PolySwarmV2

Real-time threat intelligence from a crowd-sourced network of security experts and antivirus companies.

Data Enrichment & Threat Intelligence · PolySwarm

Details

IDPolySwarmV2
ProviderPolySwarm
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/polyswarm:1.0.0.6911470
Supported ModulesAgentix XSIAM

README

Real-time threat intelligence from a crowd-sourced network of security experts and antivirus companies.

Configure PolySwarmV2 in Cortex

Parameter Description Required
PolySwarm API Key   True
The base URL to connect to   True
PolySwarm v2 Community the segment of PolySwarm’s marketplace to query on. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

polyswarm-get-report

Returns a report using the UUID.

Base Command

polyswarm-get-report

Input

Argument Name Description Required
scan_uuid UUID string. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.
Command Example

!polyswarm-get-report scan_uuid="25e755c8957163376b3437ce808843c1c2598e0fb3c5f31dc958576cd5cde63e"
!polyswarm-get-report scan_uuid="25e755c8957163376b3437ce808843c1c2598e0fb3c5f31dc958576cd5cde63e, 2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe"

Human Readable Output

file

Queries PolySwarm for file reputation information.

Base Command

file

Input

Argument Name Description Required
hash The value of the file hash for which to retrieve the reputation information. The hash type can be: “SHA256”, “SHA1”, or “MD5”. Optional
file The type of the file hash for which to retrieve the reputation information. The hash type can be: “SHA256”, “SHA1”, or “MD5”. Optional

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.
DBotScore.Indicator The indicator that was tested. String
DBotScore.Score The actual score. Number
DBotScore.Type The type of indicator. String
DBotScore.Vendor The vendor used to calculate the score. String
DBotScore.Reliability Reliability of the source providing the intelligence data. String
File.MD5 The MD5 hash of the file. String
File.SHA256 The SHA256 hash of the file. String
File.SHA1 The SHA1 hash of the file. String

Command Example

!file hash="2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe"
!file hash="2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe, 1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a"

Human Readable Output

ip

Queries PolySwarm for IP reputation information.

Base Command

ip

Input

Argument Name Description Required
ip The IP address for which to retrieve the reputation information. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Indicator String The indicator that was tested.
IP.Address String The IP address.
IP.Malicious.Vendor String For malicious files, the vendor that made the decision.
IP.MalwareFamily String The malware family associated with the IP.
IP.Tags String Tags that are associated with the IP.

Command Example

!ip ip="8.8.8.8"

url

Queries PolySwarm for URL reputation information.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url The URL for which to retrieve the reputation information. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Indicator String The indicator that was tested.
URL.Data String The URL address.
URL.Malicious.Vendor String For malicious files, the vendor that made the decision.
URL.MalwareFamily String The malware family associated with the url.
URL.Tags String Tags that are associated with the url.

Command Example

!url url="https://polyswarm.io"

Context Example

Human Readable Output

domain

Queries PolySwarm to retrieve domain reputation information.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name Description Required
domain Domain for which to retrieve the reputation information. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Indicator String The indicator that was tested.
Domain.Name String The domain name, for example: “google.com”.
Domain.Malicious.Vendor String For malicious files, the vendor that made the decision.
Domain.MalwareFamily String The malware family associated with the domain.
Domain.Tags String Tags that are associated with the domain.

Command Example

!domain domain="polyswarm.io"

Context Example

Human Readable Output

url-scan

Uploads a URL to PolySwarm and retrieves the analysis results.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url-scan

Input

Argument Name Description Required
url The URL to scan. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.

Command Example

!url-scan url="https://polyswarm.io"
!url-scan url="https://polyswarm.io, https://polyswarm.network"

Human Readable Output

file-rescan

Rescans the uploaded artifact by hash.

Base Command

file-rescan

Input

Argument Name Description Required
hash The type of the file hash to rescan. The hash type can be: “SHA256”, “SHA1”, or “MD5”. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.

Command Example

!file-rescan hash="2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe"
!file-rescan hash="2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe, 25e755c8957163376b3437ce808843c1c2598e0fb3c5f31dc958576cd5cde63e"

Human Readable Output

get-file

Downloads a file hash from PolySwarm.

Base Command

get-file

Input

Argument Name Description Required
hash The file hash type to download. The hash type can be: “SHA256”, “SHA1”, or “MD5”. Required

Context Output

Path Type Description
File.Size Number The file size.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The sample name.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The War Room entry ID of the file.
File.Info String Basic information of the file.
File.Type String File type. For example, “PE”.
File MD5 String The MD5 hash of the file.
File.Extension String The file extension.
PolySwarm.FileID String The file ID.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Indicator String The indicator that was tested.
File.Tags.TagGroups.TagGroupName String The tag’s group name.
File.Tags.Aliases String Aliases of the tags.
File.Tags.PublicTagName String The public name of the tag. This is usually used as the ID of the tag.
File.Tags.TagName String The simple name of the tag.

Command Example

!get-file hash="2410907a92b16dbd23a88d6bbd5037eae20eea809279f370293b587e1996eafe

Human Readable Output

file-scan

Uploads a file to PolySwarm and retrieves the analysis results.

Base Command

file-scan

Input

Argument Name Description Required
entryID The War Room entry ID of the file. Required

Context Output

Path Type Description
PolySwarm.Total Number The total number of scans.
PolySwarm.Permalink String PolySwarm permalink results.
PolySwarm.Positives Number The total number of positives found.
PolySwarm.Scan_UUID String The PolySwarm scan UUID.
PolySwarm.Artifact String The artifact queried.

Command Example

!file-scan entryID="995@0c42ee2d-57ff-4ccf-88ef-8d51c7936595"

Human Readable Output

Configuration parameters

  • api_key — PolySwarm API Key (required)
  • base_url — The base URL to connect to (required)
  • PolySwarm_v2 — PolySwarm v2 Community (required)
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (9)

  • domain

    Queries PolySwarm to retrieve domain reputation information.

  • file

    Queries PolySwarm for file reputation information.

  • file-rescan

    Rescans the uploaded artifact by hash.

  • file-scan

    Uploads a file to PolySwarm and retrieves the analysis results.

  • get-file

    Downloads a file hash from PolySwarm.

  • ip

    Queries PolySwarm for IP reputation information.

  • polyswarm-get-report

    Returns a report using the UUID (SHA256).

  • url

    Queries PolySwarm for URL reputation information.

  • url-scan

    Uploads a URL to PolySwarm and retrieves the analysis results.

Source

PolySwarmV2.py PolySwarmV2_test.py PolySwarmV2.yml PolySwarmV2_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: PolySwarm
sectionorder:
- Connect
commonfields:
  id: PolySwarmV2
  version: -1
configuration:
- display: PolySwarm API Key
  name: api_key
  required: true
  type: 4
  section: Connect
- display: The base URL to connect to
  name: base_url
  defaultvalue: https://api.polyswarm.network/v3/
  required: true
  type: 0
  section: Connect
- display: PolySwarm v2 Community
  name: PolySwarm_v2
  defaultvalue: default
  required: true
  type: 0
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Connect
  advanced: true
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Connect
  advanced: true
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  additionalinfo: the segment of PolySwarm's marketplace to query on.
  required: false
  section: Connect
  advanced: true
description: Real-time threat intelligence from a crowd-sourced network of security experts and antivirus companies.
display: PolySwarm
name: PolySwarmV2
script:
  commands:
  - arguments:
    - default: true
      description: UUID string (SHA256).
      name: scan_uuid
      required: true
    description: Returns a report using the UUID (SHA256).
    name: polyswarm-get-report
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID (SHA256).
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
  - arguments:
    - description: 'The value of the file hash for which to retrieve the reputation information. The hash type can be: "SHA256", "SHA1", or "MD5".'
      name: hash
    - default: true
      description: 'The type of the file hash for which to retrieve the reputation information. The hash type can be: "SHA256", "SHA1", or "MD5".'
      isArray: true
      name: file
    description: Queries PolySwarm for file reputation information.
    name: file
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
  - arguments:
    - default: true
      description: The IP address for which to retrieve the reputation information.
      isArray: true
      name: ip
      required: true
    description: Queries PolySwarm for IP reputation information.
    name: ip
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: IP.MalwareFamily
      description: The malware family associated with the IP.
      type: String
    - contextPath: IP.Tags
      description: Tags that are associated with the IP.
      type: String
  - arguments:
    - default: true
      description: The URL for which to retrieve the reputation information.
      name: url
      required: true
    description: Queries PolySwarm for URL reputation information.
    name: url
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: URL.Data
      description: The URL address.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: URL.MalwareFamily
      description: The malware family associated with the url.
      type: String
    - contextPath: URL.Tags
      description: Tags that are associated with the url.
      type: String
  - arguments:
    - default: true
      description: Domain for which to retrieve the reputation information.
      isArray: true
      name: domain
      required: true
    description: Queries PolySwarm to retrieve domain reputation information.
    name: domain
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: Domain.MalwareFamily
      description: The malware family associated with the domain.
      type: String
    - contextPath: Domain.Tags
      description: Tags that are associated with the domain.
      type: String
  - arguments:
    - default: true
      description: The URL to scan.
      isArray: true
      name: url
      required: true
    description: Uploads a URL to PolySwarm and retrieves the analysis results.
    name: url-scan
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
  - arguments:
    - description: 'The type of the file hash to rescan. The hash type can be: "SHA256", "SHA1", or "MD5".'
      name: hash
      required: true
    description: Rescans the uploaded artifact by hash.
    name: file-rescan
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
  - arguments:
    - default: true
      description: 'The file hash type to download. The hash type can be: "SHA256", "SHA1", or "MD5".'
      name: hash
      required: true
    description: Downloads a file hash from PolySwarm.
    name: get-file
    outputs:
    - contextPath: File.Size
      description: The file size.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The sample name.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The War Room entry ID of the file.
      type: String
    - contextPath: File.Info
      description: Basic information of the file.
      type: String
    - contextPath: File.Type
      description: File type. For example, "PE".
      type: String
    - contextPath: File MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
    - contextPath: PolySwarm.FileID
      description: The file ID.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.Tags.TagGroups.TagGroupName
      description: The tag's group name.
      type: String
    - contextPath: File.Tags.Aliases
      description: Aliases of the tags.
      type: String
    - contextPath: File.Tags.PublicTagName
      description: The public name of the tag. This is usually used as the ID of the tag.
      type: String
    - contextPath: File.Tags.TagName
      description: The simple name of the tag.
      type: String
  - arguments:
    - default: true
      description: The War Room entry ID of the file.
      name: entryID
      required: true
    description: Uploads a file to PolySwarm and retrieves the analysis results.
    name: file-scan
    outputs:
    - contextPath: PolySwarm.Total
      description: The total number of scans.
      type: Number
    - contextPath: PolySwarm.Permalink
      description: PolySwarm permalink results.
      type: String
    - contextPath: PolySwarm.Positives
      description: The total number of positives found.
      type: Number
    - contextPath: PolySwarm.Scan_UUID
      description: The PolySwarm scan UUID.
      type: String
    - contextPath: PolySwarm.Artifact
      description: The artifact queried.
      type: String
  runonce: false
  script: '-'
  subtype: python3
  type: python
  dockerimage: demisto/polyswarm:1.0.0.6911470
fromversion: 5.0.0
tests:
- No tests (auto formatted)