RelayShield

RelayShield real-time identity-compromise and agent-security threat intelligence. Implements the generic `domain`/`ip`/`email` reputation commands (auto-invoked by existing enrichment playbooks) plus RelayShield-specific commands for MCP server registry risk, certificate expiry, and supply-chain vendor risk. "No known finding" from any command means nothing was flagged in the sources RelayShield actually queried. It is deliberately never mapped to a "Good" DBotScore, since that would claim more certainty than the data supports. See the README's DBotScore section for the exact mapping.

Data Enrichment & Threat Intelligence · RelayShield

Details

IDRelayShield
ProviderRelayShield
CategoryData Enrichment & Threat Intelligence
From Version6.8.0
Docker Imagedemisto/python3:3.12.14.12343672

README

RelayShield real-time identity-compromise and agent-security threat intelligence.

This integration implements the generic domain, ip, and email reputation commands,
which are automatically invoked by any existing enrichment playbook that calls generic
reputation commands, with no playbook changes needed. It adds three RelayShield-specific
commands for MCP server registry risk, certificate expiry, and supply-chain vendor risk.

This integration was integrated and tested with version 1.0 of the RelayShield API.

Configure RelayShield in Cortex

Parameter Description Required
Server URL The RelayShield API base URL. True
API Key The RelayShield API key, sent as the X-RS-API-KEY header. True
Trust any certificate (not secure) Whether to trust any TLS certificate. False
Use system proxy settings Whether to route requests through the system proxy. False
Source Reliability Reliability of the source providing the intelligence data. False

DBotScore mapping

A clean result (“no known finding”) maps to DBotScore Unknown (0), never Good (1).
“No known finding” means nothing was flagged in the sources RelayShield actually queried,
which is not a verified-safe guarantee.

RelayShield verdict DBotScore
CRITICAL 3 (Bad)
HIGH 3 (Bad)
MEDIUM 2 (Suspicious)
LOW 2 (Suspicious)
No known finding 0 (Unknown)

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the
command details.

domain

Check a domain for phishing-lookalike/typosquat risk, presence in RelayShield’s criminal IOC corpus, and set a DBotScore.

Base Command

domain

Input

Argument Name Description Required
domain A comma-separated list of domains to check. Required

Context Output

Path Type Description
RelayShield.Domain.queried String The domain queried.
RelayShield.Domain.verdict String The RelayShield verdict (CRITICAL/HIGH/MEDIUM/LOW), absent if no known finding.
RelayShield.Domain.findings Unknown The list of findings, if any.
Domain.Name String The domain name.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String The reliability of the source providing the intelligence data.

ip

Check an IP address for reputation, malicious/suspicious votes, and set a DBotScore.

Base Command

ip

Input

Argument Name Description Required
ip A comma-separated list of IP addresses to check. Required

Context Output

Path Type Description
RelayShield.IP.queried String The IP address queried.
RelayShield.IP.reputation Number The community reputation score.
RelayShield.IP.malicious_votes Number The malicious vote count.
IP.Address String The IP address.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String The reliability of the source providing the intelligence data.

email

Check an email address for breach exposure and active stolen-session risk, and set a DBotScore.

Base Command

email

Input

Argument Name Description Required
email A comma-separated list of email addresses to check. Required

Context Output

Path Type Description
RelayShield.Email.queried String The email address queried.
RelayShield.Email.breach_found Boolean Whether the email address appears in a known breach.
RelayShield.Email.breach_sources Unknown The list of breach sources the email address was found in.
RelayShield.Email.session_risk_found Boolean Whether an active stolen session was found.
RelayShield.Email.sessions Unknown The list of stolen sessions found, if any.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String The reliability of the source providing the intelligence data.

relayshield-mcp-registry-risk

Assess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it.

Base Command

relayshield-mcp-registry-risk

Input

Argument Name Description Required
server_url The full URL of the MCP server to check. Provide this or package_name. Optional
package_name The package name of the MCP server if no server_url is available. Optional

Context Output

Path Type Description
RelayShield.MCPRegistryRisk.queried String The server URL or package name queried.
RelayShield.MCPRegistryRisk.verdict String The RelayShield verdict, absent if no known finding.
RelayShield.MCPRegistryRisk.findings Unknown The list of findings, if any.

relayshield-cert-expiry

Check a domain’s TLS certificate expiry risk.

Base Command

relayshield-cert-expiry

Input

Argument Name Description Required
domain The domain to check. Required

Context Output

Path Type Description
RelayShield.CertExpiry.domain String The domain checked.
RelayShield.CertExpiry.days_remaining Number The days until certificate expiry.
RelayShield.CertExpiry.risk_level String The risk level (CRITICAL/HIGH/MEDIUM/LOW).

relayshield-supply-chain

Check up to 10 vendor domains (or emails) for combined breach/infostealer risk.

Base Command

relayshield-supply-chain

Input

Argument Name Description Required
vendor_domains A comma-separated list of up to 10 vendor domains to check. Provide this or vendor_emails. Optional
vendor_emails A comma-separated list of vendor email addresses. The domain portion is extracted automatically. Optional

Context Output

Path Type Description
RelayShield.SupplyChain.domains_checked Number The number of vendor domains checked.
RelayShield.SupplyChain.highest_risk String The highest risk level found across all vendors checked.
RelayShield.SupplyChain.critical_vendors Unknown The list of vendors flagged as critical risk.

Configuration parameters

  • url — Server URL (required)
  • credentials — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability

Commands (6)

  • domain

    Check a domain for phishing-lookalike/typosquat risk, presence in RelayShield's criminal IOC corpus, and set a DBotScore.

  • email

    Check an email address for breach exposure and active stolen-session risk, and set a DBotScore.

  • ip

    Check an IP address for reputation, malicious/suspicious votes, and set a DBotScore.

  • relayshield-cert-expiry

    Check a domain's TLS certificate expiry risk.

  • relayshield-mcp-registry-risk

    Assess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it.

  • relayshield-supply-chain

    Check up to 10 vendor domains (or emails) for combined breach/infostealer risk.

Source

RelayShield.py RelayShield_test.py RelayShield.yml RelayShield_description.md
Download History Raw 
name: RelayShield
display: RelayShield
category: Data Enrichment & Threat Intelligence
provider: RelayShield
commonfields:
  id: RelayShield
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL
  name: url
  defaultvalue: https://api.relayshield.net
  type: 0
  required: true
  section: Connect
- display: API Key
  name: credentials
  type: 9
  displaypassword: API Key
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Source Reliability
  name: integrationReliability
  defaultvalue: B - Usually reliable
  type: 15
  required: false
  additionalinfo: Reliability of the source providing the intelligence data.
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
description: |-
  RelayShield real-time identity-compromise and agent-security threat intelligence.
  Implements the generic `domain`/`ip`/`email` reputation commands (auto-invoked by
  existing enrichment playbooks) plus RelayShield-specific commands for MCP server
  registry risk, certificate expiry, and supply-chain vendor risk.

  "No known finding" from any command means nothing was flagged in the sources
  RelayShield actually queried. It is deliberately never mapped to a "Good" DBotScore,
  since that would claim more certainty than the data supports. See the README's
  DBotScore section for the exact mapping.
script:
  commands:
  - name: domain
    description: Check a domain for phishing-lookalike/typosquat risk, presence in RelayShield's criminal IOC corpus, and set a DBotScore.
    arguments:
    - name: domain
      default: true
      required: true
      isArray: true
      description: A comma-separated list of domains to check.
    outputs:
    - contextPath: RelayShield.Domain.queried
      description: The domain queried.
      type: String
    - contextPath: RelayShield.Domain.verdict
      description: The RelayShield verdict (CRITICAL/HIGH/MEDIUM/LOW), absent if no known finding.
      type: String
    - contextPath: RelayShield.Domain.findings
      description: The list of findings, if any.
      type: Unknown
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
  - name: ip
    description: Check an IP address for reputation, malicious/suspicious votes, and set a DBotScore.
    arguments:
    - name: ip
      default: true
      required: true
      isArray: true
      description: A comma-separated list of IP addresses to check.
    outputs:
    - contextPath: RelayShield.IP.queried
      description: The IP address queried.
      type: String
    - contextPath: RelayShield.IP.reputation
      description: The community reputation score.
      type: Number
    - contextPath: RelayShield.IP.malicious_votes
      description: The malicious vote count.
      type: Number
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
  - name: email
    description: Check an email address for breach exposure and active stolen-session risk, and set a DBotScore.
    arguments:
    - name: email
      default: true
      required: true
      isArray: true
      description: A comma-separated list of email addresses to check.
    outputs:
    - contextPath: RelayShield.Email.queried
      description: The email address queried.
      type: String
    - contextPath: RelayShield.Email.breach_found
      description: Whether the email address appears in a known breach.
      type: Boolean
    - contextPath: RelayShield.Email.breach_sources
      description: The list of breach sources the email address was found in.
      type: Unknown
    - contextPath: RelayShield.Email.session_risk_found
      description: Whether an active stolen session was found.
      type: Boolean
    - contextPath: RelayShield.Email.sessions
      description: The list of stolen sessions found, if any.
      type: Unknown
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
  - name: relayshield-mcp-registry-risk
    description: Assess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it.
    arguments:
    - name: server_url
      description: The full URL of the MCP server to check. Provide this or package_name.
    - name: package_name
      description: The package name of the MCP server if no server_url is available.
    outputs:
    - contextPath: RelayShield.MCPRegistryRisk.queried
      description: The server URL or package name queried.
      type: String
    - contextPath: RelayShield.MCPRegistryRisk.verdict
      description: The RelayShield verdict, absent if no known finding.
      type: String
    - contextPath: RelayShield.MCPRegistryRisk.findings
      description: The list of findings, if any.
      type: Unknown
  - name: relayshield-cert-expiry
    description: Check a domain's TLS certificate expiry risk.
    arguments:
    - name: domain
      required: true
      description: The domain to check.
    outputs:
    - contextPath: RelayShield.CertExpiry.domain
      description: The domain checked.
      type: String
    - contextPath: RelayShield.CertExpiry.days_remaining
      description: The days until certificate expiry.
      type: Number
    - contextPath: RelayShield.CertExpiry.risk_level
      description: The risk level (CRITICAL/HIGH/MEDIUM/LOW).
      type: String
    compliantpolicies:
    - User Soft Remediation
  - name: relayshield-supply-chain
    description: Check up to 10 vendor domains (or emails) for combined breach/infostealer risk.
    arguments:
    - name: vendor_domains
      isArray: true
      description: A comma-separated list of up to 10 vendor domains to check. Provide this or vendor_emails.
    - name: vendor_emails
      isArray: true
      description: A comma-separated list of vendor email addresses. The domain portion is extracted automatically.
    outputs:
    - contextPath: RelayShield.SupplyChain.domains_checked
      description: The number of vendor domains checked.
      type: Number
    - contextPath: RelayShield.SupplyChain.highest_risk
      description: The highest risk level found across all vendors checked.
      type: String
    - contextPath: RelayShield.SupplyChain.critical_vendors
      description: The list of vendors flagged as critical risk.
      type: Unknown
  dockerimage: demisto/python3:3.12.14.12343672
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.8.0
tests:
- No tests