PassiveTotal v2
Analyze and understand threat infrastructure from a variety of sources-passive DNS, active DNS, WHOIS, SSL certificates and more-without devoting resources to time-intensive manual threat research and analysis.
Data Enrichment & Threat Intelligence · PassiveTotal
Details
| ID | PassiveTotal v2 |
|---|---|
| Provider | Microsoft |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Analyze and understand threat infrastructure from a variety of sources-passive DNS, active DNS, WHOIS, SSL certificates and more-without devoting resources to time-intensive manual threat research and analysis.
This integration was integrated and tested with enterprise version of PassiveTotal v2.
Configure PassiveTotal v2 in Cortex
| Parameter | Description | Required |
|---|---|---|
| url | API URL | True |
| username | Username | True |
| secret | API Secret | True |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
| request_timeout | HTTP(S) Request Timeout (in seconds) | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
pt-whois-search
Gets WHOIS information records based on field matching queries.
Base Command
pt-whois-search
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Query value to use in your request. | Required |
| field | WHOIS field to execute the search on: domain, email, name, organization, address, phone, nameserver. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain name, for example: ‘google.com’. |
| Domain.WHOIS.CreationDate | Date | The date that the domain was created. |
| Domain.WHOIS.UpdatedDate | Date | The date that the domain was last updated. |
| Domain.WHOIS.ExpirationDate | Date | The expiration date of the domain. |
| Domain.WHOIS.NameServers | String | Name servers of the domain. |
| Domain.Organization | String | The organization of the domain. |
| Domain.Admin.Email | String | The email address of the domain administrator. |
| Domain.Admin.Name | String | The name of the domain administrator. |
| Domain.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.Admin.Country | String | The country of the domain administrator. |
| Domain.Registrant.Email | String | The email address of the registrant. |
| Domain.Registrant.Name | String | The name of the registrant. |
| Domain.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.Registrant.Country | String | The country of the registrant. |
| Domain.WHOIS.Admin.Email | String | The email address of the domain administrator. |
| Domain.WHOIS.Admin.Name | String | The name of the domain administrator. |
| Domain.WHOIS.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.WHOIS.Admin.Country | String | The country of the domain administrator. |
| Domain.WHOIS.Registrar.Name | String | The name of the registrar, for example: ‘GoDaddy’. |
| Domain.WHOIS.Registrant.Email | String | The email address of the registrant. |
| Domain.WHOIS.Registrant.Name | String | The name of the registrant. |
| Domain.WHOIS.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.WHOIS.Registrant.Country | String | The country of the registrant. |
| PassiveTotal.WHOIS.domain | String | The domain name, for example: ‘google.com’. |
| PassiveTotal.WHOIS.registrar | String | The name of the registrar of the domain |
| PassiveTotal.WHOIS.whoisServer | String | WHOIS server name where the details of domain registrations belong |
| PassiveTotal.WHOIS.registered | Date | The date that the domain was registered. |
| PassiveTotal.WHOIS.expiresAt | Date | The expiration date of the domain. |
| PassiveTotal.WHOIS.registryUpdatedAt | Date | The date when registry was last updated. |
| PassiveTotal.WHOIS.lastLoadedAt | Date | Last loaded date of WHOIS database. |
| PassiveTotal.WHOIS.nameServers | String | Name servers of the domain. |
| PassiveTotal.WHOIS.organization | String | The organization of the domain. |
| PassiveTotal.WHOIS.name | String | Name of the domain. |
| PassiveTotal.WHOIS.telephone | String | Telephone number fetched from whois details of the domain. |
| PassiveTotal.WHOIS.contactEmail | String | Contact Email address of the domain owner |
| PassiveTotal.WHOIS.registrantEmail | String | The name of the domain registrant. |
| PassiveTotal.WHOIS.registrantFax | String | The fax number of the domain registrant. |
| PassiveTotal.WHOIS.registrantName | String | The name of the domain registrant. |
| PassiveTotal.WHOIS.registrantOrganization | String | The organizations of the domain registrant. |
| PassiveTotal.WHOIS.registrantStreet | String | The street of the domain registrant. |
| PassiveTotal.WHOIS.registrantCity | String | The city of the domain registrant. |
| PassiveTotal.WHOIS.registrantState | String | The state of the domain registrant. |
| PassiveTotal.WHOIS.registrantPostalCode | String | The postal code of the domain registrant. |
| PassiveTotal.WHOIS.registrantCountry | String | The country of the domain registrant. |
| PassiveTotal.WHOIS.registrantTelephone | String | The telephone number of the domain registrant. |
| PassiveTotal.WHOIS.adminEmail | String | The email address of the domain administrator. |
| PassiveTotal.WHOIS.adminFax | String | The fax number of the domain administrator. |
| PassiveTotal.WHOIS.adminName | String | The name of the domain administrator. |
| PassiveTotal.WHOIS.adminOrganization | String | The organizations of the domain administrator. |
| PassiveTotal.WHOIS.adminStreet | String | The street of the domain administrator. |
| PassiveTotal.WHOIS.adminCity | String | The city of the domain administrator. |
| PassiveTotal.WHOIS.adminState | String | The state of the domain administrator. |
| PassiveTotal.WHOIS.adminPostalCode | String | The postal code of the domain administrator. |
| PassiveTotal.WHOIS.adminCountry | String | The country of the domain administrator. |
| PassiveTotal.WHOIS.adminTelephone | String | The telephone number of the domain administrator. |
| PassiveTotal.WHOIS.billingEmail | String | The email address of the domain billing. |
| PassiveTotal.WHOIS.billingFax | String | The fax number of the domain billing. |
| PassiveTotal.WHOIS.billingName | String | The name of the domain billing. |
| PassiveTotal.WHOIS.billingOrganization | String | The organizations of the domain billing. |
| PassiveTotal.WHOIS.billingStreet | String | The street of the domain billing. |
| PassiveTotal.WHOIS.billingCity | String | The city of the domain billing. |
| PassiveTotal.WHOIS.billingState | String | The state of the domain billing. |
| PassiveTotal.WHOIS.billingPostalCode | String | The postal code of the domain billing. |
| PassiveTotal.WHOIS.billingCountry | String | The country of the domain billing. |
| PassiveTotal.WHOIS.billingTelephone | String | The telephone number of the domain billing. |
| PassiveTotal.WHOIS.techEmail | String | The email address of the domain tech. |
| PassiveTotal.WHOIS.techFax | String | The fax number of the domain tech. |
| PassiveTotal.WHOIS.techName | String | The name of the domain tech. |
| PassiveTotal.WHOIS.techOrganization | String | The organizations of domain tech. |
| PassiveTotal.WHOIS.techStreet | String | The street of the domain tech. |
| PassiveTotal.WHOIS.techCity | String | The city of the domain tech. |
| PassiveTotal.WHOIS.techState | String | The state of the domain tech. |
| PassiveTotal.WHOIS.techPostalCode | String | The postal code of the domain tech. |
| PassiveTotal.WHOIS.techCountry | String | The country of the domain tech. |
| PassiveTotal.WHOIS.techTelephone | String | The telephone number of the domain tech. |
Command Example
!pt-whois-search field=domain query=riskiq.com
Context Example
{
"DBotScore": [
{
"Indicator": "riskiq.com",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
}
],
"Domain": [
{
"Admin": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"CreationDate": "2006-01-11T16:00:00.000-0800",
"ExpirationDate": "2017-01-11T16:00:00.000-0800",
"Name": "riskiq.com",
"NameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"Organization": "RiskIQ, Inc.",
"Registrant": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"Registrar": {
"AbuseEmail": null,
"AbusePhone": null,
"Name": "GODADDY.COM, LLC"
},
"UpdatedDate": "2014-12-08T16:00:00.000-0800",
"WHOIS": {
"Admin": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"CreationDate": "2006-01-11T16:00:00.000-0800",
"ExpirationDate": "2017-01-11T16:00:00.000-0800",
"NameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"Registrant": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"Registrar": {
"AbuseEmail": null,
"AbusePhone": null,
"Name": "GODADDY.COM, LLC"
},
"UpdatedDate": "2014-12-08T16:00:00.000-0800"
}
}
],
"PassiveTotal": {
"WHOIS": {
"adminCity": "san francisco",
"adminCountry": "us",
"adminEmail": "domains@riskiq.com",
"adminName": "Risk IQ",
"adminOrganization": "RiskIQ, Inc.",
"adminPostalCode": "94111",
"adminState": "california",
"adminStreet": "22 Battery Street\n10th Floor",
"adminTelephone": "18884154447",
"contactEmail": "domains@riskiq.com",
"domain": "riskiq.com",
"expiresAt": "2017-01-11T16:00:00.000-0800",
"lastLoadedAt": "2016-09-27T09:40:31.180-0700",
"name": "Risk IQ",
"nameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"organization": "RiskIQ, Inc.",
"registered": "2006-01-11T16:00:00.000-0800",
"registrantCity": "san francisco",
"registrantCountry": "us",
"registrantEmail": "domains@riskiq.com",
"registrantName": "Risk IQ",
"registrantOrganization": "RiskIQ, Inc.",
"registrantPostalCode": "94111",
"registrantState": "california",
"registrantStreet": "22 Battery Street\n10th Floor",
"registrantTelephone": "18884154447",
"registrar": "GODADDY.COM, LLC",
"registryUpdatedAt": "2014-12-08T16:00:00.000-0800",
"techCity": "san francisco",
"techCountry": "us",
"techEmail": "domains@riskiq.com",
"techName": "Risk IQ",
"techOrganization": "RiskIQ, Inc.",
"techPostalCode": "94111",
"techState": "california",
"techStreet": "22 Battery Street\n10th Floor",
"techTelephone": "18884154447",
"telephone": "18884154447",
"whoisServer": "whois.godaddy.com"
}
}
}
Human Readable Output
Total Retrieved Record(s): 2
Associated Domains
Domain WHOIS Server Registrar Contact Email Name Servers Registrant Admin Tech Creation Date (GMT) Expire Date (GMT) Updated Date (GMT) Last Scanned (GMT) riskiq.com whois.godaddy.com GODADDY.COM, LLC domains@riskiq.com luke.ns.cloudflare.com, serena.ns.cloudflare.com City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 188841544472006-01-11T16:00:00.000-0800 2017-01-11T16:00:00.000-0800 2014-12-08T16:00:00.000-0800 2016-09-27T09:40:31.180-0700
pt-get-components
Retrieves the host attribute components for a domain or IP address. Maximum 2000 records are fetched.
Base Command
pt-get-components
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Domain or IP address you want to search components for. | Required |
| start | Filter for records whose last seen is after this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
| end | Filter for records whose first seen is before this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain name, for example: “google.com”. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| IP.Address | String | The IP Address of the component. |
| PassiveTotal.Component.firstSeen | Date | The date and time when the component was first observed. |
| PassiveTotal.Component.lastSeen | Date | The date and time when the component was most recently observed. |
| PassiveTotal.Component.version | String | The current version of component. |
| PassiveTotal.Component.category | String | The category under which the component falls. |
| PassiveTotal.Component.label | String | The value of the component. |
| PassiveTotal.Component.hostname | String | The hostname of the component. |
| PassiveTotal.Component.address | String | The IP address of the component. |
Command Example
!pt-get-components query=www.furth.com.ar
Context Example
{
"DBotScore": {
"Indicator": "www.furth.com.ar",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
},
"Domain": {
"Name": "www.furth.com.ar"
},
"PassiveTotal": {
"Component": [
{
"category": "Framework",
"firstSeen": "2020-05-29 10:57:44",
"hostname": "www.furth.com.ar",
"label": "PHP",
"lastSeen": "2020-05-29 10:57:44"
},
{
"category": "Server",
"firstSeen": "2020-05-29 10:57:44",
"hostname": "www.furth.com.ar",
"label": "Apache",
"lastSeen": "2020-05-29 10:57:44"
},
{
"category": "Server Module",
"firstSeen": "2016-01-11 23:45:15",
"hostname": "www.furth.com.ar",
"label": "mod_bwlimited",
"lastSeen": "2017-10-24 15:53:52",
"version": "1.4"
},
{
"category": "Server Module",
"firstSeen": "2016-01-11 23:45:15",
"hostname": "www.furth.com.ar",
"label": "OpenSSL",
"lastSeen": "2017-10-24 15:53:52",
"version": "1.0.1e-fips"
},
{
"category": "Server",
"firstSeen": "2016-01-11 23:45:15",
"hostname": "www.furth.com.ar",
"label": "Apache",
"lastSeen": "2017-10-24 15:53:52",
"version": "2.2.29"
},
{
"category": "Operating System",
"firstSeen": "2016-01-11 23:45:15",
"hostname": "www.furth.com.ar",
"label": "Unix",
"lastSeen": "2017-10-24 15:53:52"
},
{
"category": "Server Module",
"firstSeen": "2016-01-11 23:45:15",
"hostname": "www.furth.com.ar",
"label": "mod_ssl",
"lastSeen": "2017-10-24 15:53:52",
"version": "2.2.29"
}
]
}
}
Human Readable Output
Total Retrieved Record(s): 7
COMPONENTS
Hostname First (GMT) Last (GMT) Category Value Version www.furth.com.ar 2020-05-29 10:57:44 2020-05-29 10:57:44 Framework PHP www.furth.com.ar 2020-05-29 10:57:44 2020-05-29 10:57:44 Server Apache www.furth.com.ar 2016-01-11 23:45:15 2017-10-24 15:53:52 Server Module mod_bwlimited 1.4 www.furth.com.ar 2016-01-11 23:45:15 2017-10-24 15:53:52 Server Module OpenSSL 1.0.1e-fips www.furth.com.ar 2016-01-11 23:45:15 2017-10-24 15:53:52 Server Apache 2.2.29 www.furth.com.ar 2016-01-11 23:45:15 2017-10-24 15:53:52 Operating System Unix www.furth.com.ar 2016-01-11 23:45:15 2017-10-24 15:53:52 Server Module mod_ssl 2.2.29
pt-get-trackers
Retrieves the host attribute trackers for a domain or IP address. Maximum 2000 records are fetched.
Base Command
pt-get-trackers
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Domain or IP address you want to search trackers for. | Required |
| start | Filter for records whose last seen is after this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
| end | Filter for records whose first seen is before this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain name, for example: “google.com”. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| IP.Address | String | The IP Address of the component. |
| PassiveTotal.Tracker.firstSeen | Date | The date and time when the tracker was first observed. |
| PassiveTotal.Tracker.lastSeen | Date | The date and time when the tracker was most recently observed. |
| PassiveTotal.Tracker.attributeValue | String | The value of the tracker. |
| PassiveTotal.Tracker.attributeType | String | The type under which the tracker falls. |
| PassiveTotal.Tracker.hostname | String | The hostname of the tracker. |
| PassiveTotal.Tracker.address | String | The IP address of the tracker. |
Command Example
!pt-get-trackers query=filmesonlinegratis.net
Context Example
{
"DBotScore": [
{
"Indicator": "filmesonlinegratis.net",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
},
{
"Indicator": "www.filmesonlinegratis.net",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
}
],
"Domain": [
{
"Name": "filmesonlinegratis.net"
},
{
"Name": "www.filmesonlinegratis.net"
}
],
"PassiveTotal": {
"Tracker": [
{
"attributeType": "GoogleAnalyticsTrackingId",
"attributeValue": "ua-70630818-3",
"firstSeen": "2016-10-14 10:16:38",
"hostname": "filmesonlinegratis.net",
"lastSeen": "2020-06-14 19:43:28"
},
{
"attributeType": "GoogleAnalyticsAccountNumber",
"attributeValue": "ua-70630818",
"firstSeen": "2016-10-14 10:16:38",
"hostname": "filmesonlinegratis.net",
"lastSeen": "2020-06-14 19:43:28"
},
{
"attributeType": "GoogleAnalyticsAccountNumber",
"attributeValue": "ua-11598035",
"firstSeen": "2012-03-07 05:53:50",
"hostname": "www.filmesonlinegratis.net",
"lastSeen": "2016-10-13 15:38:35"
},
{
"attributeType": "GoogleAnalyticsTrackingId",
"attributeValue": "ua-11598035-1",
"firstSeen": "2012-03-07 05:53:50",
"hostname": "www.filmesonlinegratis.net",
"lastSeen": "2016-10-13 15:38:35"
},
{
"attributeType": "GoogleAnalyticsTrackingId",
"attributeValue": "ua-11598035-1",
"firstSeen": "2014-02-11 01:30:40",
"hostname": "filmesonlinegratis.net",
"lastSeen": "2016-09-13 03:54:34"
},
{
"attributeType": "GoogleAnalyticsAccountNumber",
"attributeValue": "ua-11598035",
"firstSeen": "2014-02-11 01:30:40",
"hostname": "filmesonlinegratis.net",
"lastSeen": "2016-09-13 03:54:34"
},
{
"attributeType": "TumblrId",
"attributeValue": "25.media",
"firstSeen": "2016-07-02 00:46:33",
"hostname": "www.filmesonlinegratis.net",
"lastSeen": "2016-09-02 11:09:30"
},
{
"attributeType": "FacebookId",
"attributeValue": "filmesog",
"firstSeen": "2012-11-27 06:06:44",
"hostname": "www.filmesonlinegratis.net",
"lastSeen": "2015-09-26 05:52:23"
},
{
"attributeType": "FacebookId",
"attributeValue": "filmesog",
"firstSeen": "2014-02-11 01:30:40",
"hostname": "filmesonlinegratis.net",
"lastSeen": "2015-09-24 05:12:39"
},
{
"attributeType": "WhosAmungUsId",
"attributeValue": "6cdg",
"firstSeen": "2012-03-07 05:53:50",
"hostname": "www.filmesonlinegratis.net",
"lastSeen": "2012-03-07 16:00:45"
}
]
}
}
Human Readable Output
Total Retrieved Record(s): 10
TRACKERS
Hostname First (GMT) Last (GMT) Type Value filmesonlinegratis.net 2016-10-14 10:16:38 2020-06-14 19:43:28 GoogleAnalyticsTrackingId ua-70630818-3 filmesonlinegratis.net 2016-10-14 10:16:38 2020-06-14 19:43:28 GoogleAnalyticsAccountNumber ua-70630818 www.filmesonlinegratis.net 2012-03-07 05:53:50 2016-10-13 15:38:35 GoogleAnalyticsAccountNumber ua-11598035 www.filmesonlinegratis.net 2012-03-07 05:53:50 2016-10-13 15:38:35 GoogleAnalyticsTrackingId ua-11598035-1 filmesonlinegratis.net 2014-02-11 01:30:40 2016-09-13 03:54:34 GoogleAnalyticsTrackingId ua-11598035-1 filmesonlinegratis.net 2014-02-11 01:30:40 2016-09-13 03:54:34 GoogleAnalyticsAccountNumber ua-11598035 www.filmesonlinegratis.net 2016-07-02 00:46:33 2016-09-02 11:09:30 TumblrId 25.media www.filmesonlinegratis.net 2012-11-27 06:06:44 2015-09-26 05:52:23 FacebookId filmesog filmesonlinegratis.net 2014-02-11 01:30:40 2015-09-24 05:12:39 FacebookId filmesog www.filmesonlinegratis.net 2012-03-07 05:53:50 2012-03-07 16:00:45 WhosAmungUsId 6cdg
pt-get-pdns-details
Retrieves the passive DNS results from active account sources.
Base Command
pt-get-pdns-details
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The domain or IP being queried. | Required |
| start | Filter for records whose last seen is after this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
| end | Filter for records whose first seen is before this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.PDNS.resolve | String | The host or ip address that indicates resolve in Passive DNS record. |
| PassiveTotal.PDNS.resolveType | String | The type of the resolve. I.e domain, ip, host, etc. |
| PassiveTotal.PDNS.value | String | The value of the Passive DNS record. |
| PassiveTotal.PDNS.source | String | Source of the passive DNS records. |
| PassiveTotal.PDNS.firstSeen | String | First seen timestamp of the passive DNS record. |
| PassiveTotal.PDNS.lastSeen | String | Last seen timestamp of the passive DNS record. |
| PassiveTotal.PDNS.collected | String | The date when a passive DNS record is collected. |
| PassiveTotal.PDNS.recordType | String | The type of the passive DNS record. I.e CNAME, SOA, A, etc |
| PassiveTotal.PDNS.recordHash | String | The hash value of the passive DNS record. |
| Domain.Name | String | The domain name, for example: ‘google.com’. |
| IP.Address | String | The IP Address of the component. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
Command Example
!pt-get-pdns-details query=www.furth.com.ar
Context Example
{
"DBotScore": [
{
"Indicator": "furth.com.ar",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
},
{
"Indicator": "77.81.241.5",
"Score": 0,
"Type": "ip",
"Vendor": "PassiveTotal"
},
{
"Indicator": "184.75.255.33",
"Score": 0,
"Type": "ip",
"Vendor": "PassiveTotal"
}
],
"Domain": {
"Name": "furth.com.ar"
},
"IP": [
{
"Address": "77.81.241.5"
},
{
"Address": "184.75.255.33"
}
],
"PassiveTotal": {
"PDNS": [
{
"collected": "2020-06-17 12:26:33",
"firstSeen": "2010-12-15 09:10:10",
"lastSeen": "2020-06-17 05:26:33",
"recordHash": "abf781b2484ea79d521cffb0745b71319d4db1158f71bb019b41077f8e55b035",
"recordType": "CNAME",
"resolve": "furth.com.ar",
"resolveType": "domain",
"source": [
"riskiq",
"pingly"
],
"value": "www.furth.com.ar"
},
{
"collected": "2020-06-17 12:26:33",
"firstSeen": "2020-05-29 03:57:44",
"lastSeen": "2020-06-17 05:26:33",
"recordHash": "d7183564ca617e173fc26aeff66a38bb5c1b9089e56819851183860b9a37ccca",
"recordType": "A",
"resolve": "77.81.241.5",
"resolveType": "ip",
"source": [
"riskiq",
"pingly"
],
"value": "www.furth.com.ar"
},
{
"collected": "2020-06-17 12:26:33",
"firstSeen": "2016-01-11 15:45:15",
"lastSeen": "2017-10-24 08:53:52",
"recordHash": "345780dcde96f0c28e3b93ec53bd33067f26075f30c2d4e49fafe0d2396194ca",
"recordType": "A",
"resolve": "184.75.255.33",
"resolveType": "ip",
"source": [
"riskiq"
],
"value": "www.furth.com.ar"
},
{
"collected": "2020-06-17 12:26:33",
"firstSeen": "2020-06-17 05:26:33",
"lastSeen": "2020-06-17 05:26:33",
"recordHash": "63deb7c38cbea98f631777fd3ba89de0c270178bd37eb6a270ee7e37b3cd92e5",
"recordType": "SOA",
"resolve": "webmaster@furth.com.ar",
"resolveType": "email",
"source": [
"pingly"
],
"value": "www.furth.com.ar"
},
{
"collected": "2020-06-17 12:26:33",
"firstSeen": "2020-06-17 05:26:33",
"lastSeen": "2020-06-17 05:26:33",
"recordHash": "24fa99da36eecc22b8970a33f8adf0f150598391319df4fc02128d677999e886",
"recordType": "MX",
"resolve": "furth.com.ar",
"resolveType": "domain",
"source": [
"pingly"
],
"value": "www.furth.com.ar"
}
]
}
}
Human Readable Output
Total Retrieved Record(s): 5
PDNS detail(s)
Resolve Resolve Type Record Type Collected (GMT) First (GMT) Last (GMT) Source Record Hash furth.com.ar domain CNAME 2020-06-17 12:26:33 2010-12-15 09:10:10 2020-06-17 05:26:33 riskiq, pingly abf781b2484ea79d521cffb0745b71319d4db1158f71bb019b41077f8e55b035 77.81.241.5 ip A 2020-06-17 12:26:33 2020-05-29 03:57:44 2020-06-17 05:26:33 riskiq, pingly d7183564ca617e173fc26aeff66a38bb5c1b9089e56819851183860b9a37ccca 184.75.255.33 ip A 2020-06-17 12:26:33 2016-01-11 15:45:15 2017-10-24 08:53:52 riskiq 345780dcde96f0c28e3b93ec53bd33067f26075f30c2d4e49fafe0d2396194ca webmaster@furth.com.ar SOA 2020-06-17 12:26:33 2020-06-17 05:26:33 2020-06-17 05:26:33 pingly 63deb7c38cbea98f631777fd3ba89de0c270178bd37eb6a270ee7e37b3cd92e5 furth.com.ar domain MX 2020-06-17 12:26:33 2020-06-17 05:26:33 2020-06-17 05:26:33 pingly 24fa99da36eecc22b8970a33f8adf0f150598391319df4fc02128d677999e886
pt-ssl-cert-search
Retrieves SSL certificates for a given field value.
Base Command
pt-ssl-cert-search
Input
| Argument Name | Description | Required |
|---|---|---|
| field | Field by which to search. Allowed values: issuerSurname, subjectOrganizationName, issuerCountry, issuerOrganizationUnitName, fingerprint, subjectOrganizationUnitName, serialNumber, subjectEmailAddress, subjectCountry, issuerGivenName, subjectCommonName, issuerCommonName, issuerStateOrProvinceName, issuerProvince, subjectStateOrProvinceName, sha1, subjectStreetAddress, subjectSerialNumber, issuerOrganizationName, subjectSurname, subjectLocalityName, issuerStreetAddress, issuerLocalityName, subjectGivenName, subjectProvince, issuerSerialNumber, issuerEmailAddress |
Required |
| query | Field value for which to search. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.SSL.firstSeen | Number | Epoch timestamp when SSL certificate identified by the system. |
| PassiveTotal.SSL.lastSeen | Number | The last seen epoch timestamp of the SSL certificates. |
| PassiveTotal.SSL.fingerprint | String | A fingerprint detail from the SSL certificates. |
| PassiveTotal.SSL.sslVersion | Number | A version of the certificate. |
| PassiveTotal.SSL.expirationDate | String | The expiry date of the certificate. |
| PassiveTotal.SSL.issueDate | String | Issue date of the certificate. |
| PassiveTotal.SSL.sha1 | String | Sha1 of the certificate. |
| PassiveTotal.SSL.serialNumber | String | A serial number of the certificate. |
| PassiveTotal.SSL.issuerCountry | String | The country name of the certificate issuer. |
| PassiveTotal.SSL.issuerStateOrProvinceName | String | The state or province name of the certificate issuer. |
| PassiveTotal.SSL.issuerCommonName | String | The common name of the issuer. |
| PassiveTotal.SSL.issuerEmailAddress | String | A contact email address of the certificate issuer. |
| PassiveTotal.SSL.issuerProvince | String | A province of the certificate issuer. |
| PassiveTotal.SSL.issuerOrganizationUnitName | String | An organization unit name of the certificate issuer. |
| PassiveTotal.SSL.issuerSurname | String | The surname of the certificate issuer. |
| PassiveTotal.SSL.issuerStreetAddress | String | Street address of the certificate issuer. |
| PassiveTotal.SSL.issuerLocalityName | String | The locality of the certificate issuer. |
| PassiveTotal.SSL.issuerSerialNumber | String | The serial number of the certificate issuer. |
| PassiveTotal.SSL.issuerOrganizationName | String | An organization name of the certificate issuer. |
| PassiveTotal.SSL.issuerGivenName | String | A given name of the certificate issuer. |
| PassiveTotal.SSL.subjectCommonName | String | The common name of the subject. |
| PassiveTotal.SSL.subjectOrganizationName | String | An organization name of the subject of the certificate. |
| PassiveTotal.SSL.subjectOrganizationUnitName | String | An organization unit name of the subject of the certificate. |
| PassiveTotal.SSL.subjectGivenName | String | The given name of the subject of the certificate. |
| PassiveTotal.SSL.subjectSurname | String | The surname of the subject of the certificate. |
| PassiveTotal.SSL.subjectLocalityName | String | The locality of the subject. |
| PassiveTotal.SSL.subjectEmailAddress | String | A contact email address of the subject. |
| PassiveTotal.SSL.subjectProvince | String | The province of the subject. |
| PassiveTotal.SSL.subjectStateOrProvinceName | String | The state or province name of the subject. |
| PassiveTotal.SSL.subjectSerialNumber | String | A serial number of the subject. |
| PassiveTotal.SSL.subjectStreetAddress | String | The street address of the subject. |
| PassiveTotal.SSL.subjectCountry | String | The country name of the subject from the certificate. |
| PassiveTotal.SSL.subjectAlternativeNames | String | Alternative names of the subject from the certificate details. |
Command Example
!pt-ssl-cert-search field=serialNumber query=61135c80f8ed28d2
Context Example
{
"PassiveTotal": {
"SSL": [
{
"expirationDate": "Apr 09 13:15:00 2019 GMT",
"fingerprint": "88:48:e8:68:b1:90:d0:fd:cb:6f:39:c3:7b:53:82:c8:7e:09:76:b0",
"firstSeen": 1547559631314,
"issueDate": "Jan 15 13:15:00 2019 GMT",
"issuerCommonName": "Google Internet Authority G3",
"issuerCountry": "US",
"issuerOrganizationName": "Google Trust Services",
"lastSeen": 1547607634446,
"serialNumber": "6995036355238373586",
"sha1": "8848e868b190d0fdcb6f39c37b5382c87e0976b0",
"sslVersion": "3",
"subjectAlternativeNames": [
"www.google.com"
],
"subjectCommonName": "www.google.com",
"subjectCountry": "US",
"subjectLocalityName": "Mountain View",
"subjectOrganizationName": "Google LLC",
"subjectProvince": "California",
"subjectStateOrProvinceName": "California"
},
{
"expirationDate": "Apr 09 13:15:00 2019 GMT",
"fingerprint": "99:5b:00:5f:44:be:53:bf:3e:59:21:90:1d:79:a9:8e:54:af:d3:29",
"firstSeen": 1548455641692,
"issueDate": "Jan 15 13:15:00 2019 GMT",
"issuerCommonName": "Google Internet Authority G3",
"issuerCountry": "US",
"issuerOrganizationName": "Google Trust Services",
"lastSeen": 1549571983939,
"serialNumber": "6995036355238373586",
"sha1": "995b005f44be53bf3e5921901d79a98e54afd329",
"sslVersion": "3",
"subjectAlternativeNames": [
"www.google.com"
],
"subjectCommonName": "www.google.com",
"subjectCountry": "US",
"subjectLocalityName": "Mountain View",
"subjectOrganizationName": "Google LLC",
"subjectProvince": "California",
"subjectStateOrProvinceName": "California"
}
]
}
}
Human Readable Output
Total Retrieved Record(s): 2
SSL certificate(s)
Sha1 Serial Number Issued (GMT) Expires (GMT) SSL Version First (GMT) Last (GMT) Issuer Common Name Subject Common Name Subject Alternative Names Issuer Organization Name Subject Organization Name Subject Locality Name Subject State/Province Name Issuer Country Subject Country 8848e868b190d0fdcb6f39c37b5382c87e0976b0 6995036355238373586 Jan 15 13:15:00 2019 GMT Apr 09 13:15:00 2019 GMT 3 2019-01-15 13:40:31 2019-01-16 03:00:34 Google Internet Authority G3 www.google.com www.google.com Google Trust Services Google LLC Mountain View California US US 995b005f44be53bf3e5921901d79a98e54afd329 6995036355238373586 Jan 15 13:15:00 2019 GMT Apr 09 13:15:00 2019 GMT 3 2019-01-25 22:34:01 2019-02-07 20:39:43 Google Internet Authority G3 www.google.com www.google.com Google Trust Services Google LLC Mountain View California US US
pt-get-host-pairs
Retrieves the host attribute pairs related to a domain or IP address. Maximum 2000 records are fetched.
Base Command
pt-get-host-pairs
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Domain or IP address you want to search host-pairs for. | Required |
| direction | The direction of searching pair records for a given domain. Valid values: children, parents. | Required |
| start | Filter for records whose last seen is after this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
| end | Filter for records whose first seen is before this datetime. It accepts “yyyy-mm-dd hh:mm:ss” or “yyyy-mm-dd” format. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.HostPair.firstSeen | Date | The date and time when the host pair was first observed. |
| PassiveTotal.HostPair.lastSeen | Date | The date and time when the host pair was most recently observed. |
| PassiveTotal.HostPair.cause | String | The cause of relation between parent and child. |
| PassiveTotal.HostPair.parent | String | The hostname of the parent of the host pair. |
| PassiveTotal.HostPair.child | String | The hostname of the child of the host pair. |
Command Example
!pt-get-host-pairs direction=children query=ns1.furth.com.ar
Context Example
{
"PassiveTotal": {
"HostPair": [
{
"cause": "redirect",
"child": "furth.com.ar",
"firstSeen": "2020-05-29 07:05:22",
"lastSeen": "2020-06-10 11:53:23",
"parent": "ns1.furth.com.ar"
},
{
"cause": "parentPage",
"child": "ns1.furth.com.ar",
"firstSeen": "2020-05-02 06:47:23",
"lastSeen": "2020-06-08 03:08:38",
"parent": "ns1.furth.com.ar"
}
]
}
}
Human Readable Output
Total Retrieved Record(s): 2
HOST PAIRS
Parent Hostname Child Hostname First (GMT) Last (GMT) Cause ns1.furth.com.ar furth.com.ar 2020-05-29 07:05:22 2020-06-10 11:53:23 redirect ns1.furth.com.ar ns1.furth.com.ar 2020-05-02 06:47:23 2020-06-08 03:08:38 parentPage
domain
Provides data enrichment for domains.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | The domain to enrich. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain name, for example: ‘google.com’. |
| Domain.WHOIS.CreationDate | Date | The date that the domain was created. |
| Domain.WHOIS.UpdatedDate | Date | The date that the domain was last updated. |
| Domain.WHOIS.ExpirationDate | Date | The expiration date of the domain. |
| Domain.WHOIS.NameServers | String | Name servers of the domain. |
| Domain.Organization | String | The organization of the domain. |
| Domain.Admin.Email | String | The email address of the domain administrator. |
| Domain.Admin.Name | String | The name of the domain administrator. |
| Domain.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.Admin.Country | String | The country of the domain administrator. |
| Domain.Registrant.Email | String | The email address of the registrant. |
| Domain.Registrant.Name | String | The name of the registrant. |
| Domain.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.Registrant.Country | String | The country of the registrant. |
| Domain.WHOIS.Admin.Email | String | The email address of the domain administrator. |
| Domain.WHOIS.Admin.Name | String | The name of the domain administrator. |
| Domain.WHOIS.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.WHOIS.Admin.Country | String | The country of the domain administrator. |
| Domain.WHOIS.Registrar.Name | String | The name of the registrar, for example: ‘GoDaddy’. |
| Domain.WHOIS.Registrant.Email | String | The email address of the registrant. |
| Domain.WHOIS.Registrant.Name | String | The name of the registrant. |
| Domain.WHOIS.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.WHOIS.Registrant.Country | String | The country of the registrant. |
| PassiveTotal.Domain.domain | String | The domain name, for example: ‘google.com’. |
| PassiveTotal.Domain.registrar | String | The name of the registrar of the domain |
| PassiveTotal.Domain.whoisServer | String | WHOIS server name where the details of domain registrations belong |
| PassiveTotal.Domain.registered | Date | The date that the domain was registered. |
| PassiveTotal.Domain.expiresAt | Date | The expiration date of the domain. |
| PassiveTotal.Domain.registryUpdatedAt | Date | The date when registry was last updated. |
| PassiveTotal.Domain.lastLoadedAt | Date | Last loaded date of WHOIS database. |
| PassiveTotal.Domain.nameServers | String | Name servers of the domain. |
| PassiveTotal.Domain.organization | String | The organization of the domain. |
| PassiveTotal.Domain.name | String | Name of the domain. |
| PassiveTotal.Domain.telephone | String | Telephone number fetched from whois details of the domain. |
| PassiveTotal.Domain.contactEmail | String | Contact Email address of the domain owner |
| PassiveTotal.Domain.registrantEmail | String | The name of the domain registrant. |
| PassiveTotal.Domain.registrantFax | String | The fax number of the domain registrant. |
| PassiveTotal.Domain.registrantName | String | The name of the domain registrant. |
| PassiveTotal.Domain.registrantOrganization | String | The organizations of the domain registrant. |
| PassiveTotal.Domain.registrantStreet | String | The street of the domain registrant. |
| PassiveTotal.Domain.registrantCity | String | The city of the domain registrant. |
| PassiveTotal.Domain.registrantState | String | The state of the domain registrant. |
| PassiveTotal.Domain.registrantPostalCode | String | The postal code of the domain registrant. |
| PassiveTotal.Domain.registrantCountry | String | The country of the domain registrant. |
| PassiveTotal.Domain.registrantTelephone | String | The telephone number of the domain registrant. |
| PassiveTotal.Domain.adminEmail | String | The email address of the domain administrator. |
| PassiveTotal.Domain.adminFax | String | The fax number of the domain administrator. |
| PassiveTotal.Domain.adminName | String | The name of the domain administrator. |
| PassiveTotal.Domain.adminOrganization | String | The organizations of the domain administrator. |
| PassiveTotal.Domain.adminStreet | String | The street of the domain administrator. |
| PassiveTotal.Domain.adminCity | String | The city of the domain administrator. |
| PassiveTotal.Domain.adminState | String | The state of the domain administrator. |
| PassiveTotal.Domain.adminPostalCode | String | The postal code of the domain administrator. |
| PassiveTotal.Domain.adminCountry | String | The country of the domain administrator. |
| PassiveTotal.Domain.adminTelephone | String | The telephone number of the domain administrator. |
| PassiveTotal.Domain.billingEmail | String | The email address of the domain billing. |
| PassiveTotal.Domain.billingFax | String | The fax number of the domain billing. |
| PassiveTotal.Domain.billingName | String | The name of the domain billing. |
| PassiveTotal.Domain.billingOrganization | String | The organizations of the domain billing. |
| PassiveTotal.Domain.billingStreet | String | The street of the domain billing. |
| PassiveTotal.Domain.billingCity | String | The city of the domain billing. |
| PassiveTotal.Domain.billingState | String | The state of the domain billing. |
| PassiveTotal.Domain.billingPostalCode | String | The postal code of the domain billing. |
| PassiveTotal.Domain.billingCountry | String | The country of the domain billing. |
| PassiveTotal.Domain.billingTelephone | String | The telephone number of the domain billing. |
| PassiveTotal.Domain.techEmail | String | The email address of the domain tech. |
| PassiveTotal.Domain.techFax | String | The fax number of the domain tech. |
| PassiveTotal.Domain.techName | String | The name of the domain tech. |
| PassiveTotal.Domain.techOrganization | String | The organizations of domain tech. |
| PassiveTotal.Domain.techStreet | String | The street of the domain tech. |
| PassiveTotal.Domain.techCity | String | The city of the domain tech. |
| PassiveTotal.Domain.techState | String | The state of the domain tech. |
| PassiveTotal.Domain.techPostalCode | String | The postal code of the domain tech. |
| PassiveTotal.Domain.techCountry | String | The country of the domain tech. |
| PassiveTotal.Domain.techTelephone | String | The telephone number of the domain tech. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual DBot score. |
| PassiveTotal.Domain.score | Number | Reputation score of the indicator. |
| PassiveTotal.Domain.classification | String | Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN) |
| PassiveTotal.Domain.rules.name | String | Name of the rule that informed the reputation score of the indicator. |
| PassiveTotal.Domain.rules.description | String | Description of the rule. |
| PassiveTotal.Domain.rules.severity | Number | Severity of the rule. |
| PassiveTotal.Domain.rules.link | String | Link to the rule. |
Command Example
!domain domain=riskiq.com
Context Example
{
"DBotScore": [
{
"Indicator": "riskiq.com",
"Score": 0,
"Type": "domain",
"Vendor": "PassiveTotal"
}
],
"Domain": [
{
"Admin": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"CreationDate": "2006-01-11T16:00:00.000-0800",
"ExpirationDate": "2017-01-11T16:00:00.000-0800",
"Name": "riskiq.com",
"NameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"Organization": "RiskIQ, Inc.",
"Registrant": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"Registrar": {
"AbuseEmail": null,
"AbusePhone": null,
"Name": "GODADDY.COM, LLC"
},
"UpdatedDate": "2014-12-08T16:00:00.000-0800",
"WHOIS": {
"Admin": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"CreationDate": "2006-01-11T16:00:00.000-0800",
"ExpirationDate": "2017-01-11T16:00:00.000-0800",
"NameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"Registrant": {
"Country": "us",
"Email": "domains@riskiq.com",
"Name": "Risk IQ",
"Phone": "18884154447"
},
"Registrar": {
"AbuseEmail": null,
"AbusePhone": null,
"Name": "GODADDY.COM, LLC"
},
"UpdatedDate": "2014-12-08T16:00:00.000-0800"
}
}
],
"PassiveTotal": {
"Domain": {
"adminCity": "san francisco",
"adminCountry": "us",
"adminEmail": "domains@riskiq.com",
"adminName": "Risk IQ",
"adminOrganization": "RiskIQ, Inc.",
"adminPostalCode": "94111",
"adminState": "california",
"adminStreet": "22 Battery Street\n10th Floor",
"adminTelephone": "18884154447",
"contactEmail": "domains@riskiq.com",
"domain": "riskiq.com",
"expiresAt": "2017-01-11T16:00:00.000-0800",
"lastLoadedAt": "2016-09-27T09:40:31.180-0700",
"name": "Risk IQ",
"nameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"organization": "RiskIQ, Inc.",
"registered": "2006-01-11T16:00:00.000-0800",
"registrantCity": "san francisco",
"registrantCountry": "us",
"registrantEmail": "domains@riskiq.com",
"registrantName": "Risk IQ",
"registrantOrganization": "RiskIQ, Inc.",
"registrantPostalCode": "94111",
"registrantState": "california",
"registrantStreet": "22 Battery Street\n10th Floor",
"registrantTelephone": "18884154447",
"registrar": "GODADDY.COM, LLC",
"registryUpdatedAt": "2014-12-08T16:00:00.000-0800",
"techCity": "san francisco",
"techCountry": "us",
"techEmail": "domains@riskiq.com",
"techName": "Risk IQ",
"techOrganization": "RiskIQ, Inc.",
"techPostalCode": "94111",
"techState": "california",
"techStreet": "22 Battery Street\n10th Floor",
"techTelephone": "18884154447",
"telephone": "18884154447",
"whoisServer": "whois.godaddy.com",
"score": 3,
"classification": "UNKNOWN",
"rules": [
{
"name": "Open ports observed",
"description": "The number of open ports may indicate maliciousness",
"severity": 3
}
]
}
}
}
Human Readable Output
Domain(s)
|Domain|WHOIS Server|Registrar|Contact Email|Name Servers|Registrant|Admin|Tech|Creation Date (GMT)|Expire Date (GMT)|Updated Date (GMT)|Last Scanned (GMT)|
|—|—|—|—|—|—|—|—|—|—|—|—|
| riskiq.com | whois.godaddy.com | GODADDY.COM, LLC | domains@riskiq.com | luke.ns.cloudflare.com, serena.ns.cloudflare.com | City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447 | City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447 | City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447 | 2006-01-11T16:00:00.000-0800 | 2017-01-11T16:00:00.000-0800 | 2014-12-08T16:00:00.000-0800 | 2016-09-27T09:40:31.180-0700 |
The reputation score for ‘riskiq.com’ is 3 and is classified as ‘UNKNOWN’.
Reputation Rules
Name Description Severity Open ports observed The number of open ports may indicate maliciousness 3
pt-get-services
Retrieves exposed services on the recently open ports for an IP address.
Base Command
pt-get-services
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | IP address for which the user wants to search services for. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Service.ip | String | IP address of the service. |
| PassiveTotal.Service.portNumber | Number | Port number on which recent services were running or current services are running. |
| PassiveTotal.Service.firstSeen | Date | The date and time when the service was started for the first time on the port. |
| PassiveTotal.Service.lastSeen | Date | The date and time when the service was most recently used on the port. |
| PassiveTotal.Service.lastScan | Date | The date and time when the system performed the last scan to check whether any service is running on the port or not. |
| PassiveTotal.Service.count | Number | The total number of times service was used on the port. |
| PassiveTotal.Service.status | String | The status of the service. |
| PassiveTotal.Service.protocol | String | The protocol used by the service. |
| PassiveTotal.Service.banners.banner | String | The description of the banner generated as a result of scanning. Can be in HTML format. |
| PassiveTotal.Service.banners.scanType | String | The type of scan when the banner was generated. |
| PassiveTotal.Service.banners.firstSeen | Date | The date and time when the scan started. |
| PassiveTotal.Service.banners.lastSeen | Date | The date and time when the scan ended. |
| PassiveTotal.Service.banners.count | Number | The total number of times the same label was generated while scanning. |
| PassiveTotal.Service.currentServices.firstSeen | Date | The date and time when the current service started. |
| PassiveTotal.Service.currentServices.lastSeen | Date | The date and time when the current service was most recently used. |
| PassiveTotal.Service.currentServices.version | String | The version of the current service. |
| PassiveTotal.Service.currentServices.category | String | The category of the current service. |
| PassiveTotal.Service.currentServices.label | String | The label of the current service. |
| PassiveTotal.Service.recentServices.firstSeen | Date | The date and time when the recent service started. |
| PassiveTotal.Service.recentServices.lastSeen | Date | The date and time when the recent service was most recently used. |
| PassiveTotal.Service.recentServices.version | String | The version of the recent service. |
| PassiveTotal.Service.recentServices.category | String | The category of the recent service. |
| PassiveTotal.Service.recentServices.label | String | The label of the recent service. |
| PassiveTotal.Service.mostRecentSslCert.firstSeen | Date | The timestamp in epoch when the most recent SSL certificate was identified by the system. |
| PassiveTotal.Service.mostRecentSslCert.lastSeen | Date | The timestamp in epoch when the most recent SSL certificate was last used. |
| PassiveTotal.Service.mostRecentSslCert.fingerprint | String | A fingerprint detail from the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.sslVersion | String | The version of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.expirationDate | Date | The expiry date and time of the most recent SSL certificate in GMT. |
| PassiveTotal.Service.mostRecentSslCert.issueDate | Date | The date and time in GMT when the most recent SSL certificate was issued. |
| PassiveTotal.Service.mostRecentSslCert.sha1 | String | Sha1 of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.serialNumber | String | The serial Number of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectCountry | String | The name of the Country of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerCommonName | String | The common name of the issuer of most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerProvince | String | The province of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectStateOrProvinceName | String | The state or province name of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectStreetAddress | String | The street address of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerStateOrProvinceName | String | The state or province name of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectSurname | String | The surname of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerCountry | String | The country of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectLocalityName | String | The subject locality name of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectAlternativeNames | String | List of alternative names of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerOrganizationUnitName | String | The name organization unit of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerOrganizationName | String | The organization name of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectEmailAddress | String | Email Address of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectOrganizationName | String | The organization name of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerLocalityName | String | The name of the locality of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectCommonName | String | Common name of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectProvince | String | The province of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerGivenName | String | The given name of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectOrganizationUnitName | String | Subject organization unit name of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerEmailAddress | String | The email address of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectGivenName | String | Given name of the subject of the the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.subjectSerialNumber | String | The serial number of the subject of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerStreetAddress | String | The street Address of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerSerialNumber | String | The serial number of the issuer of the most recent SSL certificate. |
| PassiveTotal.Service.mostRecentSslCert.issuerSurname | String | The surname of the issuer of the most recent SSL certificate. |
Command Example
!pt-get-services ip=1.1.1.1
Context Example
{
"PassiveTotal": {
"Service": [
{
"count": 42335,
"currentServices": [
{
"label": "Other Service"
}
],
"firstSeen": "2018-03-28 12:04:21",
"ip": "1.1.1.1",
"lastScan": "2021-03-06 02:28:14",
"lastSeen": "2021-03-04 05:11:29",
"portNumber": 53,
"protocol": "UDP",
"status": "filtered"
},
{
"banners": [
{
"banner": "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>cloudflare</center>\r\n</body>\r\n</html>\r\n",
"count": 3,
"firstSeen": "2021-03-05 13:56:20",
"lastSeen": "2021-03-06 00:20:32",
"scanType": "http"
}
],
"count": 1386,
"currentServices": [
{
"category": "Server",
"firstSeen": "2019-06-18 13:45:42",
"label": "CloudFlare",
"lastSeen": "2021-03-10 07:58:44"
},
{
"category": "Server",
"firstSeen": "2020-07-09 16:19:47",
"label": "cloudflare",
"lastSeen": "2021-03-10 05:59:33"
},
{
"category": "Server",
"firstSeen": "2018-07-02 11:46:37",
"label": "yunjiasu-nginx",
"lastSeen": "2021-03-09 02:26:20"
}
],
"firstSeen": "2018-04-01 00:38:56",
"ip": "1.1.1.1",
"lastScan": "2021-03-06 13:27:15",
"lastSeen": "2021-03-06 00:20:32",
"portNumber": 80,
"protocol": "TCP",
"recentServices": [
{
"category": "Server",
"firstSeen": "2020-03-18 20:37:06",
"label": "BigIP",
"lastSeen": "2021-03-05 21:31:27"
},
{
"category": "Server",
"firstSeen": "2020-06-11 11:50:49",
"label": "F5 BIG-IP load balancer httpd",
"lastSeen": "2021-03-05 21:31:27"
},
{
"category": "Server",
"firstSeen": "2020-10-27 12:39:22",
"label": "OpenResty web app server",
"lastSeen": "2021-02-27 19:59:14"
},
{
"category": "Server",
"firstSeen": "2019-02-09 11:59:43",
"label": "openresty",
"lastSeen": "2021-02-27 19:59:14"
},
{
"category": "Server",
"firstSeen": "2018-08-05 00:56:16",
"label": "Apache",
"lastSeen": "2020-11-09 07:02:20"
}
],
"status": "open"
},
{
"count": 41,
"currentServices": [
{
"label": "Other Service"
}
],
"firstSeen": "2020-02-29 04:02:09",
"ip": "1.1.1.1",
"lastScan": "2021-03-06 06:51:11",
"lastSeen": "2021-02-27 16:00:28",
"portNumber": 111,
"protocol": "UDP",
"status": "closed"
}
]
}
}
Human Readable Output
Total Retrieved Record(s) 13
Services
Port Number Protocol Status Current Service Labels First Seen Date (GMT) Last Seen Date (GMT) Last Scanned Date (GMT) 53 UDP filtered Other Service 2018-03-28 12:04:21 2021-03-04 05:11:29 2021-03-06 02:28:14 80 TCP open CloudFlare, cloudflare, yunjiasu-nginx 2018-04-01 00:38:56 2021-03-06 00:20:32 2021-03-06 13:27:15 111 UDP closed Other Service 2020-02-29 04:02:09 2021-02-27 16:00:28 2021-03-06 06:51:11
pt-get-whois
Gets WHOIS information records based on queries.
Base Command
pt-get-whois
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Query value to use in the request. For example: riskiq.com, 1.1.1.1 | Required |
| history | Whether to return historical results. Valid values: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.WHOIS.domain | String | The domain name. For example: ‘google.com’. |
| PassiveTotal.WHOIS.registrar | String | The name of the registrar of the domain. |
| PassiveTotal.WHOIS.whoisServer | String | WHOIS server name where the details of domain registrations belong. |
| PassiveTotal.WHOIS.registered | Date | The date that the domain was registered. |
| PassiveTotal.WHOIS.expiresAt | Date | The expiration date of the domain. |
| PassiveTotal.WHOIS.registryUpdatedAt | Date | The date when the registry was last updated. |
| PassiveTotal.WHOIS.lastLoadedAt | Date | Last loaded date of WHOIS database. |
| PassiveTotal.WHOIS.nameServers | String | Name servers of the domain. |
| PassiveTotal.WHOIS.organization | String | The organization of the domain. |
| PassiveTotal.WHOIS.name | String | Name of the domain. |
| PassiveTotal.WHOIS.telephone | String | Telephone number fetched from whois details of the domain. |
| PassiveTotal.WHOIS.contactEmail | String | Contact Email address of the domain owner. |
| PassiveTotal.WHOIS.registrantEmail | String | The name of the domain registrant. |
| PassiveTotal.WHOIS.registrantFax | String | The fax number of the domain registrant. |
| PassiveTotal.WHOIS.registrantName | String | The name of the domain registrant. |
| PassiveTotal.WHOIS.registrantOrganization | String | The organizations of the domain registrant. |
| PassiveTotal.WHOIS.registrantStreet | String | The street of the domain registrant. |
| PassiveTotal.WHOIS.registrantCity | String | The city of the domain registrant. |
| PassiveTotal.WHOIS.registrantState | String | The state of the domain registrant. |
| PassiveTotal.WHOIS.registrantPostalCode | String | The postal code of the domain registrant. |
| PassiveTotal.WHOIS.registrantCountry | String | The country of the domain registrant. |
| PassiveTotal.WHOIS.registrantTelephone | String | The telephone number of the domain registrant. |
| PassiveTotal.WHOIS.adminEmail | String | The email address of the domain administrator. |
| PassiveTotal.WHOIS.adminFax | String | The fax number of the domain administrator. |
| PassiveTotal.WHOIS.adminName | String | The name of the domain administrator. |
| PassiveTotal.WHOIS.adminOrganization | String | The organizations of the domain administrator. |
| PassiveTotal.WHOIS.adminStreet | String | The street of the domain administrator. |
| PassiveTotal.WHOIS.adminCity | String | The city of the domain administrator. |
| PassiveTotal.WHOIS.adminState | String | The state of the domain administrator. |
| PassiveTotal.WHOIS.adminPostalCode | String | The postal code of the domain administrator. |
| PassiveTotal.WHOIS.adminCountry | String | The country of the domain administrator. |
| PassiveTotal.WHOIS.adminTelephone | String | The telephone number of the domain administrator. |
| PassiveTotal.WHOIS.billingEmail | String | The email address of the domain billing. |
| PassiveTotal.WHOIS.billingFax | String | The fax number of the domain billing. |
| PassiveTotal.WHOIS.billingName | String | The name of the domain billing. |
| PassiveTotal.WHOIS.billingOrganization | String | The organizations of the domain billing. |
| PassiveTotal.WHOIS.billingStreet | String | The street of the domain billing. |
| PassiveTotal.WHOIS.billingCity | String | The city of the domain billing. |
| PassiveTotal.WHOIS.billingState | String | The state of the domain billing. |
| PassiveTotal.WHOIS.billingPostalCode | String | The postal code of the domain billing. |
| PassiveTotal.WHOIS.billingCountry | String | The country of the domain billing. |
| PassiveTotal.WHOIS.billingTelephone | String | The telephone number of the domain billing. |
| PassiveTotal.WHOIS.techEmail | String | The email address of the domain tech. |
| PassiveTotal.WHOIS.techFax | String | The fax number of the domain tech. |
| PassiveTotal.WHOIS.techName | String | The name of the domain tech. |
| PassiveTotal.WHOIS.techOrganization | String | The organizations of domain tech. |
| PassiveTotal.WHOIS.techStreet | String | The street of the domain tech. |
| PassiveTotal.WHOIS.techCity | String | The city of the domain tech. |
| PassiveTotal.WHOIS.techState | String | The state of the domain tech. |
| PassiveTotal.WHOIS.techPostalCode | String | The postal code of the domain tech. |
| PassiveTotal.WHOIS.techCountry | String | The country of the domain tech. |
| PassiveTotal.WHOIS.techTelephone | String | The telephone number of the domain tech. |
Command Example
!pt-get-whois query=riskiq.com
Context Example
{
"PassiveTotal": {
"WHOIS": {
"adminCity": "san francisco",
"adminCountry": "us",
"adminEmail": "domains@riskiq.com",
"adminName": "Risk IQ",
"adminOrganization": "RiskIQ, Inc.",
"adminPostalCode": "94111",
"adminState": "california",
"adminStreet": "22 Battery Street\n10th Floor",
"adminTelephone": "18884154447",
"contactEmail": "domains@riskiq.com",
"domain": "riskiq.com",
"expiresAt": "2017-01-11T16:00:00.000-0800",
"lastLoadedAt": "2016-09-27T09:40:31.180-0700",
"name": "Risk IQ",
"nameServers": [
"luke.ns.cloudflare.com",
"serena.ns.cloudflare.com"
],
"organization": "RiskIQ, Inc.",
"registered": "2006-01-11T16:00:00.000-0800",
"registrantCity": "san francisco",
"registrantCountry": "us",
"registrantEmail": "domains@riskiq.com",
"registrantName": "Risk IQ",
"registrantOrganization": "RiskIQ, Inc.",
"registrantPostalCode": "94111",
"registrantState": "california",
"registrantStreet": "22 Battery Street\n10th Floor",
"registrantTelephone": "18884154447",
"registrar": "GODADDY.COM, LLC",
"registryUpdatedAt": "2014-12-08T16:00:00.000-0800",
"techCity": "san francisco",
"techCountry": "us",
"techEmail": "domains@riskiq.com",
"techName": "Risk IQ",
"techOrganization": "RiskIQ, Inc.",
"techPostalCode": "94111",
"techState": "california",
"techStreet": "22 Battery Street\n10th Floor",
"techTelephone": "18884154447",
"telephone": "18884154447",
"whoisServer": "whois.godaddy.com"
}
}
}
Human Readable Output
Total Retrieved Record(s): 1
Associated Domains
Domain WHOIS Server Registrar Contact Email Name Servers Registrant Admin Tech Creation Date (GMT) Expire Date (GMT) Updated Date (GMT) Last Scanned (GMT) riskiq.com whois.godaddy.com GODADDY.COM, LLC domains@riskiq.com luke.ns.cloudflare.com, serena.ns.cloudflare.com City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 18884154447City: san francisco,
Country: us,
Email: domains@riskiq.com,
Name: Risk IQ,
Organization: RiskIQ, Inc.,
PostalCode: 94111,
State: california,
Street: 22 Battery Street
10th Floor,
Telephone: 188841544472006-01-11T16:00:00.000-0800 2017-01-11T16:00:00.000-0800 2014-12-08T16:00:00.000-0800 2016-09-27T09:40:31.180-0700
pt-get-cookies
Retrieves cookies addresses or hostname information based on cookie name or domain.
Base Command
pt-get-cookies
Input
| Argument Name | Description | Required |
|---|---|---|
| search_by | Search cookies information by name or domain. Valid values: 1. get addresses by cookie domain, 2. get addresses by cookie name, 3. get hosts by cookie domain, 4. get hosts by cookie name. | Required |
| query | Name or domain of cookie the user wants to search for. | Required |
| page | Page number for paging through results. Each page contains 2000 values. Default is 0. | Optional |
| sort | Field to sort the results on. Valid values: last seen, first seen. Default is last seen. | Optional |
| order | Order to return the results in. Valid values: asc, desc. Default is desc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Cookie.hostname | String | The hostname/IP of the machine on which the cookie was found. |
| PassiveTotal.Cookie.cookieName | String | The name of the cookie that was found on the host. |
| PassiveTotal.Cookie.cookieDomain | String | The domain from which the cookie originated from. |
| PassiveTotal.Cookie.firstSeen | Date | The date and time when the cookie was first observed. |
| PassiveTotal.Cookie.lastSeen | Date | The date and time when the cookie was most recently observed. |
Command Example
!pt-get-cookies search_by="get hosts by cookie name" query=dummyCookie
Context Example
{
"PassiveTotal": {
"Cookie": [
{
"cookieDomain": "dummy.domain",
"cookieName": "dummyCookie",
"firstSeen": "2016-11-22 03:36:07",
"hostname": "dummy.domain",
"lastSeen": "2017-07-27 21:05:10"
}
]
}
}
Human Readable Output
Total Record(s): 1
Total Retrieved Record(s): 1
Cookies
Hostname Cookie Name Cookie Domain First Seen Date (GMT) Last Seen Date (GMT) dummy.domain dummyCookie dummy.domain 2019-04-02 01:53:50 2021-01-22 07:15:13
pt-get-articles
Retrieves information related to articles for a specific indicator.
Base Command
pt-get-articles
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Indicator value to search for in articles. For example: riskiq.com, 1.1.1.1 | Required |
| type | Type of the indicator. For example: domain, ip, url | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Article.guid | String | The global unique ID of the article. |
| PassiveTotal.Article.title | String | The title of the article. |
| PassiveTotal.Article.summary | String | The summary of the article. |
| PassiveTotal.Article.type | String | The type of an article. |
| PassiveTotal.Article.publishedDate | Date | The date and time on which the article was published. |
| PassiveTotal.Article.link | String | The link of the article for getting more details. |
| PassiveTotal.Article.categories | Unknown | An array of categories of the article. |
| PassiveTotal.Article.tags | Unknown | An array of tags for the article. |
| PassiveTotal.Article.indicators.type | String | The type of the indicator. |
| PassiveTotal.Article.indicators.count | Number | Total number of indicators of a particular type. |
| PassiveTotal.Article.indicators.values | Unknown | An array of values related to indicators. |
| PassiveTotal.Article.indicators.source | String | The source of the indicator. |
Command Example
!pt-get-articles query=dummy.com
Context Example
{
"PassiveTotal": {
"Article": {
"categories": [
"Categories 1",
"Categories 2"
],
"guid": "12e123b1",
"indicators": [
{
"count": 1,
"source": "public",
"type": "domain",
"values": [
"dummy.com"
]
}
],
"link": "https://community.riskiq.com/article/12e123b1",
"publishedDate": "Mon Aug 29 20:00:00 VET 2016",
"summary": "Did you know that you can get all kinds of free stuff, just by giving out your personal information? The internet is full of these fake reward scams which RiskIQ's sytems surface every hour of the day.",
"tags": [
"fake rewards",
"playstation",
"scam"
],
"title": "Free PlayStations on the Internet are Probably an Online Scam",
"type": "public"
}
}
}
Human Readable Output
Total Retrieved Record(s): 1
Article(s)
GUID Title Summary Type Tags Categories Article Link Published Date (GMT) 12e123b1 Free PlayStations on the Internet are Probably an Online Scam Did you know that you can get all kinds of free stuff, just by giving out your personal information? The internet is full of these fake reward scams which RiskIQ’s sytems surface every hour of the day. public fake rewards, playstation, scam Categories 1, Categories 2 https://community.riskiq.com/article/12e123b1 Mon Aug 29 20:00:00 VET 2016
pt-get-data-card
Retrieves a summary data card associated with the given query.
Base Command
pt-get-data-card
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The domain, host or IP address to be queried. For example: riskiq.com, 1.1.1.1. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.DataCard.type | String | Type of the indicator. |
| PassiveTotal.DataCard.name | String | Name of the indicator. |
| PassiveTotal.DataCard.link | String | Link to the indicator. |
| PassiveTotal.DataCard.netblock | String | Netblock associated with the indicator. |
| PassiveTotal.DataCard.os | String | Operating system associated with the indicator. |
| PassiveTotal.DataCard.organization | String | The organization of the indicator. |
| PassiveTotal.DataCard.asn | String | Autonomous system number assigned to the indicator. |
| PassiveTotal.DataCard.hosting_provider | String | Host provider of the indicator. |
| PassiveTotal.DataCard.data_summary.resolutions.count | Number | Number of resolutions attached to the indicator. |
| PassiveTotal.DataCard.data_summary.resolutions.link | String | Link of the resolutions attached to the indicator. |
| PassiveTotal.DataCard.data_summary.services.count | Number | Number of service records for the indicator. |
| PassiveTotal.DataCard.data_summary.services.link | String | Link to the service records of the indicator. |
| PassiveTotal.DataCard.data_summary.certificates.count | Number | Number of certificates for the given indicator. |
| PassiveTotal.DataCard.data_summary.certificates.link | String | Link to the certificates associated with the indicator. |
| PassiveTotal.DataCard.data_summary.hashes.count | Number | Number of hashes associated with the indicator. |
| PassiveTotal.DataCard.data_summary.hashes.link | String | Link to the hashes associated with the indicator. |
| PassiveTotal.DataCard.data_summary.projects.count | Number | Number of projects containing the indicator. |
| PassiveTotal.DataCard.data_summary.projects.link | String | Number of projects containing the indicator. |
| PassiveTotal.DataCard.data_summary.articles.count | Number | Number of articles referencing the indicator. |
| PassiveTotal.DataCard.data_summary.articles.link | String | Link to the articles referencing the indicator. |
| PassiveTotal.DataCard.data_summary.trackers.count | Number | Number of trackers associated with the indicator. |
| PassiveTotal.DataCard.data_summary.trackers.link | String | Link to the trackers associated with the indicator. |
| PassiveTotal.DataCard.data_summary.components.count | Number | Number of components associated with the indicator. |
| PassiveTotal.DataCard.data_summary.components.link | String | Link to the components associated with the indicator. |
| PassiveTotal.DataCard.data_summary.host_pairs.count | Number | Number of host pairs associated with the indicator. |
| PassiveTotal.DataCard.data_summary.host_pairs.link | String | Link to the host pairs associated with the indicator. |
| PassiveTotal.DataCard.data_summary.reverse_dns.count | Number | Number of DNS records for the indicator. |
| PassiveTotal.DataCard.data_summary.reverse_dns.link | String | Link to the DNS records of the indicator. |
| PassiveTotal.DataCard.data_summary.cookies.count | Number | Number of available cookie records for the indicator. |
| PassiveTotal.DataCard.data_summary.cookies.link | String | Link to the cookie records for the indicator. |
Command Example
!pt-get-data-card query="1.1.1.1"
Context Example
{
"PassiveTotal": {
"DataCard": {
"asn": "AS13335 - CLOUDFLARENET",
"data_summary": {
"articles": {
"count": 0,
"link": "https://community.pt.com/research/1.1.1.1"
},
"certificates": {
"count": 3742,
"link": "https://community.pt.com/search/1.1.1.1/domaincertificates"
},
"components": {
"count": 914,
"link": "https://community.pt.com/search/1.1.1.1/components"
},
"cookies": {
"count": 23346,
"link": "https://community.pt.com/search/1.1.1.1/cookies"
},
"hashes": {
"count": 1000,
"link": "https://community.pt.com/search/1.1.1.1/hashes"
},
"host_pairs": {
"count": 6987,
"link": "https://community.pt.com/search/1.1.1.1/hostpairs"
},
"projects": {
"count": 4,
"link": "https://community.pt.com/search/1.1.1.1/projects"
},
"resolutions": {
"count": 1997,
"link": "https://community.pt.com/search/1.1.1.1/resolutions"
},
"reverse_dns": {
"count": 5,
"link": "https://community.pt.com/search/1.1.1.1/dns"
},
"services": {
"count": 3,
"link": "https://community.pt.com/search/1.1.1.1/services"
},
"trackers": {
"count": 3983,
"link": "https://community.pt.com/search/1.1.1.1/trackers"
}
},
"hosting_provider": "Cloudflare",
"link": "https://community.pt.com/search/1.1.1.1",
"name": "1.1.1.1",
"netblock": "1.1.1.0/24",
"organization": "Cloudflare, Inc.",
"os": "CentOS",
"type": "IP Address"
}
}
}
Human Readable Output
Data Card Summary
Name Type Netblock Autonomous System Number Host Provider Operating System Data Card Summary 1.1.1.1 IP Address 1.1.1.0/24 AS13335 - CLOUDFLARENET Cloudflare CentOS Resolutions: 1997, Services: 3, Certificates: 3742, Hashes: 1000, Projects: 4, Articles: 0, Trackers: 3983, Components: 914, Host Pairs: 6987, Reverse Dns: 5, Cookies: 23346
pt-get-reputation
Gets reputation for a given domain, host or IP.
Base Command
pt-get-reputation
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The domain, host or IP address to be queried. For example: riskiq.com, 1.1.1.1. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Reputation.query | String | The value of the indicator. |
| PassiveTotal.Reputation.score | Number | Reputation score of the indicator. |
| PassiveTotal.Reputation.classification | String | Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN) |
| PassiveTotal.Reputation.rules.name | String | Name of the rule that informed the reputation score of the indicator. |
| PassiveTotal.Reputation.rules.description | String | Description of the rule. |
| PassiveTotal.Reputation.rules.severity | Number | Severity of the rule. |
| PassiveTotal.Reputation.rules.link | String | Link to the rule. |
Command Example
!pt-get-reputation query="amazon.hksupd.com"
Context Example
{
"PassiveTotal": {
"Reputation": {
"classification": "MALICIOUS",
"query": "amazon.hksupd.com",
"rules": [
{
"description": "Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike",
"link": "https://community.pt.com/article/d0bf5d18",
"name": "RiskIQ Intel Article",
"severity": 5
}
],
"score": 100
}
}
}
Human Readable Output
The reputation score for ‘amazon.hksupd.com’ is 100 and is classified as ‘MALICIOUS’.
Reputation Rules
Name Description Severity RiskIQ Intel Article Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike 5
ip
Checks the reputation of an IP address.
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | The IP address to check. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.IP.query | String | The value of the indicator. |
| PassiveTotal.IP.score | Number | Reputation score of the indicator. |
| PassiveTotal.IP.classification | String | Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN) |
| PassiveTotal.IP.rules.name | String | Name of the rule that informed the reputation score of the indicator. |
| PassiveTotal.IP.rules.description | String | Description of the rule. |
| PassiveTotal.IP.rules.severity | Number | Severity of the rule. |
| PassiveTotal.IP.rules.link | String | Link to the rule. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| IP.Address | String | The IP Address. |
Command Example
!ip ip=8.8.8.8
Context Example
{
"DBotScore": {
"Indicator": "8.8.8.8",
"Score": 0,
"Type": "ip",
"Vendor": "PassiveTotal v2"
},
"IP": {
"Address": "8.8.8.8"
},
"PassiveTotal": {
"IP": {
"classification": "UNKNOWN",
"query": "8.8.8.8",
"rules": [
{
"description": "The number of open ports may indicate maliciousness",
"name": "Open ports observed",
"severity": 3
}
],
"score": 3
}
}
}
Human Readable Output
The reputation score for ‘8.8.8.8’ is 3 and is classified as ‘UNKNOWN’.
Reputation Rules
Name Description Severity Open ports observed The number of open ports may indicate maliciousness 3
pt-list-intel-profiles
Retrieves the list of all profiles.
Base Command
pt-list-intel-profiles
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the ID of the profile to retrieve the specific profile. Note: If ‘id’ argument is provided, all other arguments will be neglected. |
Optional |
| query | Filter the result based on title or aliases. . | Optional |
| type | Filter the results based on the profile type. Possible values: actor, tool, backdoor. |
Optional |
| indicator_value | Specify the indicator value to retrieve the profiles containing the given indicator. Note: To retrieve the list of indicators, execute the “pt-list-intel-profile-indicators” command. When both indicator_value and query are provided, higher priority will be given to indicator_value. |
Optional |
| source | Filter the result based on the indicator source. Possible values: osint, riskiq. Note: Requires ‘indicator_value’ argument. |
Optional |
| category | Filter the result based on the indicator category. Possible values: host, network. Note: Requires ‘indicator_value’ argument. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.IntelProfile.id | String | ID of the intel profile. |
| PassiveTotal.IntelProfile.title | String | Title of the intel profile. |
| PassiveTotal.IntelProfile.link | String | Link to the intel profile. |
| PassiveTotal.IntelProfile.osintIndicatorsCount | Number | Count of the open source intelligence indicators referencing the intel profile. |
| PassiveTotal.IntelProfile.riskIqIndicatorsCount | Number | Count of the riskiq indicators referencing the intel profile. |
| PassiveTotal.IntelProfile.indicators | String | Link to the indicators referencing the intel profile. |
| PassiveTotal.IntelProfile.aliases | String | Aliases of the intel profile. |
| PassiveTotal.IntelProfile.tags.label | String | Labels associated with the intel profile. |
| PassiveTotal.IntelProfile.tags.countryCode | String | Country code of the tags associated with the intel profile. |
Command Example
!pt-list-intel-profiles id="apt33"
Context Example
{
"PassiveTotal": {
"IntelProfile": {
"aliases": [
"Elfin",
"Magnallium",
"Refined Kitten",
"Holmium",
"Cobalt Trinity"
],
"id": "apt33",
"indicators": "https://api.pt.net/pt/v2/intel-profiles/apt33/indicators",
"link": "https://community.pt.com/intel-profiles/apt33",
"osintIndicatorsCount": 410,
"riskIqIndicatorsCount": 122,
"tags": [
{
"label": "Espionage"
},
{
"label": "Sabotage"
},
{
"label": "Windows"
},
{
"label": "Aviation"
},
{
"label": "Defense"
},
{
"label": "Oil & Gas"
},
{
"countryCode": "ir",
"label": "State Sponsored: Iran"
},
{
"countryCode": "sa",
"label": "Target: Saudi Arabia"
},
{
"countryCode": "us",
"label": "Target: USA"
},
{
"countryCode": "kr",
"label": "Target: South Korea"
},
{
"countryCode": "il",
"label": "Target: Israel"
}
],
"title": "APT33"
}
}
}
Human Readable Output
Profile(s)
ID Title Aliases Public Indicators RiskIQ Indicators apt33 APT33 Elfin, Magnallium, Refined Kitten, Holmium, Cobalt Trinity 410 122
pt-list-intel-profile-indicators
Retrieves the indicators for the given profile.
Base Command
pt-list-intel-profile-indicators
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the ID of the profile to retrieve indicators for the specific profile. Note: To retrieve the list of profile IDs, execute the “pt-list-intel-profile” command. |
Required |
| type | Filter the results based on the indicator type. Possible values: certificate_sha1, domain, email, hash_md5, hash_sha256, ip, pdb_path, soa_email, url, whois_email. |
Optional |
| indicator_value | Specify the indicator value to retrieve the specific indicator. | Optional |
| source | Filter the result based on the indicator source. Possible values: osint, riskiq. |
Optional |
| category | Filter the result based on the indicator category. Possible values: host, network. |
Optional |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.IntelProfile.id | String | Profile ID containing the indicator. |
| PassiveTotal.IntelProfile.indicator.id | String | ID of the indicator. |
| PassiveTotal.IntelProfile.indicator.type | String | Type of the indicator. |
| PassiveTotal.IntelProfile.indicator.value | String | Value of the indicator. |
| PassiveTotal.IntelProfile.indicator.category | String | Category of the indicator. |
| PassiveTotal.IntelProfile.indicator.firstSeen | String | Date & time the record was first seen. |
| PassiveTotal.IntelProfile.indicator.lastSeen | String | Date & time the record was most recently observed. |
| PassiveTotal.IntelProfile.indicator.osint | String | Whether the indicator was published in open source intelligence articles. |
| PassiveTotal.IntelProfile.indicator.osintUrl | String | Link to the osint source of the indicator. |
| PassiveTotal.IntelProfile.indicator.articleGuids | String | List of RiskIQ OSINT article GUIDs associated with the indicator. |
Command Example
!pt-list-intel-profile-indicators id="apt33" page_size=1
Context Example
{
"PassiveTotal": {
"IntelProfile": {
"id": "apt33",
"indicator": [
{
"articleGuids": [
"633605c6"
],
"category": "host",
"firstSeen": "2017-03-06T00:00:00.000+00:00",
"id": "apt33:00c417425a73db5a315d23fac8cb353f",
"osint": true,
"type": "hash_md5",
"value": "00c417425a73db5a315d23fac8cb353f",
"lastSeen": "2017-03-06T00:00:00.000+00:00"
}
]
}
}
}
Human Readable Output
Total Retrieved Indicator(s) 532
Indicator(s)
ID Artifact Value Type First Seen (GMT) Last Seen (GMT) Source apt33:00c417425a73db5a315d23fac8cb353f 00c417425a73db5a315d23fac8cb353f hash_md5 2017-03-06T00:00:00.000+00:00 2017-03-06T00:00:00.000+00:00 OSINT
pt-list-my-attack-surface-insights
Retrieves the attack surface insight information of the individual’s account.
Base Command
pt-list-my-attack-surface-insights
Input
| Argument Name | Description | Required |
|---|---|---|
| priority | Filter the results based on the priority level specified. Possible values: high, medium, low. |
Required |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Summary.Insight.name | String | The command name. |
| PassiveTotal.Summary.Insight.activeInsightCount | Number | Total number of active insights. |
| PassiveTotal.Summary.Insight.totalInsightCount | Number | Total number of insights. |
| PassiveTotal.Summary.Insight.totalObservations | Number | Total number of observations. |
| PassiveTotal.Insight.priorityLevel | String | Priority level of insights. |
| PassiveTotal.Insight.insight.name | String | Name of the insight. |
| PassiveTotal.Insight.insight.description | String | Description of the insight. |
| PassiveTotal.Insight.insight.observationCount | Number | Number of observations for the given insight. |
| PassiveTotal.Insight.insight.link | String | Link to the insight. |
| PassiveTotal.Insight.insight.insightId | String | ID of the third party insight. |
| PassiveTotal.Insight.insight.segmentBy | String | Segment by of the insight. |
Command Example
!pt-list-my-attack-surface-insights priority="low"
Context Example
{
"PassiveTotal": {
"Insight": {
"insight": [
{
"description": "##### Description \nThe following SSL certificates are SHA-1 certificates and are no longer recognized by web browsers due to possible hash collision.\n\n##### Remediation\nOrganizations should replace these certificates with new SSL certificate that use SHA-256.",
"insightId": "40466",
"link": "https://api.pt.net/pt/v2/attack-surface/insight/40466?page=0&size=25&groupBy=RISK_CATEGORY&segmentBy=savedfilter_metric_29630",
"name": "ASI: SHA-1 Certificates",
"observationCount": 0,
"segmentBy": "savedfilter_metric_29630"
},
{
"description": "##### Description \nDeprecated versions of Nginx web server that are no longer supported. Running end of life or deprecated hardware or software can open organizations up to potential risks and vulnerabilities as these systems are no longer supported via regular updates and security patches\n\n##### Remediation\nOrganizations should consider upgrading to supported versions of Nginx to ensure security patches are available.\n",
"insightId": "40466",
"link": "https://api.pt.net/pt/v2/attack-surface/insight/40466?page=0&size=25&groupBy=RISK_CATEGORY&segmentBy=savedfilter_metric_29643",
"name": "ASI: Deprecated Tech - Nginx",
"observationCount": 146,
"segmentBy": "savedfilter_metric_29643"
}
],
"priorityLevel": "low"
},
"Summary": {
"Insight": {
"activeInsightCount": 6,
"name": "pt-list-my-attack-surface-insights",
"totalInsightCount": 11,
"totalObservations": 165
}
}
}
}
Human Readable Output
Low Severity Insights
6 Active of 11 Insights - 165 Observations
Name Description Observations Insight ID Segment By ASI: Deprecated Tech - Nginx ##### Description
Deprecated versions of Nginx web server that are no longer supported. Running end of life or deprecated hardware or software can open organizations up to potential risks and vulnerabilities as these systems are no longer supported via regular updates and security patches
##### Remediation
Organizations should consider upgrading to supported versions of Nginx to ensure security patches are available.146 40466 savedfilter_metric_29643 ASI: SSL Certificates Expiring in 30 Days ##### Description
The following SSL Certificates expire within the next 30 days. Expired certificates can lead to critical business functions being unavailable to customers or employees. Expired certificates could prevent customers from accessing your website and negatively impact an organization’s brand.
##### Remediation
Organizations should review these certificates and ensure appropriate policies and procedures are in place to keep SSL certificates up to date.13 40466 savedfilter_metric_29632
pt-list-my-attack-surfaces
Retrieves the attack surface information of the individual’s account.
Base Command
pt-list-my-attack-surfaces
Input
| Argument Name | Description | Required |
|---|---|---|
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.AttackSurface.id | Number | ID of the attack surface. |
| PassiveTotal.AttackSurface.name | String | Name of the attack surface. |
| PassiveTotal.AttackSurface.priority.high.observationCount | Number | Total observations of high priority attack surface. |
| PassiveTotal.AttackSurface.priority.high.link | String | Link to the high priority attack surface. |
| PassiveTotal.AttackSurface.priority.medium.observationCount | Number | Total observations of medium priority attack surface. |
| PassiveTotal.AttackSurface.priority.medium.link | String | Link to the medium priority attack surface. |
| PassiveTotal.AttackSurface.priority.low.observationCount | Number | Total observations of low priority attack surface. |
| PassiveTotal.AttackSurface.priority.low.link | String | Link to the low priority attack surface. |
Command Example
#### Context Example
```json
{
"PassiveTotal": {
"AttackSurface": {
"id": 88256,
"name": "RiskIQ, Inc.",
"priority": {
"high": {
"link": "https://api.pt.net/pt/v2/attack-surface/priority/high",
"observationCount": 13
},
"low": {
"link": "https://api.pt.net/pt/v2/attack-surface/priority/low",
"observationCount": 165
},
"medium": {
"link": "https://api.pt.net/pt/v2/attack-surface/priority/medium",
"observationCount": 4
}
}
}
}
}
Human Readable Output
Attack Surface(s)
ID Name High Severity Medium Severity Low Severity 88256 RiskIQ, Inc. 13 observations 4 observations 165 observations
pt-list-third-party-attack-surface
Retrieves the attack surface observations by severity level for the given third-party account.
Base Command
pt-list-third-party-attack-surface
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the vendor ID to retrieve the attack surface third party information. | Optional |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.ThirdParty.id | Number | ID of the vendor. |
| PassiveTotal.ThirdParty.name | String | Name of the vendor. |
| PassiveTotal.ThirdParty.priority.high.observationCount | Number | Total observations of high priority attack surface. |
| PassiveTotal.ThirdParty.priority.high.link | String | Link to the high priority attack surface. |
| PassiveTotal.ThirdParty.priority.medium.observationCount | Number | Total observations of medium priority attack surface. |
| PassiveTotal.ThirdParty.priority.medium.link | String | Link to the medium priority attack surface. |
| PassiveTotal.ThirdParty.priority.low.observationCount | Number | Total observations of low priority attack surface. |
| PassiveTotal.ThirdParty.priority.low.link | String | Link to the low priority attack surface. |
| PassiveTotal.Summary.ThirdPartyASI.name | String | The command name. |
| PassiveTotal.Summary.ThirdPartyASI.totalCount | Number | Total number of attack surfaces. |
| PassiveTotal.Summary.ThirdPartyASI.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.ThirdPartyASI.nextPage | String | Link to the next page. |
Command Example
#### Context Example
```json
{
"PassiveTotal": {
"Summary": {
"ThirdPartyASI": {
"name": "pt-list-third-party-attack-surface",
"totalCount": 2,
"totalPages": 1
}
},
"ThirdParty": [
{
"id": 45998,
"name": "Mitsubishi Corporation",
"priority": {
"high": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/45998/priority/high",
"observationCount": 3
},
"low": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/45998/priority/low",
"observationCount": 92
},
"medium": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/45998/priority/medium",
"observationCount": 35
}
}
},
{
"id": 371662,
"name": "Aeroflot-Russian Airlines",
"priority": {
"high": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/371662/priority/high",
"observationCount": 7
},
"low": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/371662/priority/low",
"observationCount": 16
},
"medium": {
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/371662/priority/medium",
"observationCount": 8
}
}
}
]
}
}
Human Readable Output
Attack Surface(s)
ID Name High Severity Medium Severity Low Severity 45998 Mitsubishi Corporation 3 observations 35 observations 92 observations 371662 Aeroflot-Russian Airlines 7 observations 8 observations 16 observations
pt-list-third-party-attack-surface-insights
Retrieves the attack surface insight information of the given third-party account.
Base Command
pt-list-third-party-attack-surface-insights
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the vendor ID to retrieve the third-party insights information. Note: To retrieve the list of vendor IDs, execute the “pt-list-third-party-attack-surface” command. |
Required |
| priority | Filter the results based on the priority level specified. Possible values: high, medium, low. |
Required |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Summary.ThirdPartyInsight.activeInsightCount | Number | Total number of active third party insights. |
| PassiveTotal.Summary.ThirdPartyInsight.totalInsightCount | Number | Total number of third party insights. |
| PassiveTotal.Summary.ThirdPartyInsight.totalObservations | Number | Total number of third party observations. |
| PassiveTotal.ThirdParty.id | Number | Vendor ID associated with the third party insights. |
| PassiveTotal.ThirdParty.priorityLevel | String | Priority level of third party insights. |
| PassiveTotal.ThirdParty.Insight.insight.name | String | Name of the third party insight. |
| PassiveTotal.ThirdParty.Insight.insight.description | String | Description of the third party insight. |
| PassiveTotal.ThirdParty.Insight.insight.observationCount | Number | Number of observations for the given third party insight. |
| PassiveTotal.ThirdParty.Insight.insight.link | String | Link to the third party insight. |
| PassiveTotal.ThirdParty.Insight.insight.insightId | String | ID of the third party insight. |
| PassiveTotal.ThirdParty.Insight.insight.segmentBy | String | Segment by of the third party insight. |
| PassiveTotal.Summary.ThirdPartyInsight.name | String | The command name. |
Command Example
!pt-list-third-party-attack-surface-insights id="45998" priority="low"
Context Example
{
"PassiveTotal": {
"Summary": {
"ThirdPartyInsight": {
"activeInsightCount": 9,
"name": "pt-list-third-party-attack-surface-insights",
"totalInsightCount": 11,
"totalObservations": 92
}
},
"ThirdParty": {
"Insight": {
"insight": [
{
"description": "Root page assets with any CVSS/CVSS v3 score. ",
"insightId": "40466",
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/45998/insight/40466?page=0&size=25&groupBy=RISK_CATEGORY&segmentBy=savedfilter_metric_15881",
"name": "Affected CVSS Page",
"observationCount": 0,
"segmentBy": "savedfilter_metric_15881"
},
{
"description": "##### Description \nDeprecated versions of Apache server that are no longer supported. Running end of life or deprecated software can open organizations up to potential risks and vulnerabilities as these systems are no longer supported via regular updates and security patches.\n\n##### Remediation\nOrganizations should consider upgrading to supported versions of Apache to ensure security patches are available.",
"insightId": "40466",
"link": "https://api.pt.net/pt/v2/attack-surface/third-party/45998/insight/40466?page=0&size=25&groupBy=RISK_CATEGORY&segmentBy=savedfilter_metric_29644",
"name": "ASI: Deprecated Tech - Apache",
"observationCount": 2,
"segmentBy": "savedfilter_metric_29644"
}
]
},
"id": 45998,
"priorityLevel": "low"
}
}
}
Human Readable Output
Low Severity Insights
9 Active of 11 Insights - 92 Observations
Name Description Observations Insight ID Segment By ASI: Deprecated Tech - Apache ##### Description
Deprecated versions of Apache server that are no longer supported. Running end of life or deprecated software can open organizations up to potential risks and vulnerabilities as these systems are no longer supported via regular updates and security patches.
##### Remediation
Organizations should consider upgrading to supported versions of Apache to ensure security patches are available.2 40466 savedfilter_metric_29644 Affected CVSS Page Root page assets with any CVSS/CVSS v3 score. 0 40466 savedfilter_metric_15881
pt-list-my-attack-surface-assets
Retrieves the attack surface asset information of the individual’s account.
Base Command
pt-list-my-attack-surface-assets
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the insight ID to retrieve the assets. Note: To retrieve the list of insight IDs, execute the “pt-list-my-attack-surface-insights” command. |
Required |
| segment_by | Specify the segment_by to retrieve the assets. Note: To retrieve the list of segment by, execute the “pt-list-my-attack-surface-insights” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Summary.Asset.totalCount | Number | Total number of available assets. |
| PassiveTotal.Summary.Asset.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.Asset.nextPage | String | Link to the next page. |
| PassiveTotal.Asset.insightId | String | Insight ID for which assets are retrieved. |
| PassiveTotal.Asset.segmentBy | String | Segment by for which assets are retrieved. |
| PassiveTotal.Asset.asset.type | String | Type of the asset. |
| PassiveTotal.Asset.asset.name | String | Name of the asset. |
| PassiveTotal.Asset.asset.firstSeen | Date | Date & time the record was first seen. |
| PassiveTotal.Asset.asset.lastSeen | Date | Date & time the record was most recently observed. |
| PassiveTotal.Summary.Asset.name | String | The command name. |
Command Example
!pt-list-my-attack-surface-assets id="40466" segment_by="savedfilter_metric_29634"
Context Example
{
"PassiveTotal": {
"Asset": {
"asset": [
{
"firstSeen": "2016-05-25 20:07:40",
"lastSeen": "2021-09-19 09:50:32",
"name": "financialtradie.com",
"type": "DOMAIN"
}
],
"insightId": "40466",
"segmentBy": "savedfilter_metric_29634"
},
"Summary": {
"Asset": {
"name": "pt-list-my-attack-surface-assets",
"totalCount": 1,
"totalPages": 1
}
}
}
}
Human Readable Output
Asset(s)
Name Type First Seen (GMT) Last Seen (GMT) financialtradie.com DOMAIN 2016-05-25 20:07:40 2021-09-19 09:50:32
pt-list-my-attack-surface-vulnerable-components
Retrieves the attack surface vulnerable component information of the individual’s account.
Base Command
pt-list-my-attack-surface-vulnerable-components
Input
| Argument Name | Description | Required |
|---|---|---|
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Summary.VulnerableComponent.name | String | The command name. |
| PassiveTotal.Summary.VulnerableComponent.totalCount | Number | Total number of available vulnerable components. |
| PassiveTotal.Summary.VulnerableComponent.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.VulnerableComponent.nextPage | String | Link to the next page. |
| PassiveTotal.VulnerableComponent.name | String | Name of the vulnerable component. |
| PassiveTotal.VulnerableComponent.type | String | Type of the vulnerable component. |
| PassiveTotal.VulnerableComponent.severity | String | Severity of the vulnerable component. |
| PassiveTotal.VulnerableComponent.count | Number | Number of assets affected. |
Command Example
!pt-list-my-attack-surface-vulnerable-components page_size=2
Context Example
{
"PassiveTotal": {
"Summary": {
"VulnerableComponent": {
"name": "pt-list-my-attack-surface-vulnerable-components",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/components?page=1&size=2",
"totalCount": 24,
"totalPages": 12
}
},
"VulnerableComponent": [
{
"count": 129,
"name": "nginx 1.14.0",
"severity": "HIGH",
"type": "Server"
},
{
"count": 13,
"name": "nginx 1.16.1",
"severity": "HIGH",
"type": "Server"
}
]
}
}
Human Readable Output
Vulnerable Component(s)
Name Type Severity Asset Count nginx 1.14.0 Server HIGH 129 nginx 1.16.1 Server HIGH 13
pt-list-my-attack-surface-vulnerabilities
Retrieves the attack surface vulnerability information of the individual’s account.
Base Command
pt-list-my-attack-surface-vulnerabilities
Input
| Argument Name | Description | Required |
|---|---|---|
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Vulnerability.cveId | String | ID of the CVE. |
| PassiveTotal.Vulnerability.cwes.cweId | String | CWE ID associated with the CVE. |
| PassiveTotal.Vulnerability.priorityScore | Number | Priority score of the CVE. |
| PassiveTotal.Vulnerability.observationCount | Number | Number of observations of CVE. |
| PassiveTotal.Vulnerability.cveLink | String | Link to the CVE. |
| PassiveTotal.Summary.Vulnerability.name | String | The command name. |
| PassiveTotal.Summary.Vulnerability.totalCount | Number | Total number of vulnerabilities. |
| PassiveTotal.Summary.Vulnerability.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.Vulnerability.nextPage | String | Link to the next page. |
Command Example
!pt-list-my-attack-surface-vulnerabilities page_size=2
Context Example
{
"PassiveTotal": {
"Summary": {
"Vulnerability": {
"name": "pt-list-my-attack-surface-vulnerabilities",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/cves?page=1&size=2",
"totalCount": 413,
"totalPages": 207
}
},
"Vulnerability": [
{
"cveId": "CVE-2021-23017",
"cveLink": "https://api.pt.net/pt/v2/vuln-intel/CVE-2021-23017",
"cwes": [
{
"cweId": "CWE-193"
}
],
"observationCount": 149,
"priorityScore": 98
},
{
"cveId": "CVE-2019-20372",
"cveLink": "https://api.pt.net/pt/v2/vuln-intel/CVE-2019-20372",
"cwes": [
{
"cweId": "CWE-444"
}
],
"observationCount": 145,
"priorityScore": 53
}
]
}
}
Human Readable Output
Vulnerabilities
CVE ID CWE ID RiskIQ Priority Score Asset Count CVE-2021-23017 CWE-193 98.0 149 CVE-2019-20372 CWE-444 53.0 145
pt-list-my-attack-surface-observations
Retrieves the attack surface vulnerability observation information of the individual’s account.
Base Command
pt-list-my-attack-surface-observations
Input
| Argument Name | Description | Required |
|---|---|---|
| cve_id | Specify the CVE ID to retrieve observations of that CVE. Note: To retrieve the list of CVE IDs, execute the “pt-list-my-attack-surface-vulnerabilities” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.Observation.asset.type | String | Type of the asset. |
| PassiveTotal.Observation.asset.name | String | Name of the asset. |
| PassiveTotal.Observation.asset.firstSeen | Date | Date & time the record was first seen. |
| PassiveTotal.Observation.asset.lastSeen | Date | Date & time the record was most recently observed. |
| PassiveTotal.Observation.cveId | String | ID of the CVE. |
| PassiveTotal.Observation.cwe.cweId | String | CWE ID associated with the CVE. |
| PassiveTotal.Summary.Observation.name | String | The command name. |
| PassiveTotal.Summary.Observation.totalCount | Number | Total number of vulnerabilities. |
| PassiveTotal.Summary.Observation.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.Observation.nextPage | String | Link to the next page. |
Command Example
!pt-list-my-attack-surface-observations cve_id="CVE-2021-23017" page_size=2
Context Example
{
"PassiveTotal": {
"Observation": {
"asset": [
{
"firstSeen": "2018-05-11 20:40:17",
"lastSeen": "2021-09-19 14:46:48",
"name": "riskiq.app",
"type": "HOST"
},
{
"firstSeen": "2018-06-30 00:03:32",
"lastSeen": "2021-09-15 19:36:38",
"name": "www.riskiq.app",
"type": "HOST"
}
],
"cveId": "CVE-2021-23017",
"cwe": [
{
"cweId": "CWE-193"
}
]
},
"Summary": {
"Observation": {
"name": "pt-list-my-attack-surface-observations",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/cves/CVE-2021-23017/observations?page=1&size=2",
"totalCount": 149,
"totalPages": 75
}
}
}
}
Human Readable Output
Observation(s)
Name Type First Seen (GMT) Last Seen (GMT) riskiq.app HOST 2018-05-11 20:40:17 2021-09-19 14:46:48 www.riskiq.app HOST 2018-06-30 00:03:32 2021-09-15 19:36:38
pt-list-third-party-attack-surface-assets
Retrieves the attack surface asset information of the given third-party account.
Base Command
pt-list-third-party-attack-surface-assets
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the insight ID to retrieve the assets. Note: To retrieve the list of insight IDs, execute the “pt-list-third-party-attack-surface-insights” command. |
Required |
| vendor_id | Specify the vendor ID to retrieve the assets of a specific vendor. Note: To retrieve the list of vendor IDs, execute the “pt-list-third-party-attack-surface” command. |
Required |
| segment_by | Specify the segment_by to retrieve the assets. Note: To retrieve the list of segment by, execute the “pt-list-third-party-attack-surface-insights” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.ThirdParty.id | Number | ID of the vendor. |
| PassiveTotal.Summary.ThirdPartyInsightAsset.name | String | The command name. |
| PassiveTotal.Summary.ThirdPartyInsightAsset.totalCount | Number | Total number of available assets. |
| PassiveTotal.Summary.ThirdPartyInsightAsset.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.ThirdPartyInsightAsset.nextPage | String | Link to the next page. |
| PassiveTotal.ThirdParty.InsightAsset.insightId | Number | Insight ID for which assets are retrieved. |
| PassiveTotal.ThirdParty.InsightAsset.segmentBy | String | Segment by for which assets are retrieved. |
| PassiveTotal.ThirdParty.InsightAsset.asset.type | String | Type of the asset. |
| PassiveTotal.ThirdParty.InsightAsset.asset.name | String | Name of the asset. |
| PassiveTotal.ThirdParty.InsightAsset.asset.firstSeen | Date | Date & time the record was first seen. |
| PassiveTotal.ThirdParty.InsightAsset.asset.lastSeen | Date | Date & time the record was most recently observed. |
Command Example
!pt-list-third-party-attack-surface-assets id="40464" vendor_id="45998" segment_by="savedfilter_metric_29644"
Context Example
{
"PassiveTotal": {
"Summary": {
"ThirdPartyInsightAsset": {
"name": "pt-list-third-party-attack-surface-assets",
"totalCount": 2,
"totalPages": 1
}
},
"ThirdParty": {
"InsightAsset": {
"asset": [
{
"firstSeen": "2010-06-24 07:49:19",
"lastSeen": "2021-09-21 23:02:08",
"name": "160.189.11.4",
"type": "IP_ADDRESS"
},
{
"firstSeen": "2017-12-01 09:22:21",
"lastSeen": "2021-09-21 18:23:10",
"name": "ec.soup-stock-tokyo.com",
"type": "HOST"
}
],
"insightId": "40464",
"segmentBy": "savedfilter_metric_29644"
},
"id": 45998
}
}
}
Human Readable Output
Asset(s)
Name Type First Seen (GMT) Last Seen (GMT) 160.189.11.4 IP_ADDRESS 2010-06-24 07:49:19 2021-09-21 23:02:08 ec.soup-stock-tokyo.com HOST 2017-12-01 09:22:21 2021-09-21 18:23:10
pt-list-third-party-attack-surface-vulnerable-components
Retrieves the attack surface vulnerable component information of the given third-party account.
Base Command
pt-list-third-party-attack-surface-vulnerable-components
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the vendor ID to retrieve the vulnerable components for a particular vendor. Note: To retrieve the list of vendor IDs, execute the “pt-list-third-party-attack-surface” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.ThirdParty.id | String | ID of the vendor. |
| PassiveTotal.Summary.ThirdPartyVulnerableComponent.name | String | The command name. |
| PassiveTotal.Summary.ThirdPartyVulnerableComponent.totalCount | Number | Total number of available vulnerable components. |
| PassiveTotal.Summary.ThirdPartyVulnerableComponent.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.ThirdPartyVulnerableComponent.nextPage | String | Link to the next page. |
| PassiveTotal.ThirdParty.VulnerableComponent.name | String | Name of the vulnerable component. |
| PassiveTotal.ThirdParty.VulnerableComponent.type | String | Type of the vulnerable component. |
| PassiveTotal.ThirdParty.VulnerableComponent.severity | String | Severity of the vulnerable component. |
| PassiveTotal.ThirdParty.VulnerableComponent.count | Number | Number of assets affected. |
Command Example
!pt-list-third-party-attack-surface-vulnerable-components id="45998" page_size=2
Context Example
{
"PassiveTotal": {
"Summary": {
"ThirdPartyVulnerableComponent": {
"name": "pt-list-third-party-attack-surface-vulnerable-components",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/third-party/45998/components?page=1&size=2",
"totalCount": 45,
"totalPages": 23
}
},
"ThirdParty": {
"VulnerableComponent": [
{
"count": 14,
"name": "Microsoft-IIS 8.5",
"severity": "MEDIUM",
"type": "Server"
},
{
"count": 5,
"name": "OpenSSL 1.0.2k",
"severity": "HIGH",
"type": "Server Module"
}
],
"id": 45998
}
}
}
Human Readable Output
Vulnerable Component(s)
Name Type Severity Asset Count Microsoft-IIS 8.5 Server MEDIUM 14 OpenSSL 1.0.2k Server Module HIGH 5
pt-list-third-party-attack-surface-vulnerabilities
Retrieves the attack surface vulnerability information of the given third-party account.
Base Command
pt-list-third-party-attack-surface-vulnerabilities
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the vendor ID to retrieve the vulnerabilities for a particular vendor. Note: To retrieve the list of vendor IDs, execute the “pt-list-third-party-attack-surface” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.ThirdParty.id | Number | ID of the vendor. |
| PassiveTotal.ThirdParty.Vulnerability.cveId | String | ID of the CVE. |
| PassiveTotal.ThirdParty.Vulnerability.cwes.cweId | String | CWE ID associated with the CVE. |
| PassiveTotal.ThirdParty.Vulnerability.priorityScore | Number | Priority score of the CVE. |
| PassiveTotal.ThirdParty.Vulnerability.observationCount | Number | Number of observations of CVE. |
| PassiveTotal.ThirdParty.Vulnerability.cveLink | String | Link to the CVE. |
| PassiveTotal.Summary.ThirdPartyVulnerability.name | String | The command name. |
| PassiveTotal.Summary.ThirdPartyVulnerability.totalCount | Number | Total number of vulnerabilities. |
| PassiveTotal.Summary.ThirdPartyVulnerability.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.ThirdPartyVulnerability.nextPage | String | Link to the next page. |
Command Example
!pt-list-third-party-attack-surface-vulnerabilities id="45998" page_size=2
Context Example
{
"PassiveTotal": {
"Summary": {
"ThirdPartyVulnerability": {
"name": "pt-list-third-party-attack-surface-vulnerabilities",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/third-party/45998/cves?page=1&size=2",
"totalCount": 548,
"totalPages": 274
}
},
"ThirdParty": {
"Vulnerability": [
{
"cveId": "CVE-2020-11022",
"cveLink": "https://api.pt.net/pt/v2/vuln-intel/CVE-2020-11022",
"cwes": [
{
"cweId": "CWE-79"
}
],
"observationCount": 19,
"priorityScore": 61
},
{
"cveId": "CVE-2020-11023",
"cveLink": "https://api.pt.net/pt/v2/vuln-intel/CVE-2020-11023",
"cwes": [
{
"cweId": "CWE-79"
}
],
"observationCount": 19,
"priorityScore": 61
}
],
"id": 45998
}
}
}
Human Readable Output
Vulnerabilities
CVE ID CWE ID RiskIQ Priority Score Asset Count CVE-2020-11022 CWE-79 61.0 19 CVE-2020-11023 CWE-79 61.0 19
pt-list-third-party-attack-surface-observations
Retrieves the attack surface vulnerability observation information of the given third-party account.
Base Command
pt-list-third-party-attack-surface-observations
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Specify the vendor ID to retrieve the vulnerability observations for a particular vendor. Note: To retrieve the list of vendor IDs, execute the “pt-list-third-party-attack-surface” command. |
Required |
| cve_id | Specify the CVE ID to retrieve observations of the CVE. Note: To retrieve the list of CVE IDs, execute the “pt-list-third-party-attack-surface-vulnerabilities” command. |
Required |
| page_number | Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. Default is 0. |
Optional |
| page_size | Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. Default is 50. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PassiveTotal.ThirdParty.id | Number | ID of the vendor. |
| PassiveTotal.ThirdParty.Observation.asset.type | String | Type of the asset. |
| PassiveTotal.ThirdParty.Observation.asset.name | String | Name of the asset. |
| PassiveTotal.ThirdParty.Observation.asset.firstSeen | Date | Date & time the record was first seen. |
| PassiveTotal.ThirdParty.Observation.asset.lastSeen | Date | Date & time the record was most recently observed. |
| PassiveTotal.ThirdParty.Observation.cveId | String | ID of the CVE. |
| PassiveTotal.ThirdParty.Observation.cwe.cweId | String | CWE ID associated with the CVE. |
| PassiveTotal.Summary.ThirdPartyObservation.name | String | The command name. |
| PassiveTotal.Summary.ThirdPartyObservation.totalCount | Number | Total number of observations. |
| PassiveTotal.Summary.ThirdPartyObservation.totalPages | Number | Number of pages. |
| PassiveTotal.Summary.ThirdPartyObservation.nextPage | String | Link to the next page. |
Command Example
!pt-list-third-party-attack-surface-observations id="45998" cve_id="CVE-2020-11022" page_size=2
Context Example
{
"PassiveTotal": {
"Summary": {
"ThirdPartyObservation": {
"name": "pt-list-third-party-attack-surface-observations",
"nextPage": "https://api.pt.net/pt/v2/attack-surface/vuln-intel/third-party/45998/cves/CVE-2020-11022/observations?page=1&size=2",
"totalCount": 19,
"totalPages": 10
}
},
"ThirdParty": {
"Observation": {
"asset": [
{
"firstSeen": "2015-05-12 14:58:34",
"lastSeen": "2021-09-21 06:14:39",
"name": "blog.accesstage.com.br",
"type": "HOST"
},
{
"firstSeen": "2010-09-22 14:57:20",
"lastSeen": "2021-09-22 00:21:45",
"name": "www.accesstage.com.br",
"type": "HOST"
}
],
"cveId": "CVE-2020-11022",
"cwe": [
{
"cweId": "CWE-79"
}
]
},
"id": 45998
}
}
}
Human Readable Output
Observation(s)
Name Type First Seen (GMT) Last Seen (GMT) blog.accesstage.com.br HOST 2015-05-12 14:58:34 2021-09-21 06:14:39 www.accesstage.com.br HOST 2010-09-22 14:57:20 2021-09-22 00:21:45
Configuration parameters
url— API URL (required)credentials— Usernameusername— Usernamesecret— API Secretinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsrequest_timeout— HTTP(S) Request Timeout (in seconds)integrationReliability— Source ReliabilityfeedExpirationPolicy—feedExpirationInterval—
Commands (28)
-
domainProvides data enrichment for domains.
-
ipChecks the reputation of an IP address.
-
pt-get-articlesRetrieves information related to articles for a specific indicator.
-
pt-get-componentsRetrieves the host attribute components for a domain or IP address. Maximum 2000 records are fetched.
-
pt-get-cookiesRetrieves cookies addresses or hostname information based on cookie name or domain.
-
pt-get-data-cardRetrieves a summary data card associated with the given query.
-
pt-get-host-pairsRetrieves the host attribute pairs related to a domain or IP address. Maximum 2000 records are fetched.
-
pt-get-pdns-detailsRetrieves the passive DNS results from active account sources.
-
pt-get-reputationGets reputation for a given domain, host or IP.
-
pt-get-servicesRetrieves exposed services on the recently open ports for an IP address.
-
pt-get-trackersRetrieves the host attribute trackers for a domain or IP address. Maximum 2000 records are fetched.
-
pt-get-whoisGets WHOIS information records based on queries.
-
pt-list-intel-profile-indicatorsRetrieves the indicators for the given profile.
-
pt-list-intel-profilesRetrieves the list of all profiles.
-
pt-list-my-attack-surface-assetsRetrieves the attack surface asset information of the individual's account.
-
pt-list-my-attack-surface-insightsRetrieves the attack surface insight information of the individual's account.
-
pt-list-my-attack-surface-observationsRetrieves the attack surface vulnerability observation information of the individual's account.
-
pt-list-my-attack-surface-vulnerabilitiesRetrieves the attack surface vulnerability information of the individual's account.
-
pt-list-my-attack-surface-vulnerable-componentsRetrieves the attack surface vulnerable component information of the individual's account.
-
pt-list-my-attack-surfacesRetrieves the attack surface information of the individual's account.
-
pt-list-third-party-attack-surfaceRetrieves the attack surface observations by severity level for the given third-party account.
-
pt-list-third-party-attack-surface-assetsRetrieves the attack surface asset information of the given third-party account.
-
pt-list-third-party-attack-surface-insightsRetrieves the attack surface insight information of the given third-party account.
-
pt-list-third-party-attack-surface-observationsRetrieves the attack surface vulnerability observation information of the given third-party account.
-
pt-list-third-party-attack-surface-vulnerabilitiesRetrieves the attack surface vulnerability information of the given third-party account.
-
pt-list-third-party-attack-surface-vulnerable-componentsRetrieves the attack surface vulnerable component information of the given third-party account.
-
pt-ssl-cert-searchRetrieves SSL certificates for a given field value.
-
pt-whois-searchGets WHOIS information records based on field matching queries.
category: Data Enrichment & Threat Intelligence provider: Microsoft commonfields: id: PassiveTotal v2 version: -1 configuration: - defaultvalue: https://api.passivetotal.org display: API URL name: url required: true type: 0 - display: Username name: credentials required: false type: 9 displaypassword: API Secret - display: Username name: username required: false hidden: true type: 0 - display: API Secret name: secret required: false hidden: true type: 4 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - additionalinfo: All the PassiveTotal API calls would timeout if the response is not returned within the configured time interval. Default is 20. defaultvalue: '20' display: HTTP(S) Request Timeout (in seconds) name: request_timeout type: 0 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false description: Analyze and understand threat infrastructure from a variety of sources-passive DNS, active DNS, WHOIS, SSL certificates and more-without devoting resources to time-intensive manual threat research and analysis. display: PassiveTotal v2 name: PassiveTotal v2 script: commands: - arguments: - description: Query value to use in your request. name: query required: true - auto: PREDEFINED description: 'WHOIS field to execute the search on: domain, email, name, organization, address, phone, nameserver.' name: field predefined: - domain - email - name - organization - address - phone - nameserver required: true description: Gets WHOIS information records based on field matching queries. name: pt-whois-search outputs: - contextPath: Domain.Name description: 'The domain name, for example: ''google.com''.' type: String - contextPath: Domain.WHOIS.CreationDate description: The date that the domain was created. type: Date - contextPath: Domain.WHOIS.UpdatedDate description: The date that the domain was last updated. type: Date - contextPath: Domain.WHOIS.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: Domain.WHOIS.NameServers description: Name servers of the domain. type: String - contextPath: Domain.Organization description: The organization of the domain. type: String - contextPath: Domain.Admin.Email description: The email address of the domain administrator. type: String - contextPath: Domain.Admin.Name description: The name of the domain administrator. type: String - contextPath: Domain.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: Domain.Admin.Country description: The country of the domain administrator. type: String - contextPath: Domain.Registrant.Email description: The email address of the registrant. type: String - contextPath: Domain.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.Registrant.Phone description: The phone number for receiving abuse reports. type: String - contextPath: Domain.Registrant.Country description: The country of the registrant. type: String - contextPath: Domain.WHOIS.Admin.Email description: The email address of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Name description: The name of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Country description: The country of the domain administrator. type: String - contextPath: Domain.WHOIS.Registrar.Name description: 'The name of the registrar, for example: ''GoDaddy''.' type: String - contextPath: Domain.WHOIS.Registrant.Email description: The email address of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Phone description: The phone number for receiving abuse reports. type: String - contextPath: Domain.WHOIS.Registrant.Country description: The country of the registrant. type: String - contextPath: PassiveTotal.WHOIS.domain description: 'The domain name, for example: ''google.com''.' type: String - contextPath: PassiveTotal.WHOIS.registrar description: The name of the registrar of the domain. type: String - contextPath: PassiveTotal.WHOIS.whoisServer description: WHOIS server name where the details of domain registrations belong. type: String - contextPath: PassiveTotal.WHOIS.registered description: The date that the domain was registered. type: Date - contextPath: PassiveTotal.WHOIS.expiresAt description: The expiration date of the domain. type: Date - contextPath: PassiveTotal.WHOIS.registryUpdatedAt description: The date when registry was last updated. type: Date - contextPath: PassiveTotal.WHOIS.lastLoadedAt description: Last loaded date of WHOIS database. type: Date - contextPath: PassiveTotal.WHOIS.nameServers description: Name servers of the domain. type: String - contextPath: PassiveTotal.WHOIS.organization description: The organization of the domain. type: String - contextPath: PassiveTotal.WHOIS.name description: Name of the domain. type: String - contextPath: PassiveTotal.WHOIS.telephone description: Telephone number fetched from whois details of the domain. type: String - contextPath: PassiveTotal.WHOIS.contactEmail description: Contact Email address of the domain owner. type: String - contextPath: PassiveTotal.WHOIS.registrantEmail description: The name of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantFax description: The fax number of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantName description: The name of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantOrganization description: The organizations of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantStreet description: The street of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantCity description: The city of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantState description: The state of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantPostalCode description: The postal code of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantCountry description: The country of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantTelephone description: The telephone number of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.adminEmail description: The email address of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminFax description: The fax number of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminName description: The name of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminOrganization description: The organizations of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminStreet description: The street of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminCity description: The city of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminState description: The state of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminPostalCode description: The postal code of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminCountry description: The country of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminTelephone description: The telephone number of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.billingEmail description: The email address of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingFax description: The fax number of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingName description: The name of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingOrganization description: The organizations of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingStreet description: The street of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingCity description: The city of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingState description: The state of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingPostalCode description: The postal code of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingCountry description: The country of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingTelephone description: The telephone number of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.techEmail description: The email address of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techFax description: The fax number of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techName description: The name of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techOrganization description: The organizations of domain tech. type: String - contextPath: PassiveTotal.WHOIS.techStreet description: The street of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techCity description: The city of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techState description: The state of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techPostalCode description: The postal code of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techCountry description: The country of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techTelephone description: The telephone number of the domain tech. type: String - arguments: - description: 'Query value to use in the request. For example: riskiq.com, 1.1.1.1.' name: query required: true - auto: PREDEFINED defaultValue: 'false' description: |- Whether to return historical results. Valid values: true, false. name: history predefined: - 'true' - 'false' description: Gets WHOIS information records based on queries. name: pt-get-whois outputs: - contextPath: PassiveTotal.WHOIS.domain description: 'The domain name. For example: ''google.com''.' type: String - contextPath: PassiveTotal.WHOIS.registrar description: The name of the registrar of the domain. type: String - contextPath: PassiveTotal.WHOIS.whoisServer description: WHOIS server name where the details of domain registrations belong. type: String - contextPath: PassiveTotal.WHOIS.registered description: The date that the domain was registered. type: Date - contextPath: PassiveTotal.WHOIS.expiresAt description: The expiration date of the domain. type: Date - contextPath: PassiveTotal.WHOIS.registryUpdatedAt description: The date when the registry was last updated. type: Date - contextPath: PassiveTotal.WHOIS.lastLoadedAt description: Last loaded date of WHOIS database. type: Date - contextPath: PassiveTotal.WHOIS.nameServers description: Name servers of the domain. type: String - contextPath: PassiveTotal.WHOIS.organization description: The organization of the domain. type: String - contextPath: PassiveTotal.WHOIS.name description: Name of the domain. type: String - contextPath: PassiveTotal.WHOIS.telephone description: Telephone number fetched from whois details of the domain. type: String - contextPath: PassiveTotal.WHOIS.contactEmail description: Contact Email address of the domain owner. type: String - contextPath: PassiveTotal.WHOIS.registrantEmail description: The email address of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantFax description: The fax number of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantName description: The name of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantOrganization description: The organizations of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantStreet description: The street of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantCity description: The city of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantState description: The state of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantPostalCode description: The postal code of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantCountry description: The country of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.registrantTelephone description: The telephone number of the domain registrant. type: String - contextPath: PassiveTotal.WHOIS.adminEmail description: The email address of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminFax description: The fax number of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminName description: The name of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminOrganization description: The organizations of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminStreet description: The street of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminCity description: The city of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminState description: The state of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminPostalCode description: The postal code of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminCountry description: The country of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.adminTelephone description: The telephone number of the domain administrator. type: String - contextPath: PassiveTotal.WHOIS.billingEmail description: The email address of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingFax description: The fax number of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingName description: The name of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingOrganization description: The organizations of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingStreet description: The street of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingCity description: The city of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingState description: The state of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingPostalCode description: The postal code of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingCountry description: The country of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.billingTelephone description: The telephone number of the domain billing. type: String - contextPath: PassiveTotal.WHOIS.techEmail description: The email address of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techFax description: The fax number of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techName description: The name of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techOrganization description: The organizations of domain tech. type: String - contextPath: PassiveTotal.WHOIS.techStreet description: The street of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techCity description: The city of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techState description: The state of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techPostalCode description: The postal code of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techCountry description: The country of the domain tech. type: String - contextPath: PassiveTotal.WHOIS.techTelephone description: The telephone number of the domain tech. type: String - arguments: - default: true description: Domain or IP address you want to search components for. name: query required: true - description: Filter for records whose last seen is after this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: start - description: Filter for records whose first seen is before this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: end description: Retrieves the host attribute components for a domain or IP address. Maximum 2000 records are fetched. name: pt-get-components outputs: - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: IP.Address description: The IP Address of the component. type: String - contextPath: PassiveTotal.Component.firstSeen description: The date and time when the component was first observed. type: Date - contextPath: PassiveTotal.Component.lastSeen description: The date and time when the component was most recently observed. type: Date - contextPath: PassiveTotal.Component.version description: The current version of component. type: String - contextPath: PassiveTotal.Component.category description: The category under which the component falls. type: String - contextPath: PassiveTotal.Component.label description: The value of the component. type: String - contextPath: PassiveTotal.Component.hostname description: The hostname of the component. type: String - contextPath: PassiveTotal.Component.address description: The IP address of the component. type: String - arguments: - default: true description: Domain or IP address you want to search trackers for. name: query required: true - description: Filter for records whose last seen is after this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: start - description: Filter for records whose first seen is before this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: end description: Retrieves the host attribute trackers for a domain or IP address. Maximum 2000 records are fetched. name: pt-get-trackers outputs: - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: IP.Address description: The IP Address of the component. type: String - contextPath: PassiveTotal.Tracker.firstSeen description: The date and time when the tracker was first observed. type: Date - contextPath: PassiveTotal.Tracker.lastSeen description: The date and time when the tracker was most recently observed. type: Date - contextPath: PassiveTotal.Tracker.attributeValue description: The value of the tracker. type: String - contextPath: PassiveTotal.Tracker.attributeType description: The type under which the tracker falls. type: String - contextPath: PassiveTotal.Tracker.hostname description: The hostname of the tracker. type: String - contextPath: PassiveTotal.Tracker.address description: The IP address of the tracker. type: String - arguments: - default: true description: The domain or IP being queried. name: query required: true - description: Filter for records whose last seen is after this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: start - description: Filter for records whose first seen is before this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: end description: Retrieves the passive DNS results from active account sources. name: pt-get-pdns-details outputs: - contextPath: PassiveTotal.PDNS.resolve description: The host or ip address that indicates resolve in Passive DNS record. type: String - contextPath: PassiveTotal.PDNS.resolveType description: The type of the resolve. I.e domain, ip, host, etc. type: String - contextPath: PassiveTotal.PDNS.value description: The value of the Passive DNS record. type: String - contextPath: PassiveTotal.PDNS.source description: Source of the passive DNS records. type: String - contextPath: PassiveTotal.PDNS.firstSeen description: First seen timestamp of the passive DNS record. type: String - contextPath: PassiveTotal.PDNS.lastSeen description: Last seen timestamp of the passive DNS record. type: String - contextPath: PassiveTotal.PDNS.collected description: The date when a passive DNS record is collected. type: String - contextPath: PassiveTotal.PDNS.recordType description: The type of the passive DNS record. I.e CNAME, SOA, A, etc. type: String - contextPath: PassiveTotal.PDNS.recordHash description: The hash value of the passive DNS record. type: String - contextPath: Domain.Name description: 'The domain name, for example: ''google.com''.' type: String - contextPath: IP.Address description: The IP Address of the component. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - auto: PREDEFINED description: "Field by which to search. \n\nAllowed values: issuerSurname, subjectOrganizationName, issuerCountry, issuerOrganizationUnitName, fingerprint, subjectOrganizationUnitName, serialNumber, subjectEmailAddress, subjectCountry, issuerGivenName, subjectCommonName, issuerCommonName, issuerStateOrProvinceName, issuerProvince, subjectStateOrProvinceName, sha1, subjectStreetAddress, subjectSerialNumber, issuerOrganizationName, subjectSurname, subjectLocalityName, issuerStreetAddress, issuerLocalityName, subjectGivenName, subjectProvince, issuerSerialNumber, issuerEmailAddress." name: field predefined: - issuerSurname - subjectOrganizationName - issuerCountry - issuerOrganizationUnitName - fingerprint - subjectOrganizationUnitName - serialNumber - subjectEmailAddress - subjectCountry - issuerGivenName - subjectCommonName - issuerCommonName - issuerStateOrProvinceName - issuerProvince - subjectStateOrProvinceName - sha1 - subjectStreetAddress - subjectSerialNumber - issuerOrganizationName - subjectSurname - subjectLocalityName - issuerStreetAddress - issuerLocalityName - subjectGivenName - subjectProvince - issuerSerialNumber - issuerEmailAddress required: true - description: Field value for which to search. name: query required: true description: Retrieves SSL certificates for a given field value. name: pt-ssl-cert-search outputs: - contextPath: PassiveTotal.SSL.firstSeen description: Epoch timestamp when SSL certificate identified by the system. type: Number - contextPath: PassiveTotal.SSL.lastSeen description: The last seen epoch timestamp of the SSL certificates. type: Number - contextPath: PassiveTotal.SSL.fingerprint description: 'A fingerprint detail from the SSL certificates. ' type: String - contextPath: PassiveTotal.SSL.sslVersion description: A version of the certificate. type: Number - contextPath: PassiveTotal.SSL.expirationDate description: The expiry date of the certificate. type: String - contextPath: PassiveTotal.SSL.issueDate description: Issue date of the certificate. type: String - contextPath: PassiveTotal.SSL.sha1 description: Sha1 of the certificate. type: String - contextPath: PassiveTotal.SSL.serialNumber description: A serial number of the certificate. type: String - contextPath: PassiveTotal.SSL.issuerCountry description: The country name of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerStateOrProvinceName description: The state or province name of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerCommonName description: The common name of the issuer. type: String - contextPath: PassiveTotal.SSL.issuerEmailAddress description: A contact email address of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerProvince description: A province of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerOrganizationUnitName description: An organization unit name of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerSurname description: The surname of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerStreetAddress description: Street address of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerLocalityName description: The locality of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerSerialNumber description: The serial number of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerOrganizationName description: An organization name of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.issuerGivenName description: A given name of the certificate issuer. type: String - contextPath: PassiveTotal.SSL.subjectCommonName description: The common name of the subject. type: String - contextPath: PassiveTotal.SSL.subjectOrganizationName description: An organization name of the subject of the certificate. type: String - contextPath: PassiveTotal.SSL.subjectOrganizationUnitName description: An organization unit name of the subject of the certificate. type: String - contextPath: PassiveTotal.SSL.subjectGivenName description: The given name of the subject of the certificate. type: String - contextPath: PassiveTotal.SSL.subjectSurname description: The surname of the subject of the certificate. type: String - contextPath: PassiveTotal.SSL.subjectLocalityName description: The locality of the subject. type: String - contextPath: PassiveTotal.SSL.subjectEmailAddress description: A contact email address of the subject. type: String - contextPath: PassiveTotal.SSL.subjectProvince description: The province of the subject. type: String - contextPath: PassiveTotal.SSL.subjectStateOrProvinceName description: The state or province name of the subject. type: String - contextPath: PassiveTotal.SSL.subjectSerialNumber description: A serial number of the subject. type: String - contextPath: PassiveTotal.SSL.subjectStreetAddress description: The street address of the subject. type: String - contextPath: PassiveTotal.SSL.subjectCountry description: The country name of the subject from the certificate. type: String - contextPath: PassiveTotal.SSL.subjectAlternativeNames description: Alternative names of the subject from the certificate details. type: String - arguments: - description: Domain or IP address you want to search host-pairs for. name: query required: true - auto: PREDEFINED description: 'The direction of searching pair records for a given domain. Valid values: children, parents.' name: direction predefined: - children - parents required: true - description: Filter for records whose last seen is after this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: start - description: Filter for records whose first seen is before this datetime. It accepts "yyyy-mm-dd hh:mm:ss" or "yyyy-mm-dd" format. name: end description: Retrieves the host attribute pairs related to a domain or IP address. Maximum 2000 records are fetched. name: pt-get-host-pairs outputs: - contextPath: PassiveTotal.HostPair.firstSeen description: The date and time when the host pair was first observed. type: Date - contextPath: PassiveTotal.HostPair.lastSeen description: The date and time when the host pair was most recently observed. type: Date - contextPath: PassiveTotal.HostPair.cause description: The cause of relation between parent and child. type: String - contextPath: PassiveTotal.HostPair.parent description: The hostname of the parent of the host pair. type: String - contextPath: PassiveTotal.HostPair.child description: The hostname of the child of the host pair. type: String - arguments: - default: true description: The domain to enrich. isArray: true name: domain description: Provides data enrichment for domains. name: domain outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: Unknown - contextPath: DBotScore.Type description: The indicator type. type: Unknown - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: Unknown - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: Domain.Name description: 'The domain name, for example: ''google.com''.' type: String - contextPath: Domain.WHOIS.CreationDate description: The date that the domain was created. type: Date - contextPath: Domain.WHOIS.UpdatedDate description: The date that the domain was last updated. type: Date - contextPath: Domain.WHOIS.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: Domain.WHOIS.NameServers description: Name servers of the domain. type: String - contextPath: Domain.Organization description: The organization of the domain. type: String - contextPath: Domain.Admin.Email description: The email address of the domain administrator. type: String - contextPath: Domain.Admin.Name description: The name of the domain administrator. type: String - contextPath: Domain.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: Domain.Admin.Country description: The country of the domain administrator. type: String - contextPath: Domain.Registrant.Email description: The email address of the registrant. type: String - contextPath: Domain.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.Registrant.Phone description: The phone number for receiving abuse reports. type: String - contextPath: Domain.Registrant.Country description: The country of the registrant. type: String - contextPath: Domain.WHOIS.Admin.Email description: The email address of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Name description: The name of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: Domain.WHOIS.Admin.Country description: The country of the domain administrator. type: String - contextPath: Domain.WHOIS.Registrar.Name description: 'The name of the registrar, for example: ''GoDaddy''.' type: String - contextPath: Domain.WHOIS.Registrant.Email description: The email address of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Phone description: The phone number for receiving abuse reports. type: String - contextPath: Domain.WHOIS.Registrant.Country description: The country of the registrant. type: String - contextPath: PassiveTotal.Domain.domain description: 'The domain name, for example: ''google.com''.' type: String - contextPath: PassiveTotal.Domain.registrar description: The name of the registrar of the domain. type: String - contextPath: PassiveTotal.Domain.whoisServer description: WHOIS server name where the details of domain registrations belong. type: String - contextPath: PassiveTotal.Domain.registered description: The date that the domain was registered. type: Date - contextPath: PassiveTotal.Domain.expiresAt description: The expiration date of the domain. type: Date - contextPath: PassiveTotal.Domain.registryUpdatedAt description: The date when registry was last updated. type: Date - contextPath: PassiveTotal.Domain.lastLoadedAt description: Last loaded date of WHOIS database. type: Date - contextPath: PassiveTotal.Domain.nameServers description: Name servers of the domain. type: String - contextPath: PassiveTotal.Domain.organization description: The organization of the domain. type: String - contextPath: PassiveTotal.Domain.name description: Name of the domain. type: String - contextPath: PassiveTotal.Domain.telephone description: Telephone number fetched from whois details of the domain. type: String - contextPath: PassiveTotal.Domain.contactEmail description: Contact Email address of the domain owner. type: String - contextPath: PassiveTotal.Domain.registrantEmail description: The name of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantFax description: The fax number of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantName description: The name of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantOrganization description: The organizations of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantStreet description: The street of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantCity description: The city of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantState description: The state of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantPostalCode description: The postal code of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantCountry description: The country of the domain registrant. type: String - contextPath: PassiveTotal.Domain.registrantTelephone description: The telephone number of the domain registrant. type: String - contextPath: PassiveTotal.Domain.adminEmail description: The email address of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminFax description: The fax number of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminName description: The name of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminOrganization description: The organizations of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminStreet description: The street of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminCity description: The city of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminState description: The state of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminPostalCode description: The postal code of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminCountry description: The country of the domain administrator. type: String - contextPath: PassiveTotal.Domain.adminTelephone description: The telephone number of the domain administrator. type: String - contextPath: PassiveTotal.Domain.billingEmail description: The email address of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingFax description: The fax number of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingName description: The name of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingOrganization description: The organizations of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingStreet description: The street of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingCity description: The city of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingState description: The state of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingPostalCode description: The postal code of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingCountry description: The country of the domain billing. type: String - contextPath: PassiveTotal.Domain.billingTelephone description: The telephone number of the domain billing. type: String - contextPath: PassiveTotal.Domain.techEmail description: The email address of the domain tech. type: String - contextPath: PassiveTotal.Domain.techFax description: The fax number of the domain tech. type: String - contextPath: PassiveTotal.Domain.techName description: The name of the domain tech. type: String - contextPath: PassiveTotal.Domain.techOrganization description: The organizations of domain tech. type: String - contextPath: PassiveTotal.Domain.techStreet description: The street of the domain tech. type: String - contextPath: PassiveTotal.Domain.techCity description: The city of the domain tech. type: String - contextPath: PassiveTotal.Domain.techState description: The state of the domain tech. type: String - contextPath: PassiveTotal.Domain.techPostalCode description: The postal code of the domain tech. type: String - contextPath: PassiveTotal.Domain.techCountry description: The country of the domain tech. type: String - contextPath: PassiveTotal.Domain.techTelephone description: The telephone number of the domain tech. type: String - contextPath: PassiveTotal.Domain.score description: Reputation score of the indicator. type: Number - contextPath: PassiveTotal.Domain.classification description: Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN). type: String - contextPath: PassiveTotal.Domain.rules.name description: Name of the rule that informed the reputation score of the indicator. type: String - contextPath: PassiveTotal.Domain.rules.description description: Description of the rule. type: String - contextPath: PassiveTotal.Domain.rules.severity description: Severity of the rule. type: Number - contextPath: PassiveTotal.Domain.rules.link description: Link to the rule. type: String - arguments: - description: 'Indicator value to search for in articles. For example: riskiq.com, 1.1.1.1.' name: query required: true - description: 'Type of the indicator. For example: domain, ip, url.' name: type description: Retrieves information related to articles for a specific indicator. name: pt-get-articles outputs: - contextPath: PassiveTotal.Article.guid description: The global unique ID of the article. type: String - contextPath: PassiveTotal.Article.title description: The title of the article. type: String - contextPath: PassiveTotal.Article.summary description: The summary of the article. type: String - contextPath: PassiveTotal.Article.type description: The type of an article. type: String - contextPath: PassiveTotal.Article.publishedDate description: The date and time on which the article was published. type: Date - contextPath: PassiveTotal.Article.link description: The link of the article for getting more details. type: String - contextPath: PassiveTotal.Article.categories description: An array of categories of the article. type: Unknown - contextPath: PassiveTotal.Article.tags description: An array of tags for the article. type: Unknown - contextPath: PassiveTotal.Article.indicators.type description: The type of the indicator. type: String - contextPath: PassiveTotal.Article.indicators.count description: Total number of indicators of a particular type. type: Number - contextPath: PassiveTotal.Article.indicators.values description: An array of values related to indicators. type: Unknown - contextPath: PassiveTotal.Article.indicators.source description: The source of the indicator. type: String - arguments: - default: true description: IP address for which the user wants to search services for. name: ip required: true description: Retrieves exposed services on the recently open ports for an IP address. name: pt-get-services outputs: - contextPath: PassiveTotal.Service.ip description: IP address of the service. type: String - contextPath: PassiveTotal.Service.portNumber description: Port number on which recent services were running or current services are running. type: Number - contextPath: PassiveTotal.Service.firstSeen description: The date and time when the service was started for the first time on the port. type: Date - contextPath: PassiveTotal.Service.lastSeen description: The date and time when the service was most recently used on the port. type: Date - contextPath: PassiveTotal.Service.lastScan description: The date and time when the system performed the last scan to check whether any service is running on the port or not. type: Date - contextPath: PassiveTotal.Service.count description: The total number of times service was used on the port. type: Number - contextPath: PassiveTotal.Service.status description: The status of the service. type: String - contextPath: PassiveTotal.Service.protocol description: The protocol used by the service. type: String - contextPath: PassiveTotal.Service.banners.banner description: The description of the banner generated as a result of scanning. Can be in HTML format. type: String - contextPath: PassiveTotal.Service.banners.scanType description: The type of scan when the banner was generated. type: String - contextPath: PassiveTotal.Service.banners.firstSeen description: The date and time when the scan started. type: Date - contextPath: PassiveTotal.Service.banners.lastSeen description: The date and time when the scan ended. type: Date - contextPath: PassiveTotal.Service.banners.count description: The total number of times the same label was generated while scanning. type: Number - contextPath: PassiveTotal.Service.currentServices.firstSeen description: The date and time when the current service started. type: Date - contextPath: PassiveTotal.Service.currentServices.lastSeen description: The date and time when the current service was most recently used. type: Date - contextPath: PassiveTotal.Service.currentServices.version description: The version of the current service. type: String - contextPath: PassiveTotal.Service.currentServices.category description: The category of the current service. type: String - contextPath: PassiveTotal.Service.currentServices.label description: The label of the current service. type: String - contextPath: PassiveTotal.Service.recentServices.firstSeen description: The date and time when the recent service started. type: Date - contextPath: PassiveTotal.Service.recentServices.lastSeen description: The date and time when the recent service was most recently used. type: Date - contextPath: PassiveTotal.Service.recentServices.version description: The version of the recent service. type: String - contextPath: PassiveTotal.Service.recentServices.category description: The category of the recent service. type: String - contextPath: PassiveTotal.Service.recentServices.label description: The label of the recent service. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.firstSeen description: The timestamp in epoch when the most recent SSL certificate was identified by the system. type: Date - contextPath: PassiveTotal.Service.mostRecentSslCert.lastSeen description: The timestamp in epoch when the most recent SSL certificate was last used. type: Date - contextPath: PassiveTotal.Service.mostRecentSslCert.fingerprint description: A fingerprint detail from the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.sslVersion description: The version of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.expirationDate description: The expiry date and time of the most recent SSL certificate in GMT. type: Date - contextPath: PassiveTotal.Service.mostRecentSslCert.issueDate description: The date and time in GMT when the most recent SSL certificate was issued. type: Date - contextPath: PassiveTotal.Service.mostRecentSslCert.sha1 description: Sha1 of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.serialNumber description: The serial Number of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectCountry description: The name of the Country of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerCommonName description: The common name of the issuer of most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerProvince description: The province of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectStateOrProvinceName description: The state or province name of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectStreetAddress description: The street address of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerStateOrProvinceName description: The state or province name of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectSurname description: The surname of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerCountry description: The country of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectLocalityName description: The subject locality name of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectAlternativeNames description: List of alternative names of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerOrganizationUnitName description: The name organization unit of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerOrganizationName description: The organization name of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectEmailAddress description: Email Address of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectOrganizationName description: The organization name of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerLocalityName description: The name of the locality of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectCommonName description: Common name of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectProvince description: The province of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerGivenName description: The given name of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectOrganizationUnitName description: Subject organization unit name of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerEmailAddress description: The email address of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectGivenName description: Given name of the subject of the the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.subjectSerialNumber description: The serial number of the subject of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerStreetAddress description: The street Address of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerSerialNumber description: The serial number of the issuer of the most recent SSL certificate. type: String - contextPath: PassiveTotal.Service.mostRecentSslCert.issuerSurname description: The surname of the issuer of the most recent SSL certificate. type: String - arguments: - auto: PREDEFINED description: |- Search cookies information by name or domain. Valid values: 1. get addresses by cookie domain 2. get addresses by cookie name 3. get hosts by cookie domain 4. get hosts by cookie name. name: search_by predefined: - get addresses by cookie domain - get addresses by cookie name - get hosts by cookie domain - get hosts by cookie name required: true - description: Name or domain of cookie the user wants to search for. name: query required: true - defaultValue: '0' description: Page number for paging through results. Each page contains 2000 values. name: page - auto: PREDEFINED defaultValue: last seen description: 'Field to sort the results on. Valid values: last seen, first seen.' name: sort predefined: - last seen - first seen - auto: PREDEFINED defaultValue: desc description: 'Order to return the results in. Valid values: asc, desc.' name: order predefined: - desc - asc description: Retrieves cookies addresses or hostname information based on cookie name or domain. name: pt-get-cookies outputs: - contextPath: PassiveTotal.Cookie.hostname description: The hostname/IP of the machine on which the cookie was found. type: String - contextPath: PassiveTotal.Cookie.cookieName description: The name of the cookie that was found on the host. type: String - contextPath: PassiveTotal.Cookie.cookieDomain description: The domain from which the cookie originated from. type: String - contextPath: PassiveTotal.Cookie.firstSeen description: The date and time when the cookie was first observed. type: Date - contextPath: PassiveTotal.Cookie.lastSeen description: The date and time when the cookie was most recently observed. type: Date - arguments: - description: 'The domain, host or IP address to be queried. For example: riskiq.com, 1.1.1.1.' name: query required: true description: Retrieves a summary data card associated with the given query. name: pt-get-data-card outputs: - contextPath: PassiveTotal.DataCard.type description: Type of the indicator. type: String - contextPath: PassiveTotal.DataCard.name description: Name of the indicator. type: String - contextPath: PassiveTotal.DataCard.link description: Link to the indicator. type: String - contextPath: PassiveTotal.DataCard.netblock description: Netblock associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.os description: Operating system associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.organization description: The organization of the indicator. type: String - contextPath: PassiveTotal.DataCard.asn description: Autonomous system number assigned to the indicator. type: String - contextPath: PassiveTotal.DataCard.hosting_provider description: Host provider of the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.resolutions.count description: Number of resolutions attached to the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.resolutions.link description: Link of the resolutions attached to the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.services.count description: Number of service records for the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.services.link description: Link to the service records of the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.certificates.count description: Number of certificates for the given indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.certificates.link description: Link to the certificates associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.hashes.count description: Number of hashes associated with the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.hashes.link description: Link to the hashes associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.projects.count description: Number of projects containing the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.projects.link description: Number of projects containing the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.articles.count description: Number of articles referencing the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.articles.link description: Link to the articles referencing the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.trackers.count description: Number of trackers associated with the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.trackers.link description: Link to the trackers associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.components.count description: Number of components associated with the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.components.link description: Link to the components associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.host_pairs.count description: Number of host pairs associated with the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.host_pairs.link description: Link to the host pairs associated with the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.reverse_dns.count description: Number of DNS records for the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.reverse_dns.link description: Link to the DNS records of the indicator. type: String - contextPath: PassiveTotal.DataCard.data_summary.cookies.count description: Number of available cookie records for the indicator. type: Number - contextPath: PassiveTotal.DataCard.data_summary.cookies.link description: Link to the cookie records for the indicator. type: String - arguments: - description: 'The domain, host or IP address to be queried. For example: riskiq.com, 1.1.1.1.' name: query required: true description: Gets reputation for a given domain, host or IP. name: pt-get-reputation outputs: - contextPath: PassiveTotal.Reputation.query description: The value of the indicator. type: String - contextPath: PassiveTotal.Reputation.score description: Reputation score of the indicator. type: Number - contextPath: PassiveTotal.Reputation.classification description: Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN). type: String - contextPath: PassiveTotal.Reputation.rules.name description: Name of the rule that informed the reputation score of the indicator. type: String - contextPath: PassiveTotal.Reputation.rules.description description: Description of the rule. type: String - contextPath: PassiveTotal.Reputation.rules.severity description: Severity of the rule. type: Number - contextPath: PassiveTotal.Reputation.rules.link description: Link to the rule. type: String - arguments: - default: true description: The IP address to check. isArray: true name: ip description: Checks the reputation of an IP address. name: ip outputs: - contextPath: PassiveTotal.IP.query description: The value of the indicator. type: String - contextPath: PassiveTotal.IP.score description: Reputation score of the indicator. type: Number - contextPath: PassiveTotal.IP.classification description: Reputation classification of the indicator. (Can be GOOD, SUSPICIOUS, MALICIOUS, or UNKNOWN). type: String - contextPath: PassiveTotal.IP.rules.name description: Name of the rule that informed the reputation score of the indicator. type: String - contextPath: PassiveTotal.IP.rules.description description: Description of the rule. type: String - contextPath: PassiveTotal.IP.rules.severity description: Severity of the rule. type: Number - contextPath: PassiveTotal.IP.rules.link description: Link to the rule. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: IP.Address description: The IP Address. type: String - arguments: - description: |- Specify the ID of the profile to retrieve the specific profile. Note: If 'id' argument is provided, all other arguments will be neglected. name: id - description: 'Filter the result based on title or aliases. ' name: query - auto: PREDEFINED description: "Filter the results based on the profile type. \n\nPossible values: actor, tool, backdoor." name: type predefined: - actor - tool - backdoor - description: "Specify the indicator value to retrieve the profiles containing the given indicator.\n\nNote: To retrieve the list of indicators, execute the \"pt-list-intel-profile-indicators\" command. \nWhen both indicator_value and query are provided, higher priority will be given to indicator_value." name: indicator_value - auto: PREDEFINED description: "Filter the result based on the indicator source. \n\nPossible values: osint, riskiq.\n\nNote: Requires 'indicator_value' argument." name: source predefined: - osint - riskiq - auto: PREDEFINED description: "Filter the result based on the indicator category. \n\nPossible values: host, network.\n\nNote: Requires 'indicator_value' argument." name: category predefined: - host - network - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. name: page_size description: Retrieves the list of all profiles. name: pt-list-intel-profiles outputs: - contextPath: PassiveTotal.IntelProfile.id description: ID of the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.title description: Title of the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.link description: Link to the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.osintIndicatorsCount description: Count of the open source intelligence indicators referencing the intel profile. type: Number - contextPath: PassiveTotal.IntelProfile.riskIqIndicatorsCount description: Count of the riskiq indicators referencing the intel profile. type: Number - contextPath: PassiveTotal.IntelProfile.indicators description: Link to the indicators referencing the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.aliases description: Aliases of the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.tags.label description: Labels associated with the intel profile. type: String - contextPath: PassiveTotal.IntelProfile.tags.countryCode description: Country code of the tags associated with the intel profile. type: String - arguments: - description: |- Specify the ID of the profile to retrieve indicators for the specific profile. Note: To retrieve the list of profile IDs, execute the "pt-list-intel-profile" command. name: id required: true - auto: PREDEFINED description: "Filter the results based on the indicator type. \n\nPossible values: certificate_sha1, domain, email, hash_md5, hash_sha256, ip, pdb_path, soa_email, url, whois_email." name: type predefined: - certificate_sha1 - domain - email - hash_md5 - hash_sha256 - ip - pdb_path - soa_email - url - whois_email - description: Specify the indicator value to retrieve the specific indicator. name: indicator_value - auto: PREDEFINED description: "Filter the result based on the indicator source. \n\nPossible values: osint, riskiq." name: source predefined: - osint - riskiq - auto: PREDEFINED description: "Filter the result based on the indicator category. \n\nPossible values: host, network." name: category predefined: - host - network - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the indicators for the given profile. name: pt-list-intel-profile-indicators outputs: - contextPath: PassiveTotal.IntelProfile.id description: Profile ID containing the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.id description: ID of the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.type description: Type of the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.value description: Value of the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.category description: Category of the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.firstSeen description: Date & time the record was first seen. type: String - contextPath: PassiveTotal.IntelProfile.indicator.lastSeen description: Date & time the record was most recently observed. type: String - contextPath: PassiveTotal.IntelProfile.indicator.osint description: Whether the indicator was published in open source intelligence articles. type: String - contextPath: PassiveTotal.IntelProfile.indicator.osintUrl description: Link to the osint source of the indicator. type: String - contextPath: PassiveTotal.IntelProfile.indicator.articleGuids description: List of RiskIQ OSINT article GUIDs associated with the indicator. type: String - arguments: - auto: PREDEFINED description: |- Filter the results based on the priority level specified. Possible values: high, medium, low. name: priority predefined: - high - medium - low required: true - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. name: page_size description: Retrieves the attack surface insight information of the individual's account. name: pt-list-my-attack-surface-insights outputs: - contextPath: PassiveTotal.Summary.Insight.name description: The command name. type: String - contextPath: PassiveTotal.Summary.Insight.activeInsightCount description: Total number of active insights. type: Number - contextPath: PassiveTotal.Summary.Insight.totalInsightCount description: Total number of insights. type: Number - contextPath: PassiveTotal.Summary.Insight.totalObservations description: Total number of observations. type: Number - contextPath: PassiveTotal.Insight.priorityLevel description: Priority level of insights. type: String - contextPath: PassiveTotal.Insight.insight.name description: Name of the insight. type: String - contextPath: PassiveTotal.Insight.insight.description description: Description of the insight. type: String - contextPath: PassiveTotal.Insight.insight.observationCount description: Number of observations for the given insight. type: Number - contextPath: PassiveTotal.Insight.insight.link description: Link to the insight. type: String - contextPath: PassiveTotal.Insight.insight.insightId description: ID of the third party insight. type: String - contextPath: PassiveTotal.Insight.insight.segmentBy description: Segment by of the insight. type: String - arguments: - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. name: page_size description: Retrieves the attack surface information of the individual's account. name: pt-list-my-attack-surfaces outputs: - contextPath: PassiveTotal.AttackSurface.id description: ID of the attack surface. type: Number - contextPath: PassiveTotal.AttackSurface.name description: Name of the attack surface. type: String - contextPath: PassiveTotal.AttackSurface.priority.high.observationCount description: Total observations of high priority attack surface. type: Number - contextPath: PassiveTotal.AttackSurface.priority.high.link description: Link to the high priority attack surface. type: String - contextPath: PassiveTotal.AttackSurface.priority.medium.observationCount description: Total observations of medium priority attack surface. type: Number - contextPath: PassiveTotal.AttackSurface.priority.medium.link description: Link to the medium priority attack surface. type: String - contextPath: PassiveTotal.AttackSurface.priority.low.observationCount description: Total observations of low priority attack surface. type: Number - contextPath: PassiveTotal.AttackSurface.priority.low.link description: Link to the low priority attack surface. type: String - arguments: - description: Specify the vendor ID to retrieve the attack surface third party information. name: id - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface observations by severity level for the given third-party account. name: pt-list-third-party-attack-surface outputs: - contextPath: PassiveTotal.ThirdParty.id description: ID of the vendor. type: Number - contextPath: PassiveTotal.ThirdParty.name description: Name of the vendor. type: String - contextPath: PassiveTotal.ThirdParty.priority.high.observationCount description: Total observations of high priority attack surface. type: Number - contextPath: PassiveTotal.ThirdParty.priority.high.link description: Link to the high priority attack surface. type: String - contextPath: PassiveTotal.ThirdParty.priority.medium.observationCount description: Total observations of medium priority attack surface. type: Number - contextPath: PassiveTotal.ThirdParty.priority.medium.link description: Link to the medium priority attack surface. type: String - contextPath: PassiveTotal.ThirdParty.priority.low.observationCount description: Total observations of low priority attack surface. type: Number - contextPath: PassiveTotal.ThirdParty.priority.low.link description: Link to the low priority attack surface. type: String - contextPath: PassiveTotal.Summary.ThirdPartyASI.name description: The command name. type: String - contextPath: PassiveTotal.Summary.ThirdPartyASI.totalCount description: Total number of attack surfaces. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyASI.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyASI.nextPage description: Link to the next page. type: String - arguments: - description: |- Specify the vendor ID to retrieve the third-party insights information. Note: To retrieve the list of vendor IDs, execute the "pt-list-third-party-attack-surface" command. name: id required: true - auto: PREDEFINED description: |- Filter the results based on the priority level specified. Possible values: high, medium, low. name: priority predefined: - high - medium - low required: true - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is 1000. name: page_size description: Retrieves the attack surface insight information of the given third-party account. name: pt-list-third-party-attack-surface-insights outputs: - contextPath: PassiveTotal.Summary.ThirdPartyInsight.activeInsightCount description: Total number of active third party insights. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyInsight.totalInsightCount description: Total number of third party insights. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyInsight.totalObservations description: Total number of third party observations. type: Number - contextPath: PassiveTotal.ThirdParty.id description: Vendor ID associated with the third party insights. type: Number - contextPath: PassiveTotal.ThirdParty.priorityLevel description: Priority level of third party insights. type: String - contextPath: PassiveTotal.ThirdParty.Insight.insight.name description: Name of the third party insight. type: String - contextPath: PassiveTotal.ThirdParty.Insight.insight.description description: Description of the third party insight. type: String - contextPath: PassiveTotal.ThirdParty.Insight.insight.observationCount description: Number of observations for the given third party insight. type: Number - contextPath: PassiveTotal.ThirdParty.Insight.insight.link description: Link to the third party insight. type: String - contextPath: PassiveTotal.ThirdParty.Insight.insight.insightId description: ID of the third party insight. type: String - contextPath: PassiveTotal.ThirdParty.Insight.insight.segmentBy description: Segment by of the third party insight. type: String - contextPath: PassiveTotal.Summary.ThirdPartyInsight.name description: The command name. type: String - arguments: - description: |- Specify the insight ID to retrieve the assets. Note: To retrieve the list of insight IDs, execute the "pt-list-my-attack-surface-insights" command. name: id required: true - description: |- Specify the segment_by to retrieve the assets. Note: To retrieve the list of segment by, execute the "pt-list-my-attack-surface-insights" command. name: segment_by required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface asset information of the individual's account. name: pt-list-my-attack-surface-assets outputs: - contextPath: PassiveTotal.Summary.Asset.totalCount description: Total number of available assets. type: Number - contextPath: PassiveTotal.Summary.Asset.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.Asset.nextPage description: Link to the next page. type: String - contextPath: PassiveTotal.Asset.insightId description: Insight ID for which assets are retrieved. type: String - contextPath: PassiveTotal.Asset.segmentBy description: Segment by for which assets are retrieved. type: String - contextPath: PassiveTotal.Asset.asset.type description: Type of the asset. type: String - contextPath: PassiveTotal.Asset.asset.name description: Name of the asset. type: String - contextPath: PassiveTotal.Asset.asset.firstSeen description: Date & time the record was first seen. type: Date - contextPath: PassiveTotal.Asset.asset.lastSeen description: Date & time the record was most recently observed. type: Date - contextPath: PassiveTotal.Summary.Asset.name description: The command name. type: String - arguments: - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerable component information of the individual's account. name: pt-list-my-attack-surface-vulnerable-components outputs: - contextPath: PassiveTotal.Summary.VulnerableComponent.name description: The command name. type: String - contextPath: PassiveTotal.Summary.VulnerableComponent.totalCount description: Total number of available vulnerable components. type: Number - contextPath: PassiveTotal.Summary.VulnerableComponent.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.VulnerableComponent.nextPage description: Link to the next page. type: String - contextPath: PassiveTotal.VulnerableComponent.name description: Name of the vulnerable component. type: String - contextPath: PassiveTotal.VulnerableComponent.type description: Type of the vulnerable component. type: String - contextPath: PassiveTotal.VulnerableComponent.severity description: Severity of the vulnerable component. type: String - contextPath: PassiveTotal.VulnerableComponent.count description: Number of assets affected. type: Number - arguments: - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerability information of the individual's account. name: pt-list-my-attack-surface-vulnerabilities outputs: - contextPath: PassiveTotal.Vulnerability.cveId description: ID of the CVE. type: String - contextPath: PassiveTotal.Vulnerability.cwes.cweId description: CWE ID associated with the CVE. type: String - contextPath: PassiveTotal.Vulnerability.priorityScore description: Priority score of the CVE. type: Number - contextPath: PassiveTotal.Vulnerability.observationCount description: Number of observations of CVE. type: Number - contextPath: PassiveTotal.Vulnerability.cveLink description: Link to the CVE. type: String - contextPath: PassiveTotal.Summary.Vulnerability.name description: The command name. type: String - contextPath: PassiveTotal.Summary.Vulnerability.totalCount description: Total number of vulnerabilities. type: Number - contextPath: PassiveTotal.Summary.Vulnerability.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.Vulnerability.nextPage description: Link to the next page. type: String - arguments: - description: |- Specify the CVE ID to retrieve observations of that CVE. Note: To retrieve the list of CVE IDs, execute the "pt-list-my-attack-surface-vulnerabilities" command. name: cve_id required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerability observation information of the individual's account. name: pt-list-my-attack-surface-observations outputs: - contextPath: PassiveTotal.Observation.asset.type description: Type of the asset. type: String - contextPath: PassiveTotal.Observation.asset.name description: Name of the asset. type: String - contextPath: PassiveTotal.Observation.asset.firstSeen description: Date & time the record was first seen. type: Date - contextPath: PassiveTotal.Observation.asset.lastSeen description: Date & time the record was most recently observed. type: Date - contextPath: PassiveTotal.Observation.cveId description: ID of the CVE. type: String - contextPath: PassiveTotal.Observation.cwe.cweId description: CWE ID associated with the CVE. type: String - contextPath: PassiveTotal.Summary.Observation.name description: The command name. type: String - contextPath: PassiveTotal.Summary.Observation.totalCount description: Total number of vulnerabilities. type: Number - contextPath: PassiveTotal.Summary.Observation.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.Observation.nextPage description: Link to the next page. type: String - arguments: - description: |- Specify the insight ID to retrieve the assets. Note: To retrieve the list of insight IDs, execute the "pt-list-third-party-attack-surface-insights" command. name: id required: true - description: |- Specify the vendor ID to retrieve the assets of a specific vendor. Note: To retrieve the list of vendor IDs, execute the "pt-list-third-party-attack-surface" command. name: vendor_id required: true - description: |- Specify the segment_by to retrieve the assets. Note: To retrieve the list of segment by, execute the "pt-list-third-party-attack-surface-insights" command. name: segment_by required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface asset information of the given third-party account. name: pt-list-third-party-attack-surface-assets outputs: - contextPath: PassiveTotal.ThirdParty.id description: ID of the vendor. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyInsightAsset.name description: The command name. type: String - contextPath: PassiveTotal.Summary.ThirdPartyInsightAsset.totalCount description: Total number of available assets. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyInsightAsset.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyInsightAsset.nextPage description: Link to the next page. type: String - contextPath: PassiveTotal.ThirdParty.InsightAsset.insightId description: Insight ID for which assets are retrieved. type: Number - contextPath: PassiveTotal.ThirdParty.InsightAsset.segmentBy description: Segment by for which assets are retrieved. type: String - contextPath: PassiveTotal.ThirdParty.InsightAsset.asset.type description: Type of the asset. type: String - contextPath: PassiveTotal.ThirdParty.InsightAsset.asset.name description: Name of the asset. type: String - contextPath: PassiveTotal.ThirdParty.InsightAsset.asset.firstSeen description: Date & time the record was first seen. type: Date - contextPath: PassiveTotal.ThirdParty.InsightAsset.asset.lastSeen description: Date & time the record was most recently observed. type: Date - arguments: - description: |- Specify the vendor ID to retrieve the vulnerable components for a particular vendor. Note: To retrieve the list of vendor IDs, execute the "pt-list-third-party-attack-surface" command. name: id required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerable component information of the given third-party account. name: pt-list-third-party-attack-surface-vulnerable-components outputs: - contextPath: PassiveTotal.ThirdParty.id description: ID of the vendor. type: String - contextPath: PassiveTotal.Summary.ThirdPartyVulnerableComponent.name description: The command name. type: String - contextPath: PassiveTotal.Summary.ThirdPartyVulnerableComponent.totalCount description: Total number of available vulnerable components. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyVulnerableComponent.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyVulnerableComponent.nextPage description: Link to the next page. type: String - contextPath: PassiveTotal.ThirdParty.VulnerableComponent.name description: Name of the vulnerable component. type: String - contextPath: PassiveTotal.ThirdParty.VulnerableComponent.type description: Type of the vulnerable component. type: String - contextPath: PassiveTotal.ThirdParty.VulnerableComponent.severity description: Severity of the vulnerable component. type: String - contextPath: PassiveTotal.ThirdParty.VulnerableComponent.count description: Number of assets affected. type: Number - arguments: - description: |- Specify the vendor ID to retrieve the vulnerabilities for a particular vendor. Note: To retrieve the list of vendor IDs, execute the "pt-list-third-party-attack-surface" command. name: id required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerability information of the given third-party account. name: pt-list-third-party-attack-surface-vulnerabilities outputs: - contextPath: PassiveTotal.ThirdParty.id description: ID of the vendor. type: Number - contextPath: PassiveTotal.ThirdParty.Vulnerability.cveId description: ID of the CVE. type: String - contextPath: PassiveTotal.ThirdParty.Vulnerability.cwes.cweId description: CWE ID associated with the CVE. type: String - contextPath: PassiveTotal.ThirdParty.Vulnerability.priorityScore description: Priority score of the CVE. type: Number - contextPath: PassiveTotal.ThirdParty.Vulnerability.observationCount description: Number of observations of CVE. type: Number - contextPath: PassiveTotal.ThirdParty.Vulnerability.cveLink description: Link to the CVE. type: String - contextPath: PassiveTotal.Summary.ThirdPartyVulnerability.name description: The command name. type: String - contextPath: PassiveTotal.Summary.ThirdPartyVulnerability.totalCount description: Total number of vulnerabilities. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyVulnerability.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyVulnerability.nextPage description: Link to the next page. type: String - arguments: - description: |- Specify the vendor ID to retrieve the vulnerability observations for a particular vendor. Note: To retrieve the list of vendor IDs, execute the "pt-list-third-party-attack-surface" command. name: id required: true - description: |- Specify the CVE ID to retrieve observations of the CVE. Note: To retrieve the list of CVE IDs, execute the "pt-list-third-party-attack-surface-vulnerabilities" command. name: cve_id required: true - defaultValue: '0' description: |- Page number for paging through results. Note: The minimum value supported is 0 and maximum value supported is int32. name: page_number - defaultValue: '50' description: |- Maximum number of results to return per page. Note: The minimum value supported is 1 and maximum value supported is int32. name: page_size description: Retrieves the attack surface vulnerability observation information of the given third-party account. name: pt-list-third-party-attack-surface-observations outputs: - contextPath: PassiveTotal.ThirdParty.id description: ID of the vendor. type: Number - contextPath: PassiveTotal.ThirdParty.Observation.asset.type description: Type of the asset. type: String - contextPath: PassiveTotal.ThirdParty.Observation.asset.name description: Name of the asset. type: String - contextPath: PassiveTotal.ThirdParty.Observation.asset.firstSeen description: Date & time the record was first seen. type: Date - contextPath: PassiveTotal.ThirdParty.Observation.asset.lastSeen description: Date & time the record was most recently observed. type: Date - contextPath: PassiveTotal.ThirdParty.Observation.cveId description: ID of the CVE. type: String - contextPath: PassiveTotal.ThirdParty.Observation.cwe.cweId description: CWE ID associated with the CVE. type: String - contextPath: PassiveTotal.Summary.ThirdPartyObservation.name description: The command name. type: String - contextPath: PassiveTotal.Summary.ThirdPartyObservation.totalCount description: Total number of observations. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyObservation.totalPages description: Number of pages. type: Number - contextPath: PassiveTotal.Summary.ThirdPartyObservation.nextPage description: Link to the next page. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - No Tests- non-certified partner, test was moved to non circle folder. fromversion: 5.0.0