OnboardingIntegration

Creates mock email incidents using one of two randomly selected HTML templates. Textual content is randomly generated and defined to include some text (100 random words) and the following data (at least 5 of each data type): IP addresses, URLs, SHA-1 hashes, SHA-256 hashes, MD5 hashes, email addresses, domain names.

Utilities · OnboardingIntegration

Details

IDOnboardingIntegration
ProviderOpen Source
CategoryUtilities
From Version5.0.0
Docker Imagedemisto/faker3:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Creates mock email incidents using one of two randomly selected HTML templates. Textual content is randomly generated and defined to include some text (100 random words) and the following data (at least 5 of each data type): IP addresses, URLs, SHA-1 hashes, SHA-256 hashes, MD5 hashes, email addresses, domain names.

Configure OnboardingIntegration in Cortex

Parameter Required
Number of incidents to create per minute False
Maximum number of incidents to create False
How often to create new incidents (in minutes) False
Fetch incidents False
Incident type False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

demo-ip

Gets the simulated reputation of the IP address.

Base Command

demo-ip

Input

Argument Name Description Required
ip The IP address to get the reputation of. Required

Context Output

Path Type Description
IP.Address String IP address that was tested
IP.Malicious.Vendor String For malicious IPs, the vendor that made the decision
IP.Malicious.Description String For malicious IPs, the reason that the vendor made the decision
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score
DBotScore.Indicator String The indicator that was tested

demo-url

Gets the simulated reputation of the URL address.

Base Command

demo-url

Input

Argument Name Description Required
url The URL to get the reputation of. Required

Context Output

Path Type Description
URL.Data String The URL address that was tested
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision
URL.Malicious.Description String For malicious URLs, the reason that the vendor made the decision
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score
DBotScore.Indicator String The indicator that was tested

demo-domain

Gets the simulated reputation of the domain.

Base Command

demo-domain

Input

Argument Name Description Required
domain The domain to get the reputation of. Required

Context Output

Path Type Description
Domain.Name String The domain name that was tested
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision
Domain.Malicious.Description String For malicious domains, the reason that the vendor made the decision
DBotScore.Type String Indicator type
DBotScore.Vendor String Vendor used to calculate the score
DBotScore.Score Number The actual score
DBotScore.Indicator String The indicator that was tested

demo-file

Gets the simulated reputation of the file hash.

Base Command

demo-file

Input

Argument Name Description Required
file The file hash to get the reputation of. Required

Context Output

Path Type Description
File.MD5 String File MD5 hash that was tested
File.SHA1 String File SHA-1 hash that was tested
File.SHA256 String File SHA-256 hash that was tested
File.SHA512 String File SHA-512 hash that was tested
File.Malicious.Vendor String For malicious files, the vendor that made the decision
File.Malicious.Description String For malicious files, the reason that the vendor made the decision
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score
DBotScore.Indicator String The indicator that was tested

demo-email

Gets the simulated reputation of the email address.

Base Command

demo-email

Input

Argument Name Description Required
email The email address to get the reputation of. Required

Context Output

Path Type Description
Account.Email.Address String The email address that was tested
Account.Email.Malicious.Vendor String For malicious email addresses, the vendor that made the decision
Account.Email.Malicious.Description String For malicious email addresses, the reason that the vendor made the decision
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score
DBotScore.Indicator String The indicator that was tested

Configuration parameters

  • incidents_per_minute — Number of incidents to create per minute
  • max_num_of_incidents — Maximum number of incidents to create
  • frequency — How often to create new incidents (in minutes)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (5)

  • demo-domain

    Gets the simulated reputation of the domain.

  • demo-email

    Gets the simulated reputation of the email address.

  • demo-file

    Gets the simulated reputation of the file hash.

  • demo-ip

    Gets the simulated reputation of the IP address.

  • demo-url

    Gets the simulated reputation of the URL address.

Source

OnboardingIntegration.py OnboardingIntegration_test.py OnboardingIntegration.yml OnboardingIntegration_description.md
Download History Raw 
category: Utilities
sectionorder:
- Collect
provider: Open Source
commonfields:
  id: OnboardingIntegration
  version: -1
configuration:
- defaultvalue: '5'
  display: Number of incidents to create per minute
  name: incidents_per_minute
  type: 0
  required: false
  section: Collect
- defaultvalue: '10'
  display: Maximum number of incidents to create
  name: max_num_of_incidents
  type: 0
  required: false
  section: Collect
- display: How often to create new incidents (in minutes)
  name: frequency
  type: 0
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
description: 'Creates mock email incidents using one of two randomly selected HTML templates. Textual content is randomly generated and defined to include some text (100 random words) and the following data (at least 5 of each data type): IP addresses, URLs, SHA-1 hashes, SHA-256 hashes, MD5 hashes, email addresses, domain names.'
display: OnboardingIntegration
name: OnboardingIntegration
script:
  script: ''
  type: python
  commands:
  - arguments:
    - description: The IP address to get the reputation of.
      name: ip
      required: true
    description: Gets the simulated reputation of the IP address.
    name: demo-ip
    outputs:
    - contextPath: IP.Address
      description: IP address that was tested.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  - arguments:
    - description: The URL to get the reputation of.
      name: url
      required: true
    description: Gets the simulated reputation of the URL address.
    name: demo-url
    outputs:
    - contextPath: URL.Data
      description: The URL address that was tested.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  - arguments:
    - description: The domain to get the reputation of.
      name: domain
      required: true
    description: Gets the simulated reputation of the domain.
    name: demo-domain
    outputs:
    - contextPath: Domain.Name
      description: The domain name that was tested.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: String
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  - arguments:
    - description: The file hash to get the reputation of.
      name: file
      required: true
    description: Gets the simulated reputation of the file hash.
    name: demo-file
    outputs:
    - contextPath: File.MD5
      description: File MD5 hash that was tested.
      type: String
    - contextPath: File.SHA1
      description: File SHA-1 hash that was tested.
      type: String
    - contextPath: File.SHA256
      description: File SHA-256 hash that was tested.
      type: String
    - contextPath: File.SHA512
      description: File SHA-512 hash that was tested.
      type: String
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  - arguments:
    - description: The email address to get the reputation of.
      name: email
      required: true
    description: Gets the simulated reputation of the email address.
    name: demo-email
    outputs:
    - contextPath: Account.Email.Address
      description: The email address that was tested.
      type: String
    - contextPath: Account.Email.Malicious.Vendor
      description: For malicious email addresses, the vendor that made the decision.
      type: String
    - contextPath: Account.Email.Malicious.Description
      description: For malicious email addresses, the reason that the vendor made the decision.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  dockerimage: demisto/faker3:1.0.0.10120494
  isfetch: true
  subtype: python3
tests:
- No Tests
defaultclassifier: OnboardingIntegration
defaultmapperin: OnboardingIntegration-mapper
fromversion: 5.0.0