Netcraft Deprecated

Deprecated. Use Netcraft_V2 (Display name: Netcraft) instead.

Network Security · Netcraft (Deprecated)

Details

IDNetcraft
ProviderNetcraft
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.10.8.37753
Supported ModulesAgentix

README

An integration for Netcraft, allowing you to open and handle takedown requests.

Configure Netcraft in Cortex

Parameter Required
Credentials True
Password True
The maximum number of entries (takedowns/notes) to return. Default is 100. False
Use system proxy settings False
Trust any certificate (not secure) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

netcraft-report-attack

Reports an attack to Netcraft.

Base Command

netcraft-report-attack

Input

Argument Name Description Required
attack The attack location you want taken down. For example, a phishing URL or fraudulent email address. Required
comment The reason for submitting the attack, such as a description of the attack. Required

Context Output

Path Type Description
Netcraft.Takedown.DateSubmitted String The date and time of reporting.
Netcraft.Takedown.LastUpdated String The date and time of the last action taken on the takedown.
Netcraft.Takedown.EvidenceURL String The URL of the evidence page on incident.netcraft.com.
Netcraft.Takedown.Reporter String The person/account that submitted the takedown.
Netcraft.Takedown.Domain String The domain of the URL or email address being taken down. This will be blank for attacks without a domain name.
Netcraft.Takedown.Hostname String The full hostname of the URL or email address being taken down. This will be blank for attacks without a hostname.
Netcraft.Takedown.CountryCode String ISO country code of the hosting country.
Netcraft.Takedown.DomainAttack String Whether the domain is thought to be fraudulent.
Netcraft.Takedown.TargetedURL String The URL that this attack is masquarading as. For example, the URL of the legitimate login form that the attack targets.
Netcraft.Takedown.Certificate Unknown HTTPS certificate details for the hostname, or null if no certificate was found. The value returned is the output of PHP’s openssl_x509_parse function.
Netcraft.Takedown.ID Number The ID of the takedown.
Netcraft.Takedown.GroupID Number The group ID of the takedown, can potentially be the same as ID, or empty if there is no group.
Netcraft.Takedown.Status String The status of the takedown.
Netcraft.Takedown.AttackType String The type of takedown.
Netcraft.Takedown.AttackURL String The location of the attack being taken down.
Netcraft.Takedown.Region String The customer area in which the attack resides.
Netcraft.Takedown.IP String The IPv4 address of the attack.

netcraft-get-takedown-info

Returns information on existing takedowns. You can retrieve the takedown ID when you report the malicious URL and open the takedown, using the netcraft-report-attack command.

Base Command

netcraft-get-takedown-info

Input

Argument Name Description Required
id The ID of the takedowns for which to get information. Optional
date_from Retrieve information for takedowns submitted after this date. Format: YYYY-MM-DD HH:MM:SS. Optional
updated_since Retrieve information for takedowns updated after this date. Format: YYYY-MM-DD HH:MM:SS. Optional
url The URL by which to filter. Optional
ip The IP by which to filter. Optional
region The region by which to filter. If the region is invalid or not specified, all regions are returned. Optional

Context Output

Path Type Description
Netcraft.Takedown.ID number The ID of the takedown.
Netcraft.Takedown.GroupID number The group ID of the takedown, can potentially be the same as ID or empty if there is no group.
Netcraft.Takedown.Status string The status of the takedown.
Netcraft.Takedown.AttackType string The type of takedown.
Netcraft.Takedown.AttackURL string The location of the attack being taken down.
Netcraft.Takedown.Region string The customer area in which the attack resides.
Netcraft.Takedown.DateSubmitted string The date and time of reporting.
Netcraft.Takedown.LastUpdated string The date and time of the last action taken on the takedown.
Netcraft.Takedown.EvidenceURL string The URL of the evidence page on incident.netcraft.com.
Netcraft.Takedown.Reporter string The person/account that submitted the takedown.
Netcraft.Takedown.IP Unknown The IPv4 address of the attack.
Netcraft.Takedown.Domain Unknown The domain of the URL or email address being taken down. This will be blank for attacks without a domain name.
Netcraft.Takedown.Hostname Unknown The full hostname of the URL or email address being taken down. This will be blank for attacks without a hostname.
Netcraft.Takedown.CountryCode Unknown ISO country code of the hosting country.
Netcraft.Takedown.DomainAttack Unknown Whether the domain is thought to be fraudulent.
Netcraft.Takedown.TargetedURL Unknown The URL which this attack is masquerading as. For example, the URL of the legitimate login form that the attack targets.
Netcraft.Takedown.Certificate Unknown TTPS certificate details for the hostname, or null if no certificate was found. The value returned is the output of PHP’s openssl_x509_parse function.

netcraft-get-takedown-notes

Returns notes for takedowns.

Base Command

netcraft-get-takedown-notes

Input

Argument Name Description Required
takedown_id The takedown to get notes for. Optional
group_id A takedown group to get notes for. Optional
date_from Retrieve notes created after this date. Optional
date_to Retrieve notes created before this date. Optional
author A specific user to get notes for. Optional

Context Output

Path Type Description
Netcraft.Takedown.Note.TakedownID number The ID of the takedown to which the note belongs.
Netcraft.Takedown.Note.NoteID number The ID of the note.
Netcraft.Takedown.Note.GroupID number If this note is attached to all takedowns in a group, group_id is the ID of that group. Otherwise, the value 0 means the note is sent to a single takedown.
Netcraft.Takedown.Note.Author string The author of the note. “Netcraft” denotes a Netcraft authored note.
Netcraft.Takedown.Note.Note string The content (text) of the note.
Netcraft.Takedown.Note.Time string The date/time the note was created. Format (UTC): YYYY-MM-DD HH:MM:SS.

netcraft-add-notes-to-takedown

Adds notes to an existing takedown.

Base Command

netcraft-add-notes-to-takedown

Input

Argument Name Description Required
takedown_id A valid takedown ID to add the note to. Required
note The text to add to the takedown. Required
notify Whether to notify Netcraft. Default is “true”. Possible values are: True, False. Optional

Context Output

There is no context output for this command.

netcraft-escalate-takedown

Escalates a takedown.

Base Command

netcraft-escalate-takedown

Input

Argument Name Description Required
takedown_id The ID of the takedown to escalate. Required

Context Output

There is no context output for this command.

Configuration parameters

  • credentials — Credentials (required)
  • limit — The maximum number of entries (takedowns/notes) to return. Default is 100.
  • proxy — Use system proxy settings
  • unsecure — Trust any certificate (not secure)

Commands (5)

  • netcraft-add-notes-to-takedown Deprecated

    Adds notes to an existing takedown.

  • netcraft-escalate-takedown Deprecated

    Escalates a takedown.

  • netcraft-get-takedown-info Deprecated

    Returns information on existing takedowns. You can retrieve the takedown ID when you report the malicious URL and open the takedown, using the netcraft-report-attack command.

  • netcraft-get-takedown-notes Deprecated

    Returns notes for takedowns.

  • netcraft-report-attack Deprecated

    Reports an attack to Netcraft.

Source

Netcraft.py Netcraft.yml Netcraft_description.md
Download History Raw 
commonfields:
  id: Netcraft
  version: -1
name: Netcraft
display: Netcraft (Deprecated)
category: Network Security
provider: Netcraft
description: 'Deprecated. Use Netcraft_V2 (Display name: Netcraft) instead.'
configuration:
- display: Credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: The maximum number of entries (takedowns/notes) to return. Default is 100.
  name: limit
  defaultvalue: "100"
  type: 0
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
script:
  script: ''
  type: python
  dockerimage: demisto/python3:3.10.8.37753
  commands:
  - name: netcraft-report-attack
    arguments:
    - name: attack
      required: true
      description: The attack location you want taken down. For example, a phishing URL or fraudulent email address.
    - name: comment
      required: true
      description: The reason for submitting the attack, such as a description of the attack.
    outputs:
    - contextPath: Netcraft.Takedown.DateSubmitted
      description: The date and time of reporting.
      type: String
    - contextPath: Netcraft.Takedown.LastUpdated
      description: The date and time of the last action taken on the takedown.
      type: String
    - contextPath: Netcraft.Takedown.EvidenceURL
      description: The URL of the evidence page on incident.netcraft.com.
      type: String
    - contextPath: Netcraft.Takedown.Reporter
      description: The person/account that submitted the takedown.
      type: String
    - contextPath: Netcraft.Takedown.Domain
      description: The domain of the URL or email address being taken down. This will be blank for attacks without a domain name.
      type: String
    - contextPath: Netcraft.Takedown.Hostname
      description: The full hostname of the URL or email address being taken down. This will be blank for attacks without a hostname.
      type: String
    - contextPath: Netcraft.Takedown.CountryCode
      description: ISO country code of the hosting country.
      type: String
    - contextPath: Netcraft.Takedown.DomainAttack
      description: Whether the domain is thought to be fraudulent.
      type: String
    - contextPath: Netcraft.Takedown.TargetedURL
      description: The URL that this attack is masquarading as. For example, the URL of the legitimate login form that the attack targets.
      type: String
    - contextPath: Netcraft.Takedown.Certificate
      description: HTTPS certificate details for the hostname, or null if no certificate was found. The value returned is the output of PHP's openssl_x509_parse function.
      type: Unknown
    - contextPath: Netcraft.Takedown.ID
      description: The ID of the takedown.
      type: Number
    - contextPath: Netcraft.Takedown.GroupID
      description: The group ID of the takedown, can potentially be the same as ID, or empty if there is no group.
      type: Number
    - contextPath: Netcraft.Takedown.Status
      description: The status of the takedown.
      type: String
    - contextPath: Netcraft.Takedown.AttackType
      description: The type of takedown.
      type: String
    - contextPath: Netcraft.Takedown.AttackURL
      description: The location of the attack being taken down.
      type: String
    - contextPath: Netcraft.Takedown.Region
      description: The customer area in which the attack resides.
      type: String
    - contextPath: Netcraft.Takedown.IP
      description: The IPv4 address of the attack.
      type: String
    description: Reports an attack to Netcraft.
    deprecated: true
  - name: netcraft-get-takedown-info
    arguments:
    - name: id
      description: The ID of the takedowns for which to get information.
    - name: date_from
      description: 'Retrieve information for takedowns submitted after this date. Format: YYYY-MM-DD HH:MM:SS.'
    - name: updated_since
      description: 'Retrieve information for takedowns updated after this date. Format: YYYY-MM-DD HH:MM:SS.'
    - name: url
      description: The URL by which to filter.
    - name: ip
      description: The IP by which to filter.
    - name: region
      description: The region by which to filter. If the region is invalid or not specified, all regions are returned.
    outputs:
    - contextPath: Netcraft.Takedown.ID
      description: The ID of the takedown.
      type: number
    - contextPath: Netcraft.Takedown.GroupID
      description: The group ID of the takedown, can potentially be the same as ID or empty if there is no group.
      type: number
    - contextPath: Netcraft.Takedown.Status
      description: The status of the takedown.
      type: string
    - contextPath: Netcraft.Takedown.AttackType
      description: The type of takedown.
      type: string
    - contextPath: Netcraft.Takedown.AttackURL
      description: The location of the attack being taken down.
      type: string
    - contextPath: Netcraft.Takedown.Region
      description: The customer area in which the attack resides.
      type: string
    - contextPath: Netcraft.Takedown.DateSubmitted
      description: The date and time of reporting.
      type: string
    - contextPath: Netcraft.Takedown.LastUpdated
      description: The date and time of the last action taken on the takedown.
      type: string
    - contextPath: Netcraft.Takedown.EvidenceURL
      description: The URL of the evidence page on incident.netcraft.com.
      type: string
    - contextPath: Netcraft.Takedown.Reporter
      description: The person/account that submitted the takedown.
      type: string
    - contextPath: Netcraft.Takedown.IP
      description: The IPv4 address of the attack.
      type: Unknown
    - contextPath: Netcraft.Takedown.Domain
      description: "\tThe domain of the URL or email address being taken down. This will be blank for attacks without a domain name."
      type: Unknown
    - contextPath: Netcraft.Takedown.Hostname
      description: The full hostname of the URL or email address being taken down. This will be blank for attacks without a hostname.
      type: Unknown
    - contextPath: Netcraft.Takedown.CountryCode
      description: ISO country code of the hosting country.
      type: Unknown
    - contextPath: Netcraft.Takedown.DomainAttack
      description: Whether the domain is thought to be fraudulent.
      type: Unknown
    - contextPath: Netcraft.Takedown.TargetedURL
      description: The URL which this attack is masquerading as. For example, the URL of the legitimate login form that the attack targets.
      type: Unknown
    - contextPath: Netcraft.Takedown.Certificate
      description: TTPS certificate details for the hostname, or null if no certificate was found. The value returned is the output of PHP's openssl_x509_parse function.
      type: Unknown
    description: Returns information on existing takedowns. You can retrieve the takedown ID when you report the malicious URL and open the takedown, using the netcraft-report-attack command.
    deprecated: true
  - name: netcraft-get-takedown-notes
    arguments:
    - name: takedown_id
      description: The takedown to get notes for.
    - name: group_id
      description: A takedown group to get notes for.
    - name: date_from
      description: Retrieve notes created after this date.
    - name: date_to
      description: Retrieve notes created before this date.
    - name: author
      description: A specific user to get notes for.
    outputs:
    - contextPath: Netcraft.Takedown.Note.TakedownID
      description: The ID of the takedown to which the note belongs.
      type: number
    - contextPath: Netcraft.Takedown.Note.NoteID
      description: The ID of the note.
      type: number
    - contextPath: Netcraft.Takedown.Note.GroupID
      description: If this note is attached to all takedowns in a group, group_id is the ID of that group. Otherwise, the value 0 means the note is sent to a single takedown.
      type: number
    - contextPath: Netcraft.Takedown.Note.Author
      description: The author of the note. "Netcraft" denotes a Netcraft authored note.
      type: string
    - contextPath: Netcraft.Takedown.Note.Note
      description: The content (text) of the note.
      type: string
    - contextPath: Netcraft.Takedown.Note.Time
      description: 'The date/time the note was created. Format (UTC): YYYY-MM-DD HH:MM:SS.'
      type: string
    description: Returns notes for takedowns.
    deprecated: true
  - name: netcraft-add-notes-to-takedown
    arguments:
    - name: takedown_id
      required: true
      description: A valid takedown ID to add the note to.
    - name: note
      required: true
      description: The text to add to the takedown.
    - name: notify
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      description: Whether to notify Netcraft. Default is "true".
    description: Adds notes to an existing takedown.
    deprecated: true
  - name: netcraft-escalate-takedown
    arguments:
    - name: takedown_id
      required: true
      description: The ID of the takedown to escalate.
    description: Escalates a takedown.
    deprecated: true
  subtype: python3
fromversion: 5.0.0
deprecated: true
tests:
- No tests (deprecated)