Majestic Million

Free search and download of the top million websites.

Data Enrichment & Threat Intelligence · Majestic Million Feed · Feed

Details

IDMajestic Million
ProviderMajestic-12 Limited
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Majestic Million

Troubleshooting

Ingesting a million indicators may cause performance issues.
The default value is 100k. If you encounter performance issues, consider decreasing the limit.

Configure Majestic Million in Cortex

Parameter Description Required
feed Fetch indicators False
feedReputation Indicator Reputation False
feedReliability Source Reliability True
limit Number of top domains to fetch from the feed. False
tlp_color Traffic Light Protocol Color False
feedExpirationPolicy   False
feedExpirationInterval   False
feedFetchInterval Feed Fetch Interval False
feedBypassExclusionList Bypass exclusion list False
feedTags Tags False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
use_https Use HTTPS connection False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

majesticmillion-get-indicators

Gets the feed indicators.

Base Command

majesticmillion-get-indicators

Input

Argument Name Description Required
limit The maximum number of results to return. Default is 50. Optional

Context Output

There is no context output for this command.

Command Example

!majesticmillion-get-indicators limit=4

Context Example

{}

Human Readable Output

Indicators

value type fields
facebook.com Domain domainname: facebook.com
domainreferringsubnets: 500065
domainreferringips: 2959982
idndomain: facebook.com
tags:
google.com Domain domainname: google.com
domainreferringsubnets: 496082
domainreferringips: 2743820
idndomain: google.com
tags:
youtube.com Domain domainname: youtube.com
domainreferringsubnets: 451680
domainreferringips: 2401931
idndomain: youtube.com
tags:
twitter.com Domain domainname: twitter.com
domainreferringsubnets: 443003
domainreferringips: 2369579
idndomain: twitter.com
tags:

Configuration parameters

  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • limit — Number of top domains to fetch from the feed.
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • use_https — Use HTTPS connection

Commands (1)

  • majesticmillion-get-indicators

    Gets the feed indicators.

Source

MajesticMillion.py MajesticMillion.yml MajesticMillion_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Majestic-12 Limited
commonfields:
  id: Majestic Million
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  defaultvalue: Good
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- defaultvalue: 100000
  additionalinfo: Can be any number between 1 and 1000000.
  display: Number of top domains to fetch from the feed.
  name: limit
  type: 0
  required: false
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- defaultvalue: suddenDeath
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '1440'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Use HTTPS connection
  name: use_https
  type: 8
  required: false
description: Free search and download of the top million websites.
display: Majestic Million Feed
name: Majestic Million
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of results to return. Default is 50.
      name: limit
    description: Gets the feed indicators.
    name: majesticmillion-get-indicators
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- Majestic Million Test Playbook