MxToolBox

Details

ID	`MxToolBox`
Provider	ZiffDavis
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

mxtoolbox

Run any supported command on the mxtoolbox API

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

mxtoolbox

Input

Argument Name	Description	Required
command	The command you want to execute. Possible values are: mx, a, dns, spf, txt, soa, ptr, blacklist, smtp, tcp, http, https, ping, trace.	Required
data	The data to query.	Required
additionalParams	Any additional query parameters you want to add.	Optional

Context Output

Path	Type	Description
MXToolbox.Passed	unknown	Successful results
MXToolbox.Failed	unknown	Query failures
MXToolbox.Errors	unknown	Query errors
MXToolbox.Warnings	unknown	Warning for query
MXToolbox.Information	unknown	Additional information regarding the query
MXToolbox.MultiInformation	unknown	Additional multi-information
MXToolbox.Transcript	unknown	Query transcript

Configuration parameters

apiKey — API Key
credentials_api_key —
useproxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (1)

mxtoolbox
Run any supported command on the mxtoolbox API

Source

MxToolBox.js MxToolBox.yml MxToolBox_description.md

Download History Raw

var doReq = function(cmd, data, p) {
    var url = 'https://api.mxtoolbox.com/api/v1/lookup/' + cmd + '/' + data;
    var apiKey = (params.credentials_api_key !== undefined)? params.credentials_api_key.password : params.apiKey;
    if (!apiKey){
        throw ('API key must be provided.');
    }
    if (p) {
        url += '?' + p;
    }
    var result = http(
        url,
        {
            Headers: {'Accept': ['application/json'], 'Authorization': [apiKey]},
            Method: 'GET'
        },
        params.insecure,
        params.useproxy
    );

    if (result.StatusCode < 200 || result.StatusCode > 299) {
        throw 'Failed to perform command "' + cmd + '", request status code: ' + result.StatusCode +
            ' body is: ' + result.Body;
    }
    if (result.Body === '') {
        throw 'No content received for command "' + cmd + '", request status code: ' + result.StatusCode;
    }
    var obj;
    try {
        obj = JSON.parse(result.Body);
    } catch (ex) {
        throw 'Error parsing reply - ' + result.Body + ' - ' + ex;
    }
    return {body: result.Body, obj: obj, statusCode: result.StatusCode};
};

switch (command) {
    case 'test-module':
        doReq('mx', 'example.com');
        return 'ok';
    case 'mxtoolbox':
        var res = doReq(args.command, args.data, args.additionalParams);
        var ec = {};
        var md = 'MxToolbox command - **' + args.command + '**\n';
        var arrays = ['Passed', 'Failed', 'Errors', 'Warnings', 'Information', 'MultiInformation', 'Transcript'];
        for (var i=0; i<arrays.length; i++) {
            if (res.obj[arrays[i]] && res.obj[arrays[i]].length > 0) {
                md += tableToMarkdown(arrays[i], res.obj[arrays[i]]) + '\n';
                ec['MXToolbox.' + arrays[i]] = res.obj[arrays[i]];
            }
            delete res.obj[arrays[i]];
        }
        delete res.obj.RelatedLookups;
        md += tableToMarkdown('Result Data', res.obj);
        ec['MXToolbox.Data'] = res.obj;
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    default:
        throw 'Unknown command ' + command + ' requested';
}