QintelQSentry

QSentry queries help measure the likelihood that a user is masking their identity using publicly or privately available proxy or VPN services. The returns also flag any known fraud associations. QSentry aggregates data from Qintel’s proprietary Deep and DarkWeb research, as well as from commercially available anonymization services.

Data Enrichment & Threat Intelligence · Qintel

Details

IDQintelQSentry
ProviderQintel
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

QSentry queries help measure the likelihood that a user is masking their identity using publicly or privately available proxy or VPN services. The returns also flag any known fraud associations. QSentry aggregates data from Qintel’s proprietary Deep and DarkWeb research, as well as from commercially available anonymization services.
This integration was integrated and tested with version 4.0 of Qintel QSentry

Configure QintelQSentry in Cortex

Parameter Required
QSentry API URL (optional) False
Qintel Token True
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Queries Qintel for IP reputation data

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested
DBotScore.Type String The indicator type
DBotScore.Vendor String The vendor used to calculate the score
DBotScore.Score Number The actual score
IP.Address string IP address
IP.ASN string The autonomous system name for the IP address
IP.ASOwner string The autonomous system name for the IP address
IP.Malicious.Vendor string The vendor reporting the IP address as malicious
IP.Malicious.Description string A description explaining why the IP address was reported as malicious
Qintel.IP.Address boolean IP address
Qintel.IP.Tags string Proxy tags
Qintel.IP.Description string IP description
Qintel.IP.LastObserved string Last observed time

Command Example

!ip ip=192.168.35.100

Context Example

{
    "DBotScore": {
        "Indicator": "192.168.35.100",
        "Score": 2,
        "Type": "ip",
        "Vendor": "Qintel"
    },
    "IP": {
        "ASN": 65000,
        "ASOwner": "Some Service Provider",
        "Address": "192.168.35.100",
        "Malicious": {
            "Description": "Indicator is associated with a criminal proxy/vpn",
            "Vendor": "Qintel"
        },
        "Tags": [
            "Proxy",
            "Vpn"
        ]
    },
    "Qintel": {
        "IP": {
            "Address": "192.168.35.100",
            "Description": [
                "this ip address has been associated with a vpn network that offers paid access to users. it is advertised in online underground spaces.",
                "This ip address has been associated with a proxy network that offers paid access to users and is advertised within the online underground. it is commonly utilized by criminal actors to conduct compromised credential checking and the proxy network is hosted on a botnet infrastructure. ip address is likely an infected machine."
            ],
            "LastObserved": "2021-08-31 11:00:00",
            "Tags": [
                "Proxy",
                "Vpn"
            ]
        }
    }
}

Human Readable Output

Qintel results for IP: 192.168.35.100

ASN AS Owner Tags Description Last Observed
65000 Some Service Provider
Proxy,
Vpn		 This ip address has been associated with a vpn network that offers paid access to users. it is advertised in online underground spaces.,
This ip address has been associated with a proxy network that offers paid access to users and is advertised within the online underground. it is commonly utilized by criminal actors to conduct compromised credential checking and the proxy network is hosted on a botnet infrastructure. ip address is likely an infected machine.		 2021-08-31 11:00:00

Configuration parameters

  • remote — QSentry API URL (optional)
  • token — Qintel Token (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (1)

  • ip

    Queries Qintel for IP reputation data.

Source

QintelQSentry.py QintelQSentry_test.py QintelQSentry.yml QintelQSentry_description.md
Download History Raw 
"""Qintel QSentry Integration for Cortex XSOAR - Unit Tests file"""

import json

MOCK_URL = "https://this-is-only-a-test.local"
MOCK_CLIENT_ID = "client-id"
MOCK_CLIENT_SECRET = "client-secret"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_make_timestamp():
    from datetime import datetime

    from QintelQSentry import _make_timestamp

    res = _make_timestamp(None)
    assert res is None

    res = _make_timestamp(1626211855)
    assert isinstance(res, datetime)
    assert res.isoformat() == "2021-07-13T21:30:55"

    res = _make_timestamp("2021-07-13T21:30:55")
    assert isinstance(res, datetime)
    assert int(res.timestamp()) == 1626211855


def test_test_module(mocker):
    """Tests test-module command function with valid response.

    Checks the output of the command function with the expected output.
    """

    from QintelQSentry import Client, test_module

    client = Client(base_url=MOCK_URL, verify=False, client_id=MOCK_CLIENT_ID, client_secret=MOCK_CLIENT_SECRET)

    mock_response = util_load_json("test_data/test_module.json")
    mocker.patch.object(Client, "_http_request", return_value=mock_response)

    response = test_module(client)

    assert response == "ok"


def test_ip_command(mocker):
    """Tests ip reputation command function with valid response.

    Checks the output of the command function with the expected output.
    """

    from QintelQSentry import Client, ip_command

    client = Client(base_url=MOCK_URL, verify=False, client_id=MOCK_CLIENT_ID, client_secret=MOCK_CLIENT_SECRET)

    mock_response = util_load_json("test_data/ip_command.json")
    mocker.patch.object(Client, "_http_request", return_value=mock_response)

    args = {
        "ip": "192.168.35.100",
    }

    response = ip_command(client, args)

    assert len(response) == 1

    outputs = response[0].outputs
    hr = response[0].readable_output
    prefix = response[0].outputs_prefix

    assert prefix == "Qintel.IP"

    assert "Qintel results for IP: 192.168.35.100" in hr
    assert "|ASN|AS Owner|Tags|Description|Last Observed|" in hr
    assert "| 65000 | Some Service Provider | Criminal,<br>Proxy,<br>Vpn |" in hr

    assert outputs["Address"] == "192.168.35.100"
    assert outputs["Tags"] == ["Criminal", "Proxy", "Vpn"]
    assert len(outputs["Description"]) == 4
    assert outputs["LastObserved"] == "2021-07-29 11:00:00"