Details

ID	`SOCRadarRapidReputation`
Provider	SOCRadar
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

SOCRadar Rapid Reputation

Enrich indicators (IP, Domain, URL, Hash) by obtaining reputation information via SOCRadar’s Rapid Reputation API.

This integration was integrated and tested with the latest version of SOCRadar Rapid Reputation API.

Configure SOCRadarRapidReputation on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for SOCRadarRapidReputation.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API Key	The API Key to use for connection to SOCRadar Rapid Reputation API.	True
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Whether to use XSOAR’s system proxy settings to connect to the API.	False
Source Reliability	Reliability of the source providing the intelligence data.	False

Click Test to validate API key and connection to SOCRadar Rapid Reputation API.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

How to obtain SOCRadar API key?

SOCRadar Rapid Reputation is an Advanced Intelligence API optimized for high-volume and fast reputation queries.

Licensing Model: The features of this module are licensed separately from the standard SOCRadar platform package. To use the integration, your API key must be activated with “Rapid Reputation” privileges.
Standalone Purchase: This service can be added to your existing SOCRadar subscription, or it can be purchased as a standalone key completely independent of a platform membership.
Purchase & Activation: For API authorization, pricing information, or to purchase a new key, please contact our support team at support@socradar.io.

socradar-bulk-check

🎯 NEW FEATURE - Bulk check reputation for mixed list of indicators with automatic entity type detection.

This powerful command allows you to check reputation for a mixed list of IPs, domains, URLs, and hashes in a single command. The integration automatically detects the type of each indicator and processes it accordingly.

Base Command

socradar-bulk-check

Input

Argument Name	Description	Required
indicators	Mixed list of indicators to check (IPs, domains, URLs, hashes). Automatically detects entity types. Supports comma-separated values.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.BulkCheck.Entity	String	The queried entity value.
SOCRadarRapidReputation.BulkCheck.EntityType	String	Detected type of the entity.
SOCRadarRapidReputation.BulkCheck.DetectedType	String	Auto-detected entity type.
SOCRadarRapidReputation.BulkCheck.Score	Number	Reputation score of the entity.
SOCRadarRapidReputation.BulkCheck.IsWhitelisted	Boolean	Whether the entity is whitelisted.
SOCRadarRapidReputation.BulkCheck.FindingSources	Unknown	List of threat sources that detected this entity.
SOCRadarRapidReputation.BulkCheckSummary.total	Number	Total number of indicators checked.
SOCRadarRapidReputation.BulkCheckSummary.processed	Number	Number of successfully processed indicators.
SOCRadarRapidReputation.BulkCheckSummary.failed	Number	Number of failed indicators.
SOCRadarRapidReputation.BulkCheckSummary.by_type	Unknown	Breakdown by entity type (ip, hostname, url, hash).
SOCRadarRapidReputation.BulkCheckSummary.by_score	Unknown	Breakdown by score classification (malicious, suspicious, good, unknown, whitelisted).

Command Example

!socradar-bulk-check indicators="1.1.1.1,malicious.example.com"

Use Cases for Bulk Check

Incident Response: Quickly check all IOCs extracted from a security incident

!socradar-bulk-check indicators="192.168.1.100,malware.example.com,3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

Threat Intel Feed Processing: Validate a list of indicators from threat intelligence feeds
```
!socradar-bulk-check indicators="${File.Name}"
```
Automated Playbooks: Use in playbooks to process multiple indicators in one step
```
!socradar-bulk-check indicators="${inputs.indicators}"
```
Daily Security Monitoring: Check a list of suspicious entities identified during monitoring
```
!socradar-bulk-check indicators="suspicious_ip1,suspicious_domain1,suspicious_url1"
```

Output Features

The bulk check command provides:

Summary Statistics:
- Total indicators processed
- Success/failure counts
- Breakdown by entity type (IPs, domains, URLs, hashes)
- Breakdown by threat level (malicious, suspicious, good, unknown, whitelisted)
Individual Results:
- Each indicator gets its own detailed result card
- Includes reputation score, whitelisting status, and threat sources
- Clear classification (Malicious/Suspicious/Good/Unknown)
Automatic Type Detection:
- IPs: Automatically detected (IPv4 and IPv6)
- Domains: Detected based on domain validation
- URLs: Detected by http:// or https:// prefix
- Hashes: Detected (MD5, SHA1, SHA256)
Error Handling:
- Invalid indicators are reported with clear error messages
- Processing continues even if some indicators fail
- Failed indicators don’t stop the entire batch

Human Readable Output Example

📊 Bulk Check Summary
┌─────────────────────────┬───────┐
│ Metric                  │ Count │
├─────────────────────────┼───────┤
│ Total Indicators        │ 10    │
│ Successfully Processed  │ 9     │
│ Failed                  │ 1     │
│ IPs                     │ 3     │
│ Domains                 │ 4     │
│ URLs                    │ 2     │
│ Hashes                  │ 1     │
│ Malicious               │ 2     │
│ Suspicious              │ 3     │
│ Good                    │ 3     │
│ Unknown                 │ 1     │
│ Whitelisted             │ 0     │
└─────────────────────────┴───────┘

[Followed by detailed results for each indicator]

Commands Overview

ip

Checks reputation of provided IP entities using SOCRadar Rapid Reputation API.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP entities to check reputation. (IPv4 or IPv6). Supports comma-separated values.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.IP.Entity	String	The queried IP address.
SOCRadarRapidReputation.IP.EntityType	String	Type of the entity (ip).
SOCRadarRapidReputation.IP.Score	Number	Reputation score of the IP address.
SOCRadarRapidReputation.IP.IsWhitelisted	Boolean	Whether the IP is whitelisted.
SOCRadarRapidReputation.IP.FindingSources	Unknown	List of threat sources that detected this IP.
SOCRadarRapidReputation.IP.FindingSources.SourceName	String	Name of the threat intelligence source.
SOCRadarRapidReputation.IP.FindingSources.MainCategory	String	Primary threat category.
SOCRadarRapidReputation.IP.FindingSources.MaintainerName	String	Organization maintaining the threat list.
SOCRadarRapidReputation.IP.FindingSources.FirstSeenDate	Date	First time the IP was seen on this source.
SOCRadarRapidReputation.IP.FindingSources.LastSeenDate	Date	Last time the IP was seen on this source.
SOCRadarRapidReputation.IP.FindingSources.SeenCount	Number	Number of times the IP was observed on this source.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	String	IP address

Command Example

!ip ip="1.1.1.1"

Human Readable Output

Example output showing reputation score, whitelisting status, and threat sources that have detected the IP.

domain

Checks reputation of provided domain entities using SOCRadar Rapid Reputation API.

Base Command

domain

Input

Argument Name	Description	Required
domain	Domain entities to check reputation. Supports comma-separated values.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.Domain.Entity	String	The queried domain.
SOCRadarRapidReputation.Domain.EntityType	String	Type of the entity (hostname).
SOCRadarRapidReputation.Domain.Score	Number	Reputation score of the domain.
SOCRadarRapidReputation.Domain.IsWhitelisted	Boolean	Whether the domain is whitelisted.
SOCRadarRapidReputation.Domain.FindingSources	Unknown	List of threat sources that detected this domain.
SOCRadarRapidReputation.Domain.FindingSources.SourceName	String	Name of the threat intelligence source.
SOCRadarRapidReputation.Domain.FindingSources.MainCategory	String	Primary threat category.
SOCRadarRapidReputation.Domain.FindingSources.MaintainerName	String	Organization maintaining the threat list.
SOCRadarRapidReputation.Domain.FindingSources.FirstSeenDate	Date	First time the domain was seen on this source.
SOCRadarRapidReputation.Domain.FindingSources.LastSeenDate	Date	Last time the domain was seen on this source.
SOCRadarRapidReputation.Domain.FindingSources.SeenCount	Number	Number of times the domain was observed on this source.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Domain.Name	String	Domain name

Command Example

!domain domain="example.com"

url

Checks reputation of provided URL entities using SOCRadar Rapid Reputation API.

Base Command

url

Input

Argument Name	Description	Required
url	URL entities to check reputation. Supports comma-separated values.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.URL.Entity	String	The queried URL.
SOCRadarRapidReputation.URL.EntityType	String	Type of the entity (url).
SOCRadarRapidReputation.URL.Score	Number	Reputation score of the URL.
SOCRadarRapidReputation.URL.IsWhitelisted	Boolean	Whether the URL is whitelisted.
SOCRadarRapidReputation.URL.FindingSources	Unknown	List of threat sources that detected this URL.
SOCRadarRapidReputation.URL.FindingSources.SourceName	String	Name of the threat intelligence source.
SOCRadarRapidReputation.URL.FindingSources.MainCategory	String	Primary threat category.
SOCRadarRapidReputation.URL.FindingSources.MaintainerName	String	Organization maintaining the threat list.
SOCRadarRapidReputation.URL.FindingSources.FirstSeenDate	Date	First time the URL was seen on this source.
SOCRadarRapidReputation.URL.FindingSources.LastSeenDate	Date	Last time the URL was seen on this source.
SOCRadarRapidReputation.URL.FindingSources.SeenCount	Number	Number of times the URL was observed on this source.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
URL.Data	String	URL

Command Example

!url url="https://malicious.example.com/file.exe"

file

Checks reputation of provided file hash entities using SOCRadar Rapid Reputation API.

Base Command

file

Input

Argument Name	Description	Required
file	File hash entities to check reputation. (MD5, SHA1, or SHA256). Supports comma-separated values.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.File.Entity	String	The queried file hash.
SOCRadarRapidReputation.File.EntityType	String	Type of the entity (hash).
SOCRadarRapidReputation.File.Score	Number	Reputation score of the hash.
SOCRadarRapidReputation.File.IsWhitelisted	Boolean	Whether the hash is whitelisted.
SOCRadarRapidReputation.File.FindingSources	Unknown	List of threat sources that detected this hash.
SOCRadarRapidReputation.File.FindingSources.SourceName	String	Name of the threat intelligence source.
SOCRadarRapidReputation.File.FindingSources.MainCategory	String	Primary threat category.
SOCRadarRapidReputation.File.FindingSources.MaintainerName	String	Organization maintaining the threat list.
SOCRadarRapidReputation.File.FindingSources.FirstSeenDate	Date	First time the hash was seen on this source.
SOCRadarRapidReputation.File.FindingSources.LastSeenDate	Date	Last time the hash was seen on this source.
SOCRadarRapidReputation.File.FindingSources.SeenCount	Number	Number of times the hash was observed on this source.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
File.MD5	String	MD5 hash of the file
File.SHA1	String	SHA1 hash of the file
File.SHA256	String	SHA256 hash of the file

Command Example

!file file="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

socradar-reputation

Checks reputation of any entity type using SOCRadar Rapid Reputation API. This is a generic command that can handle any supported entity type.

Base Command

socradar-reputation

Input

Argument Name	Description	Required
entity_value	Entity value to check (IP, domain, URL, or hash).	Required
entity_type	Type of entity to check. Possible values are: ip, hostname, url, hash.	Required

Context Output

Path	Type	Description
SOCRadarRapidReputation.Reputation.Entity	String	The queried entity value.
SOCRadarRapidReputation.Reputation.EntityType	String	Type of the entity.
SOCRadarRapidReputation.Reputation.Score	Number	Reputation score of the entity.
SOCRadarRapidReputation.Reputation.IsWhitelisted	Boolean	Whether the entity is whitelisted.
SOCRadarRapidReputation.Reputation.FindingSources	Unknown	List of threat sources that detected this entity.
SOCRadarRapidReputation.Reputation.FindingSources.SourceName	String	Name of the threat intelligence source.
SOCRadarRapidReputation.Reputation.FindingSources.MainCategory	String	Primary threat category.
SOCRadarRapidReputation.Reputation.FindingSources.MaintainerName	String	Organization maintaining the threat list.
SOCRadarRapidReputation.Reputation.FindingSources.FirstSeenDate	Date	First time the entity was seen on this source.
SOCRadarRapidReputation.Reputation.FindingSources.LastSeenDate	Date	Last time the entity was seen on this source.
SOCRadarRapidReputation.Reputation.FindingSources.SeenCount	Number	Number of times the entity was observed on this source.

Command Example

!socradar-reputation entity_value="37.46.210.230" entity_type="ip"
!socradar-reputation entity_value="malicious.example.com" entity_type="hostname"
!socradar-reputation entity_value="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792" entity_type="hash"

DBot Score Interpretation

The integration converts SOCRadar reputation scores to DBot scores as follows:

SOCRadar Score	DBot Score	Classification
> 80	3	Malicious
40 - 80	2	Suspicious
0 - 40	1	Good
None/0	0	Unknown

Whitelisted entities are always assigned a DBot score of 1 (Good), regardless of their reputation score.

Additional Information

Threat Intelligence Sources

The Rapid Reputation API aggregates data from multiple threat intelligence sources, including:

CTU AIPP Blacklist
Abuse.ch URLhaus
Malware feeds
Botnet C&C lists
And many more

Each finding source provides detailed information about when and how many times the entity was observed.

Use Cases

Incident Response: Quickly check if an IP, domain, or URL involved in an incident is known to be malicious
Threat Hunting: Proactively search for indicators of compromise in your environment
Automated Playbooks: Integrate reputation checks into your security automation workflows
Alert Enrichment: Enhance security alerts with threat intelligence context

Best Practices

Use the generic socradar-reputation command when you need flexibility in entity type
Use specific commands (ip, domain, url, file) when you know the entity type for better context integration
Monitor the FindingSources field to understand which threat intelligence feeds detected the entity
Pay attention to the FirstSeenDate and LastSeenDate to understand the timeline of malicious activity

Configuration parameters

apikey — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (6)

domain
Checks reputation of provided domain entities using SOCRadar Rapid Reputation API.
file
Checks reputation of provided file hash entities using SOCRadar Rapid Reputation API.
ip
Checks reputation of provided IP entities using SOCRadar Rapid Reputation API.
socradar-bulk-check
Bulk check reputation for mixed list of indicators. Automatically detects and processes IPs, domains, URLs, and hashes. Maximum 100 indicators per batch. Rate limit - 1 req/sec (100 indicators = ~100 seconds).
socradar-reputation
Checks reputation of any entity type using SOCRadar Rapid Reputation API.
url
Checks reputation of provided URL entities using SOCRadar Rapid Reputation API.

Source

SOCRadarRapidReputation.py SOCRadarRapidReputation_test.py SOCRadarRapidReputation.yml SOCRadarRapidReputation_description.md

Download History Raw

name: SOCRadarRapidReputation
display: SOCRadar Rapid Reputation
category: Data Enrichment & Threat Intelligence
provider: SOCRadar
commonfields:
  id: SOCRadarRapidReputation
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- name: apikey
  displaypassword: API Key
  required: true
  type: 9
  hiddenusername: true
  additionalinfo: API Key to access the SOCRadar service.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  section: Collect
defaultclassifier: 'null'
description: Enrich indicators (IP, Domain, URL, Hash) by obtaining reputation information via SOCRadar Rapid Reputation API.
script:
  commands:
  - arguments:
    - default: true
      description: IP entities to check reputation. (IPv4 or IPv6).
      isArray: true
      name: ip
      required: true
    description: Checks reputation of provided IP entities using SOCRadar Rapid Reputation API.
    name: ip
    outputs:
    - contextPath: SOCRadarRapidReputation.IP.Entity
      description: The queried IP address.
      type: String
    - contextPath: SOCRadarRapidReputation.IP.EntityType
      description: Type of the entity (ip).
      type: String
    - contextPath: SOCRadarRapidReputation.IP.Score
      description: Reputation score of the IP address.
      type: Number
    - contextPath: SOCRadarRapidReputation.IP.IsWhitelisted
      description: Whether the IP is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.IP.FindingSources
      description: List of threat sources that detected this IP.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.SourceName
      description: Name of the threat intelligence source.
      type: String
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.MainCategory
      description: Primary threat category.
      type: String
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.MaintainerName
      description: Organization maintaining the threat list.
      type: String
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.FirstSeenDate
      description: First time the IP was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.LastSeenDate
      description: Last time the IP was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.IP.FindingSources.SeenCount
      description: Number of times the IP was observed on this source.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
  - arguments:
    - description: Domain entities to check reputation.
      isArray: true
      name: domain
      required: true
    description: Checks reputation of provided domain entities using SOCRadar Rapid Reputation API.
    name: domain
    outputs:
    - contextPath: SOCRadarRapidReputation.Domain.Entity
      description: The queried domain.
      type: String
    - contextPath: SOCRadarRapidReputation.Domain.EntityType
      description: Type of the entity (hostname).
      type: String
    - contextPath: SOCRadarRapidReputation.Domain.Score
      description: Reputation score of the domain.
      type: Number
    - contextPath: SOCRadarRapidReputation.Domain.IsWhitelisted
      description: Whether the domain is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources
      description: List of threat sources that detected this domain.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.SourceName
      description: Name of the threat intelligence source.
      type: String
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.MainCategory
      description: Primary threat category.
      type: String
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.MaintainerName
      description: Organization maintaining the threat list.
      type: String
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.FirstSeenDate
      description: First time the domain was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.LastSeenDate
      description: Last time the domain was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.Domain.FindingSources.SeenCount
      description: Number of times the domain was observed on this source.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: Domain name.
      type: String
  - arguments:
    - description: URL entities to check reputation.
      isArray: true
      name: url
      required: true
    description: Checks reputation of provided URL entities using SOCRadar Rapid Reputation API.
    name: url
    outputs:
    - contextPath: SOCRadarRapidReputation.URL.Entity
      description: The queried URL.
      type: String
    - contextPath: SOCRadarRapidReputation.URL.EntityType
      description: Type of the entity (url).
      type: String
    - contextPath: SOCRadarRapidReputation.URL.Score
      description: Reputation score of the URL.
      type: Number
    - contextPath: SOCRadarRapidReputation.URL.IsWhitelisted
      description: Whether the URL is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.URL.FindingSources
      description: List of threat sources that detected this URL.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.SourceName
      description: Name of the threat intelligence source.
      type: String
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.MainCategory
      description: Primary threat category.
      type: String
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.MaintainerName
      description: Organization maintaining the threat list.
      type: String
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.FirstSeenDate
      description: First time the URL was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.LastSeenDate
      description: Last time the URL was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.URL.FindingSources.SeenCount
      description: Number of times the URL was observed on this source.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: URL.Data
      description: URL.
      type: String
  - arguments:
    - description: File hash entities to check reputation. (MD5, SHA1, or SHA256).
      isArray: true
      name: file
      required: true
    description: Checks reputation of provided file hash entities using SOCRadar Rapid Reputation API.
    name: file
    outputs:
    - contextPath: SOCRadarRapidReputation.File.Entity
      description: The queried file hash.
      type: String
    - contextPath: SOCRadarRapidReputation.File.EntityType
      description: Type of the entity (hash).
      type: String
    - contextPath: SOCRadarRapidReputation.File.Score
      description: Reputation score of the hash.
      type: Number
    - contextPath: SOCRadarRapidReputation.File.IsWhitelisted
      description: Whether the hash is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.File.FindingSources
      description: List of threat sources that detected this hash.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.File.FindingSources.SourceName
      description: Name of the threat intelligence source.
      type: String
    - contextPath: SOCRadarRapidReputation.File.FindingSources.MainCategory
      description: Primary threat category.
      type: String
    - contextPath: SOCRadarRapidReputation.File.FindingSources.MaintainerName
      description: Organization maintaining the threat list.
      type: String
    - contextPath: SOCRadarRapidReputation.File.FindingSources.FirstSeenDate
      description: First time the hash was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.File.FindingSources.LastSeenDate
      description: Last time the hash was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.File.FindingSources.SeenCount
      description: Number of times the hash was observed on this source.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: String
  - arguments:
    - description: Entity value to check (IP, domain, URL, or hash).
      name: entity_value
      required: true
    - description: Type of entity to check.
      name: entity_type
      required: true
      auto: PREDEFINED
      predefined:
      - ip
      - hostname
      - url
      - hash
    description: Checks reputation of any entity type using SOCRadar Rapid Reputation API.
    name: socradar-reputation
    outputs:
    - contextPath: SOCRadarRapidReputation.Reputation.Entity
      description: The queried entity value.
      type: String
    - contextPath: SOCRadarRapidReputation.Reputation.EntityType
      description: Type of the entity.
      type: String
    - contextPath: SOCRadarRapidReputation.Reputation.Score
      description: Reputation score of the entity.
      type: Number
    - contextPath: SOCRadarRapidReputation.Reputation.IsWhitelisted
      description: Whether the entity is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources
      description: List of threat sources that detected this entity.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.SourceName
      description: Name of the threat intelligence source.
      type: String
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.MainCategory
      description: Primary threat category.
      type: String
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.MaintainerName
      description: Organization maintaining the threat list.
      type: String
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.FirstSeenDate
      description: First time the entity was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.LastSeenDate
      description: Last time the entity was seen on this source.
      type: Date
    - contextPath: SOCRadarRapidReputation.Reputation.FindingSources.SeenCount
      description: Number of times the entity was observed on this source.
      type: Number
  - arguments:
    - description: Mixed list of indicators to check (IPs, domains, URLs, hashes). Maximum 100 indicators per command. Automatically detects entity types. Supports comma-separated values. Rate limit - 1 request/second applies.
      name: indicators
      required: true
      isArray: true
    description: Bulk check reputation for mixed list of indicators. Automatically detects and processes IPs, domains, URLs, and hashes. Maximum 100 indicators per batch. Rate limit - 1 req/sec (100 indicators = ~100 seconds).
    name: socradar-bulk-check
    outputs:
    - contextPath: SOCRadarRapidReputation.BulkCheck.Entity
      description: The queried entity value.
      type: String
    - contextPath: SOCRadarRapidReputation.BulkCheck.EntityType
      description: Detected type of the entity.
      type: String
    - contextPath: SOCRadarRapidReputation.BulkCheck.DetectedType
      description: Auto-detected entity type.
      type: String
    - contextPath: SOCRadarRapidReputation.BulkCheck.Score
      description: Reputation score of the entity.
      type: Number
    - contextPath: SOCRadarRapidReputation.BulkCheck.IsWhitelisted
      description: Whether the entity is whitelisted.
      type: Boolean
    - contextPath: SOCRadarRapidReputation.BulkCheck.FindingSources
      description: List of threat sources that detected this entity.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.BulkCheckSummary.total
      description: Total number of indicators checked.
      type: Number
    - contextPath: SOCRadarRapidReputation.BulkCheckSummary.processed
      description: Number of successfully processed indicators.
      type: Number
    - contextPath: SOCRadarRapidReputation.BulkCheckSummary.failed
      description: Number of failed indicators.
      type: Number
    - contextPath: SOCRadarRapidReputation.BulkCheckSummary.by_type
      description: Breakdown by entity type.
      type: Unknown
    - contextPath: SOCRadarRapidReputation.BulkCheckSummary.by_score
      description: Breakdown by score classification.
      type: Unknown
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SOCRadarRapidReputation-Test
fromversion: 6.10.0