_response[0].raw_response == alerts


def test_alert_list_command_success_when_empty_response(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-alert-list command when empty response.

    Given:
       - command arguments for alert_list_command
    When:
       - Calling `alert_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import alert_list_command

    alerts = util_load_json("test_data/alert_list_success_empty_response.json")
    with open("test_data/alert_list_success_empty_response_hr.md") as file:
        hr_output_for_alerts = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["ALERTS"]}', json=alerts, status_code=200)

    actual_response = alert_list_command(mock_client, {"size": "1"})

    assert actual_response[0].readable_output == hr_output_for_alerts
    assert actual_response[0].raw_response == alerts


@pytest.mark.parametrize(
    "args, error_msg",
    [
        ({"size": "0"}, MESSAGES["SIZE_ERROR"].format("0", MAX_ALERTS_LIMIT)),
        ({"size": "501"}, MESSAGES["SIZE_ERROR"].format("501", MAX_ALERTS_LIMIT)),
        (
            {"created_after": "2024-06-11T05:54:25Z", "created_before": "2024-06-11T05:54:25Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "created_after", "created_before", "2024-06-11T05:54:25Z", "2024-06-11T05:54:25Z"
            ),
        ),
        ({"status": "tmpStatus"}, MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("tmpstatus", "status", ALERT_STATUS_VALUES)),
        ({"origin": "tmpOrigin"}, MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("tmporigin", "origin", ALERT_ORIGIN_VALUES)),
        ({"asset_ip": "abc.com"}, MESSAGES["INVALID_IP_ADDRESS"].format("abc.com")),
    ],
)
def test_alert_list_command_success_when_invalid_argument_provided(mock_client, args, error_msg):
    """
    Test case scenario for successful execution of flashpoint-ignite-alert-list command when invalid argument provided.

    Given:
       - command arguments for alert_list_command
    When:
       - Calling `alert_list_command` function
    Then:
       - Returns a valid error message.
    """
    from Ignite import alert_list_command

    with pytest.raises(ValueError) as err:
        alert_list_command(mock_client, args)

    assert str(err.value) == error_msg


def test_module_fetch_incidents_when_max_product_exceed_total_limit(mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incident compromised credentials when is_test is true.

    Given:
       - mocked client.
    When:
       - Calling `fetch_incidents` function
    Then:
       - Returns a valid error message.
    """
    from Ignite import fetch_incidents

    mock_response: dict = util_load_json("test_data/fetch_incidents_with_check_max_product.json")

    error_message = MESSAGES["TIME_RANGE_ERROR"].format("10005")
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)

    with pytest.raises(ValueError) as error:
        fetch_incidents(client=mock_client, last_run={}, params={}, is_test=True)

    assert str(error.value) == error_message


def test_fetch_incidents_when_empty_password_complexity_filter_params_passed(mocker, mock_client, requests_mock):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - Returns a valid output.
    """
    from Ignite import fetch_incidents

    last_run: dict = {}

    mock_response: dict = util_load_json("test_data/fetch_compromised_credentials.json")

    incidents_response = util_load_json("test_data/incidents_compromised_credentials.json")

    params: dict = {
        "fetch_type": "",
        "first_fetch": "2024-05-16T10:22:38Z",
        "is_fresh_compromised_credentials": "true",
        "password_min_length": "",
        "password_has_symbol": "",
        "password_has_uppercase": "",
        "password_has_lowercase": "",
        "password_has_number": "",
        "max_fetch": 1,
    }
    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["COMPROMISED_CREDENTIALS"]}', json=mock_response, status_code=200)
    next_run, incidents = fetch_incidents(client=mock_client, last_run=last_run, params=params)

    END_TIME = next_run.get("end_time")
    expected_next_run = {
        "fetch_count": 1,
        "fetch_sum": 1,
        "total": 31,
        "end_time": END_TIME,
        "last_time": "2021-03-31T19:42:05Z",
        "hit_ids": ["sample_id_1"],
        "last_timestamp": 1617219725,
        "start_time": "2024-05-16T10:22:38Z",
    }

    assert incidents == incidents_response
    assert next_run == expected_next_run


def test_fetch_incidents_when_invalid_password_complexity_filter_params_passed(mocker, mock_client):
    """
    Test case scenario for execution of fetch_incidents for fetch compromised credentials.

    Given:
        - mock client
    When:
        - Calling `fetch_incidents` function.
    Then:
        - raise value error.
    """
    from Ignite import fetch_incidents

    params: dict = {
        "fetch_type": "",
        "first_fetch": "2025-05-10T10:22:38Z",
        "is_fresh_compromised_credentials": "true",
        "password_min_length": "-1",
        "max_fetch": 1,
    }
    demisto_params = {**BASIC_PARAMS, "severity": "Medium"}
    mocker.patch.object(demisto, "params", return_value=demisto_params)

    with pytest.raises(ValueError) as error:
        fetch_incidents(client=mock_client, last_run={}, params=params)

    assert str(error.value) == MESSAGES["INVALID_PASSWORD_LENGTH"]


def test_vulnerability_get_command_success(mock_client, requests_mock):
    """
    Test case for successful execution of flashpoint-ignite-vulnerability-get command
    when it returns vulnerability details for given ID.

    Given:
       - mocked client
    When:
       - Calling `vulnerability_get_command` function
    Then:
       - Returns command results with vulnerability details and indicator results.
    """
    vulnerability_response = util_load_json("test_data/vulnerability_response.json")
    vulnerability_context = util_load_json("test_data/vulnerability_context.json")
    with open("test_data/hr_output_for_vulnerability.md") as file:
        hr_output_for_vulnerability = file.read()

    requests_mock.get(f"{MOCK_URL}{URL_SUFFIX['VULNERABILITY_GET']}/123456", json=vulnerability_response, status_code=200)
    args = {"id": "123456"}

    results = vulnerability_get_command(mock_client, args)

    # Verify we got multiple results (main result + indicator results)
    assert len(results) >= 1

    # First result should contain vulnerability outputs
    assert results[0].readable_output == hr_output_for_vulnerability
    assert results[0].outputs == vulnerability_context
    assert results[0].raw_response == vulnerability_response

    # Additional results should be indicator results for CVEs
    if len(results) > 1:
        for i in range(1, len(results)):
            assert results[i].indicator is not None
            assert "Created Indicator for" in results[i].readable_output  # type: ignore


@patch("demistomock.results")
def test_vulnerability_get_command_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of flashpoint-ignite-vulnerability-get command through main function
    when it returns empty response for given ID.

    Given:
       - mocked client
    When:
       - Calling `vulnerability_get_command` function with non-existent ID
    Then:
       - Returns no records found message.
    """

    requests_mock.get(f"{MOCK_URL}{URL_SUFFIX['VULNERABILITY_GET']}/999999", json={}, status_code=200)
    params = {**BASIC_PARAMS}
    args = {"id": "999999"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-vulnerability-get")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert mock_return.call_args.args[0].get("HumanReadable") == MESSAGES["NO_RECORDS_FOUND"].format("vulnerability")
    assert mock_return.call_args.args[0].get("EntryContext") == {}
    assert mock_return.call_args.args[0].get("Contents") == {}


def test_vulnerability_get_command_when_id_not_provided(mocker):
    """
    Test case for execution of flashpoint-ignite-vulnerability-get command through main function
    when vulnerability ID is not provided.

    Given:
       - mocked client
    When:
       - Calling `vulnerability_get_command` function without ID
    Then:
       - Raises error for missing required argument.
    """
    params = {**BASIC_PARAMS}
    args: dict = {}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-vulnerability-get")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("id") in return_error.call_args[0][0]


def test_vulnerability_get_command_when_blank_id_provided(mocker):
    """
    Test case for execution of flashpoint-ignite-vulnerability-get command through main function
    when vulnerability ID is blank.

    Given:
       - mocked client
    When:
       - Calling `vulnerability_get_command` function with blank ID
    Then:
       - Raises error for missing required argument.
    """
    params = {**BASIC_PARAMS}
    args = {"id": ""}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="flashpoint-ignite-vulnerability-get")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("id") in return_error.call_args[0][0]


def test_vulnerability_list_command_success(mock_client, requests_mock):
    """
    Test case scenario for successful execution of flashpoint-ignite-vulnerability-list command with filters.

    Given:
       - command arguments including severities, size, from, sort_by, sort_order
    When:
       - Calling `vulnerability_list_command` function
    Then:
       - Returns a valid output and verifies request parameters are sent correctly.
    """
    mock_response = util_load_json("test_data/vulnerability_list_response.json")

    hr_output = open("test_data/vulnerability_list_hr.md").read()
    expected_outputs = util_load_json("test_data/vulnerability_list_context.json")

    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIST"]}', json=mock_response, status_code=200)

    args = {
        "severities": "high,medium",
        "size": "2",
        "from": "0",
        "sort_by": "published at",
        "sort_order": "desc",
        "tags": "oss",
        "products": "dummy product",
        "vendors": "dummy vendor",
    }

    results = vulnerability_list_command(mock_client, args=args)

    assert results[0].outputs_prefix == OUTPUT_PREFIX["VULNERABILITY"]
    assert results[0].raw_response == mock_response
    assert results[0].readable_output == hr_output
    assert results[0].outputs == expected_outputs


@pytest.mark.parametrize(
    "vulnerability_ids, expected_ids",
    [
        ("463513,463512", "463513,463512"),
        ("FP-VULN-463513,FP-VULN-463512", "463513,463512"),
        ("FP-VULN-463513,463512", "463513,463512"),
    ],
)
def test_vulnerability_list_command_with_vulnerability_ids(mock_client, requests_mock, vulnerability_ids, expected_ids):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-list command with vulnerability_ids filter.

    Given:
       - command arguments with comma-separated vulnerability IDs, with and without the FP-VULN- prefix
    When:
       - Calling `vulnerability_list_command` function
    Then:
       - Sends the IDs as the 'ids' key of the request body with the FP-VULN- prefix stripped.
    """
    mock_response = util_load_json("test_data/vulnerability_list_response.json")

    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIST"]}', json=mock_response, status_code=200)

    vulnerability_list_command(mock_client, args={"vulnerability_ids": vulnerability_ids})

    assert requests_mock.last_request.json()["ids"] == expected_ids


def test_vulnerability_list_command_with_pagination(mock_client, requests_mock):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-list command with pagination hint.

    Given:
       - command arguments with size=2 and from=0, total=4 (next_index=2 < 4)
    When:
       - Calling `vulnerability_list_command` function
    Then:
       - Returns a valid output that includes a pagination hint in the human-readable output.
    """
    mock_response = util_load_json("test_data/vulnerability_list_response.json")

    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIST"]}', json=mock_response, status_code=200)

    results = vulnerability_list_command(mock_client, args={"size": "2", "from": "1"})

    assert len(results) == 1
    assert results[0].outputs_prefix == OUTPUT_PREFIX["VULNERABILITY"]
    assert "#### To retrieve the next set of result use," in results[0].readable_output
    assert "from = 3, size = 2" in results[0].readable_output


def test_vulnerability_list_command_when_empty_response(mock_client, requests_mock):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-list command when no results are returned.

    Given:
       - mocked client returning empty results
    When:
       - Calling `vulnerability_list_command` function
    Then:
       - Returns no records found message.
    """
    mock_response = {"total": 0, "results": []}

    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIST"]}', json=mock_response, status_code=200)

    results = vulnerability_list_command(mock_client, args={})

    assert len(results) == 1
    assert results[0].readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vulnerabilities")
    assert results[0].raw_response == mock_response


@pytest.mark.parametrize(
    "args, error_message",
    [
        (
            {"size": "0"},
            MESSAGES["INVALID_LIMIT_PROVIDED"].format("0", MAX_PAGE_SIZE),
        ),
        (
            {"size": "1001"},
            MESSAGES["INVALID_LIMIT_PROVIDED"].format("1001", MAX_PAGE_SIZE),
        ),
        (
            {"from": "-1"},
            MESSAGES["INVALID_FROM_PROVIDED"].format("-1"),
        ),
        (
            {"sort_by": "invalid_sort"},
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format("invalid_sort", "sort_by", VULNERABILITY_SORT_MAPPING.keys()),
        ),
        (
            {"sort_order": "invalid_order"},
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format("invalid_order", "sort_order", SORT_ORDER_VALUES),
        ),
        (
            {"severities": "invalid_severity"},
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                ["invalid_severity"], "Severity", ["Critical", "High", "Medium", "Low", "Informational"]
            ),
        ),
        (
            {"ransomware_scores": "invalid_score"},
            MESSAGES["INVALID_MULTI_PARAMS_PROVIDED"].format(
                ["invalid_score"], "Ransomware Scores", ["Critical", "High", "Medium", "Low"]
            ),
        ),
        (
            {"cwe_ids": "abc"},
            MESSAGES["INVALID_INT_PARAMS_PROVIDED"].format(["abc"], "CWE IDs"),
        ),
        (
            {"vulnerability_ids": "abc"},
            MESSAGES["INVALID_INT_PARAMS_PROVIDED"].format(["abc"], "Vulnerability IDs"),
        ),
        (
            {"vulnerability_ids": "463513,abc,FP-VULN-xyz"},
            MESSAGES["INVALID_INT_PARAMS_PROVIDED"].format(["abc", "xyz"], "Vulnerability IDs"),
        ),
        (
            {"updated_after": "2024-06-01T00:00:00Z", "updated_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "updated_after", "updated_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
        (
            {"disclosed_after": "2024-06-01T00:00:00Z", "disclosed_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "disclosed_after", "disclosed_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
        (
            {"published_after": "2024-06-01T00:00:00Z", "published_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "published_after", "published_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
        (
            {"last_touched_after": "2024-06-01T00:00:00Z", "last_touched_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "last_touched_after", "last_touched_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
        (
            {"min_cvssv3_score": "-1"},
            MESSAGES["INVALID_CVSS_SCORE"].format("Minimum CVSS v3 Score"),
        ),
        (
            {"max_cvssv3_score": "11"},
            MESSAGES["INVALID_CVSS_SCORE"].format("Maximum CVSS v3 Score"),
        ),
        (
            {"min_cvssv3_score": "5", "max_cvssv3_score": "3"},
            MESSAGES["INVALID_SCORE_RANGE"].format("Minimum CVSS v3 Score", "Maximum CVSS v3 Score"),
        ),
        (
            {"min_epss_score": "-0.1"},
            MESSAGES["INVALID_EPSS_SCORE"].format("Minimum EPSS Score"),
        ),
        (
            {"max_epss_score": "1.1"},
            MESSAGES["INVALID_EPSS_SCORE"].format("Maximum EPSS Score"),
        ),
        (
            {"min_epss_score": "0.8", "max_epss_score": "0.2"},
            MESSAGES["INVALID_SCORE_RANGE"].format("Minimum EPSS Score", "Maximum EPSS Score"),
        ),
    ],
)
def test_vulnerability_list_command_with_invalid_args(mock_client, args, error_message):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-list command with invalid arguments.

    Given:
       - Invalid command arguments for vulnerability_list_command
    When:
       - Calling `vulnerability_list_command` function
    Then:
       - Raises a DemistoException with the appropriate error message.
    """
    from CommonServerPython import DemistoException

    with pytest.raises(DemistoException) as error:
        vulnerability_list_command(mock_client, args=args)

    assert str(error.value) == error_message


def test_cve_command_success(mock_client, requests_mock):
    """
    Test case for successful execution of cve command through main function
    when it returns vulnerability details for given CVE.

    Given:
       - mocked client
    When:
       - Calling `cve_command` function with valid CVE
    Then:
       - Returns command results with vulnerability details.
    """
    vulnerability_response = util_load_json("test_data/vulnerability_response.json")
    cve_response = {"results": [vulnerability_response]}
    cve_context = util_load_json("test_data/cve_context.json")
    with open("test_data/hr_output_for_cve.md") as file:
        hr_output_for_cve = file.read()

    requests_mock.get(f"{MOCK_URL}{URL_SUFFIX['VULNERABILITY_GET']}", json=cve_response, status_code=200)
    args = {"cve": "CVE-2024-0001"}

    results = cve_command(mock_client, args)

    # Verify we got multiple results (main result + indicator results)
    assert len(results) >= 1

    # First result should contain vulnerability outputs
    assert results[0].readable_output == hr_output_for_cve
    assert results[0].outputs == cve_context
    assert results[0].raw_response == cve_response

    # Additional results should be indicator results for CVEs
    if len(results) > 1:
        for i in range(1, len(results)):
            assert results[i].indicator is not None
            assert "Created Indicator for" in results[i].readable_output  # type: ignore


@patch("demistomock.results")
def test_cve_command_when_empty_response(mock_return, requests_mock, mocker):
    """
    Test case for successful execution of cve command through main function
    when it returns empty response for given CVE.

    Given:
       - mocked client
    When:
       - Calling `cve_command` function with non-existent CVE
    Then:
       - Returns no records found message.
    """
    requests_mock.get(f"{MOCK_URL}{URL_SUFFIX['VULNERABILITY_GET']}", json={"results": []}, status_code=200)
    params = {**BASIC_PARAMS}
    args = {"cve": "CVE-9999-9999"}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="cve")
    mocker.patch.object(demisto, "args", return_value=args)

    main()

    assert mock_return.call_args.args[0].get("HumanReadable") == MESSAGES["NO_RECORDS_FOUND"].format("cve")


def test_cve_command_when_cve_not_provided(mocker):
    """
    Test case for execution of cve command through main function
    when CVE is not provided.

    Given:
       - mocked client
    When:
       - Calling `cve_command` function without CVE
    Then:
       - Raises error for missing required argument.
    """
    params = {**BASIC_PARAMS}
    args: dict = {}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="cve")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("cve") in return_error.call_args[0][0]


def test_cve_command_when_blank_cve_provided(mocker):
    """
    Test case for execution of cve command through main function
    when CVE is blank.

    Given:
       - mocked client
    When:
       - Calling `cve_command` function with blank CVE
    Then:
       - Raises error for missing required argument.
    """
    params = {**BASIC_PARAMS}
    args = {"cve": ""}
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "command", return_value="cve")
    mocker.patch.object(demisto, "args", return_value=args)

    return_error = mocker.patch.object(Ignite, "return_error")
    main()

    assert MESSAGES["MISSING_REQUIRED_ARGS"].format("cve") in return_error.call_args[0][0]


def test_cve_command_with_multiple_cves(mock_client, requests_mock):
    """
    Test case for successful execution of cve command through main function
    when multiple CVEs are provided.

    Given:
       - mocked client
    When:
       - Calling `cve_command` function with multiple CVEs
    Then:
       - Returns command results with vulnerability details for each CVE.
    """
    vulnerability_response = util_load_json("test_data/vulnerability_response.json")
    cve_response = {"results": [vulnerability_response]}
    cve_context = util_load_json("test_data/cve_context.json")
    with open("test_data/hr_output_for_cve.md") as file:
        hr_output_for_cve = file.read()

    requests_mock.get(f"{MOCK_URL}{URL_SUFFIX['VULNERABILITY_GET']}", json=cve_response, status_code=200)
    args = {"cve": "CVE-2024-0001,CVE-2024-0002"}

    results = cve_command(mock_client, args)

    # Verify we got multiple results (main result + indicator results)
    assert len(results) >= 1

    # First result should contain vulnerability outputs
    assert results[0].readable_output == hr_output_for_cve
    assert results[0].outputs == cve_context
    assert results[0].raw_response == cve_response

    # Additional results should be indicator results for CVEs
    if len(results) > 1:
        for i in range(1, len(results)):
            assert results[i].indicator is not None
            assert "Created Indicator for" in results[i].readable_output  # type: ignore


def test_cve_command_with_invalid_cve_format(mock_client, mocker):
    """
    Test case for execution of cve command when all provided CVEs have invalid format.

    Given:
    - An invalid CVE format (INVALID-CVE-FORMAT)

    When:
    - Running the !cve command

    Then:
    - Display warning message and exit when all CVEs are invalid
    """
    cve = {"cve": "INVALID-CVE-FORMAT"}

    # Mock return_warning to raise SystemExit when exit=True (simulating actual behavior)
    def mock_return_warning_side_effect(message, exit=False):
        if exit:
            raise SystemExit(0)

    mock_return_warning = mocker.patch("Ignite.return_warning", side_effect=mock_return_warning_side_effect)

    # Expect SystemExit to be raised when all CVEs are invalid
    with pytest.raises(SystemExit):
        cve_command(mock_client, args=cve)

    # Verify warning was called with correct message and exit=True
    mock_return_warning.assert_called_once_with("The following CVEs were found invalid: INVALID-CVE-FORMAT", exit=True)


def test_vulnerability_library_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-vulnerability-library-list command.

    Given:
       - command arguments for vulnerability_library_list_command
    When:
       - Calling `vulnerability_library_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import vulnerability_library_list_command

    response = util_load_json("test_data/vulnerability_libraries.json")

    with open("test_data/vulnerability_libraries_hr.md") as file:
        vulnerability_libraries_hr = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIBRARIES"].format("101010")}',
        json=response,
        status_code=200,
    )

    args = {
        "vulnerability_id": "101010",
        "size": "2",
        "sort_by": "Name",
        "sort_order": "asc",
        "from": "2",
        "library_name": "dummy_name",
    }
    actual_response = vulnerability_library_list_command(mock_client, args)

    assert actual_response.outputs_prefix == OUTPUT_PREFIX["VULNERABILITY_LIBRARY"]
    assert actual_response.outputs_key_field == "id"
    assert actual_response.raw_response == response
    assert len(actual_response.outputs) == 2
    assert actual_response.outputs[0]["id"] == 1010
    assert actual_response.outputs[1]["id"] == 101010
    assert actual_response.readable_output == vulnerability_libraries_hr


def test_vulnerability_library_list_command_empty_response(requests_mock, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-library-list command when empty response.

    Given:
       - command arguments for vulnerability_library_list_command
    When:
       - Calling `vulnerability_library_list_command` function
    Then:
       - Returns no records found message.
    """
    from Ignite import vulnerability_library_list_command

    response = {"total": 0, "next": None, "previous": None, "size": 25, "from": 0, "results": []}

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIBRARIES"].format("999999")}',
        json=response,
        status_code=200,
    )

    args = {"vulnerability_id": "999999"}
    actual_response = vulnerability_library_list_command(mock_client, args)

    assert actual_response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vulnerability libraries")


def test_vulnerability_library_list_command_with_pagination(requests_mock, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-library-list command with pagination.

    Given:
       - command arguments with from and size for vulnerability_library_list_command
    When:
       - Calling `vulnerability_library_list_command` function
    Then:
       - Returns a valid output with pagination hint.
    """
    from Ignite import PAGINATION_HR, vulnerability_library_list_command

    response = util_load_json("test_data/vulnerability_libraries.json")

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_LIBRARIES"].format("101010")}',
        json=response,
        status_code=200,
    )

    args = {"vulnerability_id": "101010", "from": "0", "size": "2"}
    actual_response = vulnerability_library_list_command(mock_client, args)

    assert f"{PAGINATION_HR} from = 4, size = 2" in actual_response.readable_output


@pytest.mark.parametrize(
    "args, error_msg",
    [
        (
            {"vulnerability_id": ""},
            MESSAGES["MISSING_REQUIRED_ARGS"].format("vulnerability_id"),
        ),
        (
            {"vulnerability_id": "101010", "size": "0"},
            MESSAGES["SIZE_ERROR"].format(0, MAX_PAGE_SIZE),
        ),
        (
            {"vulnerability_id": "101010", "size": "1001"},
            MESSAGES["SIZE_ERROR"].format(1001, MAX_PAGE_SIZE),
        ),
        (
            {"vulnerability_id": "101010", "sort_by": "invalid_sort"},
            MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("invalid_sort", "sort_by", LIBRARY_AND_PACKAGE_SORT_VALUES),
        ),
        (
            {"vulnerability_id": "101010", "sort_order": "invalid_order"},
            MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("invalid_order", "sort_order", SORT_ORDER_VALUES),
        ),
    ],
)
def test_vulnerability_library_list_command_invalid_args(mock_client, args, error_msg):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-library-list command when invalid argument provided.

    Given:
       - command arguments for vulnerability_library_list_command
    When:
       - Calling `vulnerability_library_list_command` function
    Then:
       - Returns a valid error message.
    """
    from Ignite import vulnerability_library_list_command

    with pytest.raises(ValueError) as error:
        vulnerability_library_list_command(mock_client, args)

    assert str(error.value) == error_msg


def test_vulnerability_package_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-vulnerability-package-list command.

    Given:
       - command arguments for vulnerability_package_list_command
    When:
       - Calling `vulnerability_package_list_command` function
    Then:
       - Returns a valid output.
    """
    from Ignite import vulnerability_package_list_command

    response = util_load_json("test_data/vulnerability_packages.json")

    with open("test_data/vulnerability_packages_hr.md") as file:
        vulnerability_packages_hr = file.read()

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_PACKAGES"].format("101010")}',
        json=response,
        status_code=200,
    )

    args = {
        "vulnerability_id": "101010",
        "size": "2",
        "sort_by": "Name",
        "sort_order": "asc",
        "from": "0",
        "package_name": "dummy_package_1",
    }
    actual_response = vulnerability_package_list_command(mock_client, args)

    assert actual_response.outputs_prefix == OUTPUT_PREFIX["VULNERABILITY_PACKAGE"]
    assert actual_response.outputs_key_field == "id"
    assert actual_response.raw_response == response
    assert len(actual_response.outputs) == 2
    assert actual_response.outputs[0]["id"] == 10000
    assert actual_response.outputs[1]["id"] == 10001
    assert actual_response.readable_output == vulnerability_packages_hr


def test_vulnerability_package_list_command_empty_response(requests_mock, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-package-list command when empty response.

    Given:
       - command arguments for vulnerability_package_list_command
    When:
       - Calling `vulnerability_package_list_command` function
    Then:
       - Returns no records found message.
    """
    from Ignite import vulnerability_package_list_command

    response = {"total": 0, "next": None, "previous": None, "size": 25, "from": 0, "results": []}

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_PACKAGES"].format("999999")}',
        json=response,
        status_code=200,
    )

    args = {"vulnerability_id": "999999"}
    actual_response = vulnerability_package_list_command(mock_client, args)

    assert actual_response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vulnerability packages")


def test_vulnerability_package_list_command_with_pagination(requests_mock, mock_client):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-package-list command with pagination.

    Given:
       - command arguments with from and size for vulnerability_package_list_command
    When:
       - Calling `vulnerability_package_list_command` function
    Then:
       - Returns a valid output with pagination hint.
    """
    from Ignite import PAGINATION_HR, vulnerability_package_list_command

    response = util_load_json("test_data/vulnerability_packages.json")

    requests_mock.get(
        f'{MOCK_URL}{URL_SUFFIX["VULNERABILITY_PACKAGES"].format("101010")}',
        json=response,
        status_code=200,
    )

    args = {"vulnerability_id": "101010", "from": "0", "size": "2"}
    actual_response = vulnerability_package_list_command(mock_client, args)

    assert f"{PAGINATION_HR} from = 2, size = 2" in actual_response.readable_output


@pytest.mark.parametrize(
    "args, error_msg",
    [
        (
            {"vulnerability_id": ""},
            MESSAGES["MISSING_REQUIRED_ARGS"].format("vulnerability_id"),
        ),
        (
            {"vulnerability_id": "101010", "size": "0"},
            MESSAGES["SIZE_ERROR"].format(0, MAX_PAGE_SIZE),
        ),
        (
            {"vulnerability_id": "101010", "size": "1001"},
            MESSAGES["SIZE_ERROR"].format(1001, MAX_PAGE_SIZE),
        ),
        (
            {"vulnerability_id": "101010", "sort_by": "invalid_sort"},
            MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("invalid_sort", "sort_by", LIBRARY_AND_PACKAGE_SORT_VALUES),
        ),
        (
            {"vulnerability_id": "101010", "sort_order": "invalid_order"},
            MESSAGES["INVALID_SINGLE_SELECT_PARAM"].format("invalid_order", "sort_order", SORT_ORDER_VALUES),
        ),
    ],
)
def test_vulnerability_package_list_command_invalid_args(mock_client, args, error_msg):
    """
    Test case scenario for execution of flashpoint-ignite-vulnerability-package-list command when invalid argument provided.

    Given:
       - command arguments for vulnerability_package_list_command
    When:
       - Calling `vulnerability_package_list_command` function
    Then:
       - Returns a valid error message.
    """
    from Ignite import vulnerability_package_list_command

    with pytest.raises(ValueError) as error:
        vulnerability_package_list_command(mock_client, args)

    assert str(error.value) == error_msg


def test_vendor_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-vendor-list command.

    Given:
       - command arguments with size=2 and from=0, total=5 (pagination expected)
    When:
       - Calling `vendor_list_command` function
    Then:
       - Returns valid output with vendors and pagination HR.
    """
    vendors = util_load_json("test_data/vendor_list_success.json")
    with open("test_data/vendor_list_success_hr.md") as file:
        expected_hr = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["VENDORS"]}', json=vendors, status_code=200)

    args = {"size": "2", "from": "0"}
    actual_response = vendor_list_command(mock_client, args)

    assert len(actual_response) == 1
    assert actual_response[0].outputs_prefix == OUTPUT_PREFIX["VENDOR"]
    assert actual_response[0].outputs_key_field == "id"
    assert actual_response[0].readable_output == expected_hr
    assert actual_response[0].outputs == vendors["results"]
    assert actual_response[0].raw_response == vendors


def test_vendor_list_command_empty_response(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-vendor-list command
    when no vendors are returned.

    Given:
       - command arguments for vendor_list_command
    When:
       - Calling `vendor_list_command` function and API returns empty results
    Then:
       - Returns no records found message.
    """
    result = {"total": "0", "next": "null", "previous": "null", "size": "25", "from": "0", "results": []}
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["VENDORS"]}', json=result, status_code=200)

    actual_response = vendor_list_command(mock_client, {})

    assert len(actual_response) == 1
    assert actual_response[0].readable_output == "No vendors were found for the given argument(s)."


@pytest.mark.parametrize(
    "args, error_msg",
    [
        ({"size": "0"}, MESSAGES["SIZE_ERROR"].format("0", MAX_PAGE_SIZE)),
        ({"size": "1001"}, MESSAGES["SIZE_ERROR"].format("1001", MAX_PAGE_SIZE)),
        ({"from": "-1"}, MESSAGES["INVALID_FROM_PROVIDED"].format(-1)),
        (
            {"updated_after": "2024-06-01T00:00:00Z", "updated_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "updated_after", "updated_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
    ],
)
def test_vendor_list_command_invalid_args(mock_client, args, error_msg):
    """
    Test case scenario for flashpoint-ignite-vendor-list command when invalid arguments are provided.

    Given:
       - Invalid command arguments
    When:
       - Calling `vendor_list_command` function
    Then:
       - Raises ValueError with appropriate error message.
    """
    with pytest.raises(ValueError, match=re.escape(error_msg)):
        vendor_list_command(mock_client, args)


def test_vendor_list_command_with_invalid_vendor_ids(requests_mock, mock_client, mocker):
    """
    Test case scenario for flashpoint-ignite-vendor-list command when non-integer vendor_ids are provided.

    Given:
       - command arguments with a mix of valid and non-integer vendor_ids
    When:
       - Calling `vendor_list_command` function
    Then:
       - A warning is issued for invalid IDs and the command still returns results.
    """
    vendors = util_load_json("test_data/vendor_list_success.json")
    return_warning_mock = mocker.patch.object(Ignite, "return_warning")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["VENDORS"]}', json=vendors, status_code=200)

    args = {"vendor_ids": "1001,abc,1002"}
    actual_response = vendor_list_command(mock_client, args)

    assert return_warning_mock.called
    warning_msg = return_warning_mock.call_args[0][0]
    assert "abc" in warning_msg
    assert len(actual_response) == 1


def test_product_list_command_success(requests_mock, mock_client):
    """
    Test case scenario for successful execution of flashpoint-ignite-product-list command.

    Given:
       - command arguments with size=2 and from=0, total=5 (pagination expected)
    When:
       - Calling `product_list_command` function
    Then:
       - Returns valid output with products and pagination HR.
    """
    products = util_load_json("test_data/product_list_success.json")
    with open("test_data/product_list_success_hr.md") as file:
        expected_hr = file.read()

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["PRODUCTS"]}', json=products, status_code=200)

    args = {"size": "2", "from": "0"}
    actual_response = product_list_command(mock_client, args)

    assert len(actual_response) == 1
    assert actual_response[0].outputs_prefix == OUTPUT_PREFIX["PRODUCT"]
    assert actual_response[0].outputs_key_field == "id"
    assert actual_response[0].readable_output == expected_hr
    assert actual_response[0].outputs == products["results"]
    assert actual_response[0].raw_response == products


def test_product_list_command_empty_response(requests_mock, mock_client):
    """
    Test case scenario for flashpoint-ignite-product-list command when no results are returned.

    Given:
       - mocked client returning empty results
    When:
       - Calling `product_list_command` function
    Then:
       - Returns no records found message.
    """
    result = {"total": 0, "next": None, "previous": None, "size": 10, "from": 0, "results": []}
    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["PRODUCTS"]}', json=result, status_code=200)

    actual_response = product_list_command(mock_client, {})

    assert len(actual_response) == 1
    assert actual_response[0].readable_output == MESSAGES["NO_RECORDS_FOUND"].format("products")


@pytest.mark.parametrize(
    "args, error_msg",
    [
        ({"size": "0"}, MESSAGES["SIZE_ERROR"].format("0", MAX_PAGE_SIZE)),
        ({"size": "1001"}, MESSAGES["SIZE_ERROR"].format("1001", MAX_PAGE_SIZE)),
        ({"from": "-1"}, MESSAGES["INVALID_FROM_PROVIDED"].format(-1)),
        (
            {"updated_after": "2024-06-01T00:00:00Z", "updated_before": "2024-05-01T00:00:00Z"},
            MESSAGES["INVALID_TIME_INTERVAL"].format(
                "updated_after", "updated_before", "2024-06-01T00:00:00Z", "2024-05-01T00:00:00Z"
            ),
        ),
    ],
)
def test_product_list_command_invalid_args(mock_client, args, error_msg):
    """
    Test case scenario for flashpoint-ignite-product-list command when invalid arguments are provided.

    Given:
       - Invalid command arguments
    When:
       - Calling `product_list_command` function
    Then:
       - Raises ValueError with appropriate error message.
    """
    with pytest.raises(ValueError, match=re.escape(error_msg)):
        product_list_command(mock_client, args)


@pytest.mark.parametrize(
    "args, invalid_id",
    [
        ({"product_ids": "10001,invalid_id,10002"}, "invalid_id"),
        ({"vendor_ids": "1,bad_id"}, "bad_id"),
    ],
)
def test_product_list_command_with_invalid_ids(requests_mock, mock_client, mocker, args, invalid_id):
    """
    Test case scenario for flashpoint-ignite-product-list command when non-integer IDs are provided.

    Given:
       - command arguments with a mix of valid and non-integer product_ids or vendor_ids
    When:
       - Calling `product_list_command` function
    Then:
       - A warning is issued for invalid IDs and the command still returns results.
    """
    products = util_load_json("test_data/product_list_success.json")
    return_warning_mock = mocker.patch.object(Ignite, "return_warning")

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["PRODUCTS"]}', json=products, status_code=200)

    actual_response = product_list_command(mock_client, args)

    assert return_warning_mock.called
    warning_msg = return_warning_mock.call_args[0][0]
    assert invalid_id in warning_msg
    assert len(actual_response) == 1


def test_community_search_relationships_truncated_when_over_limit(mock_client):
    """
    Test that relationships are capped at DEFAULT_REPUTATION_CONTEXT_LIMIT.

    Given:
        - A community search indicator with url_domains list longer than the limit.
    When:
        - Calling `create_relationships_list_for_community_search`.
    Then:
        - Relationships are capped at DEFAULT_REPUTATION_CONTEXT_LIMIT.
    """
    oversized_domains = [f"domain{i}.com" for i in range(DEFAULT_REPUTATION_CONTEXT_LIMIT + 10)]
    indicator = {"enrichments": {"url_domains": oversized_domains}}
    relationships = create_relationships_list_for_community_search(mock_client, indicator, "1.2.3.4")
    assert len(relationships) == DEFAULT_REPUTATION_CONTEXT_LIMIT


def test_community_search_relationships_not_truncated_when_within_limit(mock_client):
    """
    Test that enrichment lists within the limit produce all relationships.

    Given:
        - A community search indicator with url_domains list shorter than the limit.
    When:
        - Calling `create_relationships_list_for_community_search`.
    Then:
        - All entries produce relationships.
    """
    indicator = {"enrichments": {"url_domains": ["example.com", "test.com"]}}
    relationships = create_relationships_list_for_community_search(mock_client, indicator, "9.9.9.9")
    assert len(relationships) == 2


def test_ip_lookup_enrichments_truncated_to_param_limit(requests_mock, mocker):
    """
    Test that community-search enrichment lists are truncated to the configured
    `reputation_enrichments_limit` parameter value, not the hardcoded constant.

    Given:
        - A client with reputation_enrichments_limit set to 3.
        - A community search response containing an enrichment list with 10 entries.
    When:
        - Calling `ip_lookup_command`.
    Then:
        - The outputs stored in context contain at most 3 enrichment entries per list.
    """
    custom_limit = 3
    client = Client(MOCK_URL, {}, False, None, False, reputation_enrichments_limit=custom_limit)

    empty_ioc_response = {"items": []}
    oversized_enrichments = [f"domain{i}.com" for i in range(10)]
    community_response = {
        "items": [
            {
                "id": "test-id",
                "date": "2024-01-01T00:00:00Z",
                "first_observed_at": "2024-01-01T00:00:00Z",
                "last_observed_at": "2024-01-01T00:00:00Z",
                "author": "test-author",
                "title": "test-title",
                "site": "test-site",
                "enrichments": {
                    "url_domains": oversized_enrichments,
                },
            }
        ]
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=empty_ioc_response, status_code=200)
    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}', json=community_response, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    mocker.patch.object(demisto, "params", return_value={**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"})

    result = ip_lookup_command(client, "1.2.3.4")

    outputs = result.outputs  # type: ignore[union-attr]
    assert isinstance(outputs, list)
    stored_domains = outputs[0].get("enrichments", {}).get("url_domains", [])
    assert len(stored_domains) == custom_limit


def test_ip_lookup_enrichments_not_truncated_when_within_param_limit(requests_mock, mocker):
    """
    Test that enrichment lists within the configured limit are stored in full.

    Given:
        - A client with reputation_enrichments_limit set to 10.
        - A community search response containing an enrichment list with 3 entries.
    When:
        - Calling `ip_lookup_command`.
    Then:
        - All 3 enrichment entries are preserved in the outputs.
    """
    custom_limit = 10
    client = Client(MOCK_URL, {}, False, None, False, reputation_enrichments_limit=custom_limit)

    empty_ioc_response = {"items": []}
    small_enrichments = ["a.com", "b.com", "c.com"]
    community_response = {
        "items": [
            {
                "id": "test-id",
                "date": "2024-01-01T00:00:00Z",
                "first_observed_at": "2024-01-01T00:00:00Z",
                "last_observed_at": "2024-01-01T00:00:00Z",
                "author": "test-author",
                "title": "test-title",
                "site": "test-site",
                "enrichments": {
                    "url_domains": small_enrichments,
                },
            }
        ]
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=empty_ioc_response, status_code=200)
    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}', json=community_response, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    mocker.patch.object(demisto, "params", return_value={**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"})

    result = ip_lookup_command(client, "1.2.3.4")

    outputs = result.outputs  # type: ignore[union-attr]
    assert isinstance(outputs, list)
    stored_domains = outputs[0].get("enrichments", {}).get("url_domains", [])
    assert len(stored_domains) == len(small_enrichments)


def test_client_default_reputation_enrichments_limit():
    """
    Test that Client uses DEFAULT_REPUTATION_CONTEXT_LIMIT as the default when
    reputation_enrichments_limit is not provided.

    Given:
        - A Client instantiated without the reputation_enrichments_limit argument.
    When:
        - Accessing client.reputation_enrichments_limit.
    Then:
        - The value equals DEFAULT_REPUTATION_CONTEXT_LIMIT.
    """
    client = Client(MOCK_URL, {}, False, None, False)
    assert client.reputation_enrichments_limit == DEFAULT_REPUTATION_CONTEXT_LIMIT


def test_truncate_message_keeps_short_message_unchanged():
    """
    Test that a message shorter than DEFAULT_MESSAGE_MAX_LENGTH is returned unchanged.

    Given:
        - A short message.
    When:
        - Calling `truncate_message`.
    Then:
        - The message is returned unmodified, with no truncation suffix appended.
    """
    message = "This IP was seen scanning. It was reported once."
    assert truncate_message(message) == message


def test_truncate_message_cuts_at_max_length():
    """
    Test that a message longer than DEFAULT_MESSAGE_MAX_LENGTH is cut to that many characters.

    Given:
        - A message longer than DEFAULT_MESSAGE_MAX_LENGTH characters.
    When:
        - Calling `truncate_message`.
    Then:
        - The result contains at most DEFAULT_MESSAGE_MAX_LENGTH characters of original content,
          followed by the truncation suffix.
    """
    message = "a" * (DEFAULT_MESSAGE_MAX_LENGTH + 1000)

    result = truncate_message(message)

    assert result == message[:DEFAULT_MESSAGE_MAX_LENGTH] + MESSAGE_TRUNCATION_SUFFIX


def test_truncate_message_handles_empty_and_non_string_input():
    """
    Test that `truncate_message` safely handles falsy or non-string inputs.

    Given:
        - Empty string, None.
    When:
        - Calling `truncate_message`.
    Then:
        - The input is returned unchanged.
    """
    assert truncate_message("") == ""
    assert truncate_message(None) is None


def test_ip_lookup_community_search_truncates_large_message(requests_mock, mocker):
    """
    Test that the community-search branch of `ip_lookup_command` truncates an oversized
    "message" field down to DEFAULT_MESSAGE_MAX_LENGTH characters in the context output.

    Given:
        - A community search response where one indicator's "message" field contains
          thousands of characters of raw paste content.
    When:
        - Calling `ip_lookup_command`.
    Then:
        - The "message" field stored in the outputs is reduced to at most
          DEFAULT_MESSAGE_MAX_LENGTH characters, not the full original content.
    """
    client = Client(MOCK_URL, {}, False, None, False)

    empty_ioc_response = {"items": []}
    long_message = " ".join(f"This is sentence number {i} describing observed IOC data." for i in range(200))
    community_response = {
        "items": [
            {
                "id": "test-id",
                "date": "2024-01-01T00:00:00Z",
                "first_observed_at": "2024-01-01T00:00:00Z",
                "last_observed_at": "2024-01-01T00:00:00Z",
                "author": "test-author",
                "title": "test-title",
                "site": "test-site",
                "message": long_message,
                "enrichments": {},
            }
        ]
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=empty_ioc_response, status_code=200)
    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}', json=community_response, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    mocker.patch.object(demisto, "params", return_value={**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"})

    result = ip_lookup_command(client, "1.2.3.4")

    outputs = result.outputs  # type: ignore[union-attr]
    assert isinstance(outputs, list)
    stored_message = outputs[0].get("message", "")

    assert len(stored_message) < len(long_message)
    assert stored_message.endswith(MESSAGE_TRUNCATION_SUFFIX)


def test_ip_lookup_community_search_keeps_short_message_unchanged(requests_mock, mocker):
    """
    Test that a short "message" field is preserved as-is in the community-search branch
    of `ip_lookup_command`.

    Given:
        - A community search response where the indicator's "message" field is short
          (fewer characters than DEFAULT_MESSAGE_MAX_LENGTH).
    When:
        - Calling `ip_lookup_command`.
    Then:
        - The "message" field stored in the outputs is unchanged.
    """
    client = Client(MOCK_URL, {}, False, None, False)

    empty_ioc_response = {"items": []}
    short_message = "This is a short message."
    community_response = {
        "items": [
            {
                "id": "test-id",
                "date": "2024-01-01T00:00:00Z",
                "first_observed_at": "2024-01-01T00:00:00Z",
                "last_observed_at": "2024-01-01T00:00:00Z",
                "author": "test-author",
                "title": "test-title",
                "site": "test-site",
                "message": short_message,
                "enrichments": {},
            }
        ]
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=empty_ioc_response, status_code=200)
    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}', json=community_response, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    mocker.patch.object(demisto, "params", return_value={**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"})

    result = ip_lookup_command(client, "1.2.3.4")

    outputs = result.outputs  # type: ignore[union-attr]
    assert isinstance(outputs, list)
    assert outputs[0].get("message") == short_message


def test_client_default_message_max_length():
    """
    Test that Client uses DEFAULT_MESSAGE_MAX_LENGTH as the default when message_max_length is not provided.

    Given:
        - A Client instantiated without the message_max_length argument.
    When:
        - Accessing client.message_max_length.
    Then:
        - The value equals DEFAULT_MESSAGE_MAX_LENGTH.
    """
    client = Client(MOCK_URL, {}, False, None, False)
    assert client.message_max_length == DEFAULT_MESSAGE_MAX_LENGTH


def test_ip_lookup_community_search_message_truncated_to_client_param_limit(requests_mock, mocker):
    """
    Test that the community-search branch of `ip_lookup_command` truncates the "message" field
    using the configured `client.message_max_length` value, not the hardcoded constant.

    Given:
        - A client with message_max_length set to a small custom value.
        - A community search response containing a "message" field longer than that value.
    When:
        - Calling `ip_lookup_command`.
    Then:
        - The "message" field stored in the outputs is truncated to the custom limit.
    """
    custom_limit = 20
    client = Client(MOCK_URL, {}, False, None, False, message_max_length=custom_limit)

    empty_ioc_response = {"items": []}
    long_message = "a" * 100
    community_response = {
        "items": [
            {
                "id": "test-id",
                "date": "2024-01-01T00:00:00Z",
                "first_observed_at": "2024-01-01T00:00:00Z",
                "last_observed_at": "2024-01-01T00:00:00Z",
                "author": "test-author",
                "title": "test-title",
                "site": "test-site",
                "message": long_message,
                "enrichments": {},
            }
        ]
    }

    requests_mock.get(f'{MOCK_URL}{URL_SUFFIX["LIST_INDICATORS"]}', json=empty_ioc_response, status_code=200)
    requests_mock.post(f'{MOCK_URL}{URL_SUFFIX["COMMUNITY_SEARCH"]}', json=community_response, status_code=200)
    mocker.patch("Ignite.is_ip_address_internal", return_value=False)
    mocker.patch.object(demisto, "params", return_value={**BASIC_PARAMS, "integrationReliability": "B - Usually reliable"})

    result = ip_lookup_command(client, "1.2.3.4")

    outputs = result.outputs  # type: ignore[union-attr]
    assert isinstance(outputs, list)
    stored_message = outputs[0].get("message", "")

    assert stored_message == long_message[:custom_limit] + MESSAGE_TRUNCATION_SUFFIX


@pytest.mark.parametrize(
    "source, resource_id, expected_url",
    [
        ("reports", "abc123", MOCK_URL + "/cti/intelligence/report/abc123"),
        ("communities", "cid", MOCK_URL + "/search/context/communities/cid"),
        ("marketplaces", "mid", MOCK_URL + "/search/context/marketplaces/mid"),
        ("media", "mediaid", MOCK_URL + "/search/results/media?include.date=all+time&include.media_id=mediaid"),
        ("unknown_source", "xyz", MOCK_URL),
    ],
)
def test_get_resource_url_based_on_source(source, resource_id, expected_url):
    """
    Test that get_resource_url builds the correct deep link for each source type,
    including the new "reports" source and an unmapped source that falls back to an empty suffix.

    Given:
        - A source type, resource ID and platform URL.
    When:
        - Calling get_resource_url.
    Then:
        - The generated URL matches the expected deep link for the source type.
    """
    assert get_resource_url(source, resource_id, MOCK_URL) == expected_url


def test_prepare_incidents_from_alerts_data_vulnerabilities_uses_ignite_search_url(mocker):
    """
    Test that for a "vulnerabilities" source alert, the resource URL is taken from
    the resource's "ignite_search_url" field.

    Given:
        - An alerts response containing an alert with source "vulnerabilities".
    When:
        - Calling prepare_incidents_from_alerts_data.
    Then:
        - The alert's resource "url" is set to the "ignite_search_url" value.
    """
    mocker.patch.object(demisto, "params", return_value={"severity": DEFAULT_SEVERITY})

    ignite_search_url = MOCK_URL + "/vulns/search?query=abc"
    response = {
        "items": [
            {
                "id": "alert-1",
                "source": "Vulnerabilities",
                "reason": {"name": "CVE detected", "origin": "searches"},
                "resource": {"id": "res-1", "ignite_search_url": ignite_search_url},
                "generated_at": CURRENT_TIME_STRING,
            }
        ]
    }

    next_run, incidents = prepare_incidents_from_alerts_data(
        response=response, last_run={}, fetch_params={"created_before": CURRENT_TIME_STRING}, platform_url=MOCK_URL
    )

    assert len(incidents) == 1
    raw = json.loads(incidents[0]["rawJSON"])
    assert raw["resource"]["url"] == ignite_search_url
    assert next_run["alert_ids"] == ["alert-1"]


def test_prepare_incidents_from_alerts_data_non_vulnerabilities_keeps_resource_url(mocker):
    """
    Test that for a non-vulnerabilities source alert, the existing resource URL is preserved.

    Given:
        - An alerts response with an alert whose resource already has a "url".
    When:
        - Calling prepare_incidents_from_alerts_data.
    Then:
        - The alert's resource "url" is unchanged and ignite_search_url is not used.
    """
    mocker.patch.object(demisto, "params", return_value={"severity": DEFAULT_SEVERITY})

    existing_url = MOCK_URL + "/search/context/communities/res-1"
    response = {
        "items": [
            {
                "id": "alert-2",
                "source": "communities",
                "reason": {"name": "Community hit", "origin": "searches"},
                "resource": {"id": "res-1", "url": existing_url, "ignite_search_url": MOCK_URL + "/should-not-use"},
                "generated_at": CURRENT_TIME_STRING,
            }
        ]
    }

    _, incidents = prepare_incidents_from_alerts_data(
        response=response, last_run={}, fetch_params={"created_before": CURRENT_TIME_STRING}, platform_url=MOCK_URL
    )

    raw = json.loads(incidents[0]["rawJSON"])
    assert raw["resource"]["url"] == existing_url