QutteraWebsiteMalwareScanner

Details

ID	`QutteraWebsiteMalwareScanner`
Provider	Quttera
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Quttera Website Malware Scanner
This integration was integrated and tested with version v3 of QutteraWebsiteMalwareScanner

Configure QutteraWebsiteMalwareScanner in Cortex

Parameter	Required
API Key	True
Quttera Scanner URL	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

quttera-scan-start

Start to scan a given domain

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

quttera-scan-start

Input

Argument Name	Description	Required
domain	The name of the domain to scan.	Required

Context Output

Path	Type	Description
QutteraWebsiteMalwareScanning.Start.error	Number	HTTP response from the scanner
QutteraWebsiteMalwareScanning.Start.errorstr	String	Status of the scan request

quttera-rescan-status

Retrieve status of submitted domain

Base Command

quttera-rescan-status

Input

Argument Name	Description	Required
domain	The name of the domain to retrieve its status.	Required

Context Output

Path	Type	Description
QutteraWebsiteMalwareScanning.Status.error	Number	Scan result request status
QutteraWebsiteMalwareScanning.Status.errorstr	String	Scan result request description
QutteraWebsiteMalwareScanning.Status.status.blacklisted	String	Is the domain blacklisted
QutteraWebsiteMalwareScanning.Status.status.files	Number	Amount of scanned files
QutteraWebsiteMalwareScanning.Status.status.scanner_result	String	Scan result
QutteraWebsiteMalwareScanning.Status.status.sensitivity	String	Sensitivity
QutteraWebsiteMalwareScanning.Status.status.state	String	Is scanning done
QutteraWebsiteMalwareScanning.Status.status.time	String	Time
QutteraWebsiteMalwareScanning.Status.status.url	String	Scanned URL

quttera-scan-report

Retrieve report of submitted domain

Base Command

quttera-scan-report

Input

Argument Name	Description	Required
domain	The name of the domain to retrieve its report.	Required

Context Output

Path	Type	Description
QutteraWebsiteMalwareScanning.report.error	Number	Retrieving domain scan return code
QutteraWebsiteMalwareScanning.report.errorstr	String	Retrieving domain scan report state
QutteraWebsiteMalwareScanning.report.status	Dict	Detailed domain scan report
QutteraWebsiteMalwareScanning.report.status.blacklisted	String	Is domain blacklisted
QutteraWebsiteMalwareScanning.report.status.files	Number	How many files were scanned
QutteraWebsiteMalwareScanning.report.status.scanner_result	String	Scanner result
QutteraWebsiteMalwareScanning.report.status.sensitivity	String	Domain sensitivity
QutteraWebsiteMalwareScanning.report.status.state	String	State of the domain
QutteraWebsiteMalwareScanning.report.status.time	String	Scan time
QutteraWebsiteMalwareScanning.report.status.url	String	Scanned URL

quttera-report-malware

Retrieve url blacklist and reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

quttera-report-malware

Input

Argument Name	Description	Required
url	URL to retrieve its blacklist and reputation.	Required

Context Output

Path	Type	Description
QutteraWebsiteMalwareScanning.report	Dict	Retrieving url blacklist and reputation

quttera-status-blacklist

Retrieve domain blacklist and reputation

Base Command

quttera-status-blacklist

Input

Argument Name	Description	Required
domain	The name of the domain to retrieve its blacklist and reputation.	Required

Context Output

Path	Type	Description
QutteraWebsiteMalwareScanning.report	Dict	Retrieving domain blacklist and reputation

Configuration parameters

apikey — API Key (required)
base_url — Quttera Scanner URL (required)

Commands (5)

quttera-report-malware
Retrieve url blacklist and reputation.
quttera-rescan-status
Retrieve status of submitted domain.
quttera-scan-report
Retrieve report of submitted domain.
quttera-scan-start
Start to scan a given domain.
quttera-status-blacklist
Retrieve domain blacklist and reputation.

Source

QutteraWebsiteMalwareScanner.py QutteraWebsiteMalwareScanner_test.py QutteraWebsiteMalwareScanner.yml QutteraWebsiteMalwareScanner_description.md command_examples.txt

Download History Raw

sectionorder:
- Connect
- Collect
commonfields:
  id: QutteraWebsiteMalwareScanner
  version: -1
name: QutteraWebsiteMalwareScanner
display: QutteraWebsiteMalwareScanner
category: Data Enrichment & Threat Intelligence
provider: Quttera
description: Quttera Website Malware Scanner.
detaileddescription: |-
  Interact with Quttera Website Malware Scanner
  API to perform real-time/on-demand recursive
  scan of a domain or URL,
  retrieve malware scan report and blacklisting information.
configuration:
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Quttera Scanner URL
  name: base_url
  required: true
  defaultvalue: "https://scannerapi.quttera.com"
  type: 0
  section: Connect
script:
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  script: ''
  commands:
  - name: quttera-scan-start
    arguments:
    - name: domain
      required: true
      default: true
      description: The name of the domain to scan.
    outputs:
    - contextPath: QutteraWebsiteMalwareScanning.Start.error
      description: 'HTTP response from the scanner.'
      type: Number
    - contextPath: QutteraWebsiteMalwareScanning.Start.errorstr
      description: 'Status of the scan request.'
      type: String
    description: Start to scan a given domain.
  - name: quttera-rescan-status
    arguments:
    - name: domain
      required: true
      default: true
      description: The name of the domain to retrieve its status.
    outputs:
    - contextPath: QutteraWebsiteMalwareScanning.Status.error
      description: Scan result request status.
      type: Number
    - contextPath: QutteraWebsiteMalwareScanning.Status.errorstr
      description: Scan result request description.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.blacklisted
      description: Is the domain blacklisted.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.files
      description: Amount of scanned files.
      type: Number
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.scanner_result
      description: Scan result.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.sensitivity
      description: Sensitivity.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.state
      description: Is scanning done.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.time
      description: Time.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.Status.status.url
      description: Scanned URL.
      type: String
    description: Retrieve status of submitted domain.
  - name: quttera-scan-report
    arguments:
    - name: domain
      required: true
      default: true
      description: The name of the domain to retrieve its report.
    outputs:
    - contextPath: QutteraWebsiteMalwareScanning.report.error
      description: Retrieving domain scan return code.
      type: Number
    - contextPath: QutteraWebsiteMalwareScanning.report.errorstr
      description: Retrieving domain scan report state.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status
      description: Detailed domain scan report.
      type: Dict
    - contextPath: QutteraWebsiteMalwareScanning.report.status.blacklisted
      description: Is domain blacklisted.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status.files
      description: How many files were scanned.
      type: Number
    - contextPath: QutteraWebsiteMalwareScanning.report.status.scanner_result
      description: Scanner result.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status.sensitivity
      description: Domain sensitivity.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status.state
      description: State of the domain.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status.time
      description: Scan time.
      type: String
    - contextPath: QutteraWebsiteMalwareScanning.report.status.url
      description: Scanned URL.
      type: String
    description: Retrieve report of submitted domain.
  - name: quttera-report-malware
    arguments:
    - name: url
      required: true
      default: true
      description: URL to retrieve its blacklist and reputation.
    outputs:
    - contextPath: QutteraWebsiteMalwareScanning.report
      description: Retrieving url blacklist and reputation.
      type: Dict
    description: Retrieve url blacklist and reputation.
  - name: quttera-status-blacklist
    arguments:
    - name: domain
      required: true
      default: true
      description: The name of the domain to retrieve its blacklist and reputation.
    outputs:
    - contextPath: QutteraWebsiteMalwareScanning.report
      description: Retrieving domain blacklist and reputation.
      type: Dict
    description: Retrieve domain blacklist and reputation.
fromversion: 6.0.0
tests:
- No tests (auto formatted)