RelayShield
RelayShield real-time identity-compromise and agent-security threat intelligence. Implements the generic `domain`/`ip`/`email` reputation commands (auto-invoked by existing enrichment playbooks) plus RelayShield-specific commands for MCP server registry risk, certificate expiry, and supply-chain vendor risk. "No known finding" from any command means nothing was flagged in the sources RelayShield actually queried. It is deliberately never mapped to a "Good" DBotScore, since that would claim more certainty than the data supports. See the README's DBotScore section for the exact mapping.
Data Enrichment & Threat Intelligence · RelayShield
Details
| ID | RelayShield |
|---|---|
| Provider | RelayShield |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.8.0 |
| Docker Image | demisto/python3:3.12.14.12343672 |
README
RelayShield real-time identity-compromise and agent-security threat intelligence.
This integration implements the generic domain, ip, and email reputation commands,
which are automatically invoked by any existing enrichment playbook that calls generic
reputation commands, with no playbook changes needed. It adds three RelayShield-specific
commands for MCP server registry risk, certificate expiry, and supply-chain vendor risk.
This integration was integrated and tested with version 1.0 of the RelayShield API.
Configure RelayShield in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | The RelayShield API base URL. | True |
| API Key | The RelayShield API key, sent as the X-RS-API-KEY header. |
True |
| Trust any certificate (not secure) | Whether to trust any TLS certificate. | False |
| Use system proxy settings | Whether to route requests through the system proxy. | False |
| Source Reliability | Reliability of the source providing the intelligence data. | False |
DBotScore mapping
A clean result (“no known finding”) maps to DBotScore Unknown (0), never Good (1).
“No known finding” means nothing was flagged in the sources RelayShield actually queried,
which is not a verified-safe guarantee.
| RelayShield verdict | DBotScore |
|---|---|
| CRITICAL | 3 (Bad) |
| HIGH | 3 (Bad) |
| MEDIUM | 2 (Suspicious) |
| LOW | 2 (Suspicious) |
| No known finding | 0 (Unknown) |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the
command details.
domain
Check a domain for phishing-lookalike/typosquat risk, presence in RelayShield’s criminal IOC corpus, and set a DBotScore.
Base Command
domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | A comma-separated list of domains to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.Domain.queried | String | The domain queried. |
| RelayShield.Domain.verdict | String | The RelayShield verdict (CRITICAL/HIGH/MEDIUM/LOW), absent if no known finding. |
| RelayShield.Domain.findings | Unknown | The list of findings, if any. |
| Domain.Name | String | The domain name. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | The reliability of the source providing the intelligence data. |
ip
Check an IP address for reputation, malicious/suspicious votes, and set a DBotScore.
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | A comma-separated list of IP addresses to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.IP.queried | String | The IP address queried. |
| RelayShield.IP.reputation | Number | The community reputation score. |
| RelayShield.IP.malicious_votes | Number | The malicious vote count. |
| IP.Address | String | The IP address. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | The reliability of the source providing the intelligence data. |
Check an email address for breach exposure and active stolen-session risk, and set a DBotScore.
Base Command
email
Input
| Argument Name | Description | Required |
|---|---|---|
| A comma-separated list of email addresses to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.Email.queried | String | The email address queried. |
| RelayShield.Email.breach_found | Boolean | Whether the email address appears in a known breach. |
| RelayShield.Email.breach_sources | Unknown | The list of breach sources the email address was found in. |
| RelayShield.Email.session_risk_found | Boolean | Whether an active stolen session was found. |
| RelayShield.Email.sessions | Unknown | The list of stolen sessions found, if any. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | The reliability of the source providing the intelligence data. |
relayshield-mcp-registry-risk
Assess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it.
Base Command
relayshield-mcp-registry-risk
Input
| Argument Name | Description | Required |
|---|---|---|
| server_url | The full URL of the MCP server to check. Provide this or package_name. | Optional |
| package_name | The package name of the MCP server if no server_url is available. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.MCPRegistryRisk.queried | String | The server URL or package name queried. |
| RelayShield.MCPRegistryRisk.verdict | String | The RelayShield verdict, absent if no known finding. |
| RelayShield.MCPRegistryRisk.findings | Unknown | The list of findings, if any. |
relayshield-cert-expiry
Check a domain’s TLS certificate expiry risk.
Base Command
relayshield-cert-expiry
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | The domain to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.CertExpiry.domain | String | The domain checked. |
| RelayShield.CertExpiry.days_remaining | Number | The days until certificate expiry. |
| RelayShield.CertExpiry.risk_level | String | The risk level (CRITICAL/HIGH/MEDIUM/LOW). |
relayshield-supply-chain
Check up to 10 vendor domains (or emails) for combined breach/infostealer risk.
Base Command
relayshield-supply-chain
Input
| Argument Name | Description | Required |
|---|---|---|
| vendor_domains | A comma-separated list of up to 10 vendor domains to check. Provide this or vendor_emails. | Optional |
| vendor_emails | A comma-separated list of vendor email addresses. The domain portion is extracted automatically. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RelayShield.SupplyChain.domains_checked | Number | The number of vendor domains checked. |
| RelayShield.SupplyChain.highest_risk | String | The highest risk level found across all vendors checked. |
| RelayShield.SupplyChain.critical_vendors | Unknown | The list of vendors flagged as critical risk. |
Configuration parameters
url— Server URL (required)credentials— API Key (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsintegrationReliability— Source Reliability
Commands (6)
-
domainCheck a domain for phishing-lookalike/typosquat risk, presence in RelayShield's criminal IOC corpus, and set a DBotScore.
-
emailCheck an email address for breach exposure and active stolen-session risk, and set a DBotScore.
-
ipCheck an IP address for reputation, malicious/suspicious votes, and set a DBotScore.
-
relayshield-cert-expiryCheck a domain's TLS certificate expiry risk.
-
relayshield-mcp-registry-riskAssess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it.
-
relayshield-supply-chainCheck up to 10 vendor domains (or emails) for combined breach/infostealer risk.
## RelayShield To use this integration you need a RelayShield API key. RelayShield authenticates every request with a single API key sent in the `X-RS-API-KEY` header. There are no OAuth flows, tenant IDs, or additional permissions to grant. ### Get your API key 1. Go to [api.relayshield.net/developers](https://api.relayshield.net/developers). 2. Enter the email address the key should be issued to and submit the signup form. 3. Complete the self-serve signup. Pay-as-you-go is available with no subscription or monthly minimum. 4. Copy the API key from the confirmation page. It begins with `rs_live_`. The key is also emailed to the address you entered. ### Configure the integration instance in Cortex 1. Leave **Server URL** at `https://api.relayshield.net` unless you have been given a dedicated endpoint. 2. Paste the key from step 4 above into the **API Key** field. 3. Click **Test** to verify the connection. The test performs a single live domain lookup against your key. ### Required permissions The API key must be entitled to the endpoints backing the commands you intend to run: | Command | Endpoint | | --- | --- | | `domain` | `/v1/metered/domain` | | `ip` | `/v1/metered/ip-intel` | | `email` | `/v1/metered/breach`, `/v1/metered/session-risk` | | `relayshield-mcp-registry-risk` | `/v1/metered/mcp-registry-risk` | | `relayshield-cert-expiry` | `/v1/metered/cert-expiry` | | `relayshield-supply-chain` | `/v1/metered/supply-chain` | Self-serve pay-as-you-go keys are entitled to all six by default. ### DBotScore mapping A clean result ("no known finding") is mapped to DBotScore **Unknown (0)**, never **Good (1)**. "No known finding" means nothing was flagged in the sources RelayShield actually queried. It is not a verified-safe guarantee, and treating it as "Good" would claim more certainty than the underlying data supports. CRITICAL/HIGH findings map to **Bad (3)**, MEDIUM/LOW findings map to **Suspicious (2)**. This means RelayShield does not contribute a "clean" vote to a Cortex playbook's aggregate "all sources clean, auto-close" logic. Only a genuine finding moves the needle. ### Troubleshooting - **Test fails with an authorization error.** Confirm the key was copied in full and begins with `rs_live_`. Keys are deactivated when the underlying subscription is cancelled. - **Test fails with a connection or timeout error.** Confirm the Cortex engine can reach `https://api.relayshield.net` over HTTPS on port 443. If outbound traffic is proxied, enable **Use system proxy settings**. - **A command returns "no known finding" for an indicator you expect to be flagged.** This is a clean result, not an error. RelayShield reports only on sources it queried; see the DBotScore mapping above. - **A command fails with a quota or payment error.** Check the balance and entitlements on your account at [api.relayshield.net/developers](https://api.relayshield.net/developers). For anything else, contact [support@relayshield.net](mailto:support@relayshield.net).