SOCRadarRapidReputation

Enrich indicators (IP, Domain, URL, Hash) by obtaining reputation information via SOCRadar Rapid Reputation API.

Data Enrichment & Threat Intelligence · SOCRadar

Details

IDSOCRadarRapidReputation
ProviderSOCRadar
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

SOCRadar Rapid Reputation

Enrich indicators (IP, Domain, URL, Hash) by obtaining reputation information via SOCRadar’s Rapid Reputation API.

This integration was integrated and tested with the latest version of SOCRadar Rapid Reputation API.

Configure SOCRadarRapidReputation on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SOCRadarRapidReputation.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    API Key The API Key to use for connection to SOCRadar Rapid Reputation API. True
    Trust any certificate (not secure) Trust any certificate (not secure). False
    Use system proxy settings Whether to use XSOAR’s system proxy settings to connect to the API. False
    Source Reliability Reliability of the source providing the intelligence data. False
  4. Click Test to validate API key and connection to SOCRadar Rapid Reputation API.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

How to obtain SOCRadar API key?

SOCRadar Rapid Reputation is an Advanced Intelligence API optimized for high-volume and fast reputation queries.

  • Licensing Model: The features of this module are licensed separately from the standard SOCRadar platform package. To use the integration, your API key must be activated with “Rapid Reputation” privileges.
  • Standalone Purchase: This service can be added to your existing SOCRadar subscription, or it can be purchased as a standalone key completely independent of a platform membership.
  • Purchase & Activation: For API authorization, pricing information, or to purchase a new key, please contact our support team at support@socradar.io.

socradar-bulk-check

🎯 NEW FEATURE - Bulk check reputation for mixed list of indicators with automatic entity type detection.

This powerful command allows you to check reputation for a mixed list of IPs, domains, URLs, and hashes in a single command. The integration automatically detects the type of each indicator and processes it accordingly.

Base Command

socradar-bulk-check

Input

Argument Name Description Required
indicators Mixed list of indicators to check (IPs, domains, URLs, hashes). Automatically detects entity types. Supports comma-separated values. Required

Context Output

Path Type Description
SOCRadarRapidReputation.BulkCheck.Entity String The queried entity value.
SOCRadarRapidReputation.BulkCheck.EntityType String Detected type of the entity.
SOCRadarRapidReputation.BulkCheck.DetectedType String Auto-detected entity type.
SOCRadarRapidReputation.BulkCheck.Score Number Reputation score of the entity.
SOCRadarRapidReputation.BulkCheck.IsWhitelisted Boolean Whether the entity is whitelisted.
SOCRadarRapidReputation.BulkCheck.FindingSources Unknown List of threat sources that detected this entity.
SOCRadarRapidReputation.BulkCheckSummary.total Number Total number of indicators checked.
SOCRadarRapidReputation.BulkCheckSummary.processed Number Number of successfully processed indicators.
SOCRadarRapidReputation.BulkCheckSummary.failed Number Number of failed indicators.
SOCRadarRapidReputation.BulkCheckSummary.by_type Unknown Breakdown by entity type (ip, hostname, url, hash).
SOCRadarRapidReputation.BulkCheckSummary.by_score Unknown Breakdown by score classification (malicious, suspicious, good, unknown, whitelisted).

Command Example

!socradar-bulk-check indicators="1.1.1.1,malicious.example.com"

Use Cases for Bulk Check

  1. Incident Response: Quickly check all IOCs extracted from a security incident

    !socradar-bulk-check indicators="192.168.1.100,malware.example.com,3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

  2. Threat Intel Feed Processing: Validate a list of indicators from threat intelligence feeds

    !socradar-bulk-check indicators="${File.Name}"

  3. Automated Playbooks: Use in playbooks to process multiple indicators in one step

    !socradar-bulk-check indicators="${inputs.indicators}"

  4. Daily Security Monitoring: Check a list of suspicious entities identified during monitoring

    !socradar-bulk-check indicators="suspicious_ip1,suspicious_domain1,suspicious_url1"

Output Features

The bulk check command provides:

  1. Summary Statistics:
    • Total indicators processed
    • Success/failure counts
    • Breakdown by entity type (IPs, domains, URLs, hashes)
    • Breakdown by threat level (malicious, suspicious, good, unknown, whitelisted)
  2. Individual Results:
    • Each indicator gets its own detailed result card
    • Includes reputation score, whitelisting status, and threat sources
    • Clear classification (Malicious/Suspicious/Good/Unknown)
  3. Automatic Type Detection:
    • IPs: Automatically detected (IPv4 and IPv6)
    • Domains: Detected based on domain validation
    • URLs: Detected by http:// or https:// prefix
    • Hashes: Detected (MD5, SHA1, SHA256)
  4. Error Handling:
    • Invalid indicators are reported with clear error messages
    • Processing continues even if some indicators fail
    • Failed indicators don’t stop the entire batch

Human Readable Output Example

📊 Bulk Check Summary
┌─────────────────────────┬───────┐
│ Metric                  │ Count │
├─────────────────────────┼───────┤
│ Total Indicators        │ 10    │
│ Successfully Processed  │ 9     │
│ Failed                  │ 1     │
│ IPs                     │ 3     │
│ Domains                 │ 4     │
│ URLs                    │ 2     │
│ Hashes                  │ 1     │
│ Malicious               │ 2     │
│ Suspicious              │ 3     │
│ Good                    │ 3     │
│ Unknown                 │ 1     │
│ Whitelisted             │ 0     │
└─────────────────────────┴───────┘

[Followed by detailed results for each indicator]

Commands Overview

ip

Checks reputation of provided IP entities using SOCRadar Rapid Reputation API.

Base Command

ip

Input

Argument Name Description Required
ip IP entities to check reputation. (IPv4 or IPv6). Supports comma-separated values. Required

Context Output

Path Type Description
SOCRadarRapidReputation.IP.Entity String The queried IP address.
SOCRadarRapidReputation.IP.EntityType String Type of the entity (ip).
SOCRadarRapidReputation.IP.Score Number Reputation score of the IP address.
SOCRadarRapidReputation.IP.IsWhitelisted Boolean Whether the IP is whitelisted.
SOCRadarRapidReputation.IP.FindingSources Unknown List of threat sources that detected this IP.
SOCRadarRapidReputation.IP.FindingSources.SourceName String Name of the threat intelligence source.
SOCRadarRapidReputation.IP.FindingSources.MainCategory String Primary threat category.
SOCRadarRapidReputation.IP.FindingSources.MaintainerName String Organization maintaining the threat list.
SOCRadarRapidReputation.IP.FindingSources.FirstSeenDate Date First time the IP was seen on this source.
SOCRadarRapidReputation.IP.FindingSources.LastSeenDate Date Last time the IP was seen on this source.
SOCRadarRapidReputation.IP.FindingSources.SeenCount Number Number of times the IP was observed on this source.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
IP.Address String IP address

Command Example

!ip ip="1.1.1.1"

Human Readable Output

Example output showing reputation score, whitelisting status, and threat sources that have detected the IP.

domain

Checks reputation of provided domain entities using SOCRadar Rapid Reputation API.

Base Command

domain

Input

Argument Name Description Required
domain Domain entities to check reputation. Supports comma-separated values. Required

Context Output

Path Type Description
SOCRadarRapidReputation.Domain.Entity String The queried domain.
SOCRadarRapidReputation.Domain.EntityType String Type of the entity (hostname).
SOCRadarRapidReputation.Domain.Score Number Reputation score of the domain.
SOCRadarRapidReputation.Domain.IsWhitelisted Boolean Whether the domain is whitelisted.
SOCRadarRapidReputation.Domain.FindingSources Unknown List of threat sources that detected this domain.
SOCRadarRapidReputation.Domain.FindingSources.SourceName String Name of the threat intelligence source.
SOCRadarRapidReputation.Domain.FindingSources.MainCategory String Primary threat category.
SOCRadarRapidReputation.Domain.FindingSources.MaintainerName String Organization maintaining the threat list.
SOCRadarRapidReputation.Domain.FindingSources.FirstSeenDate Date First time the domain was seen on this source.
SOCRadarRapidReputation.Domain.FindingSources.LastSeenDate Date Last time the domain was seen on this source.
SOCRadarRapidReputation.Domain.FindingSources.SeenCount Number Number of times the domain was observed on this source.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
Domain.Name String Domain name

Command Example

!domain domain="example.com"

url

Checks reputation of provided URL entities using SOCRadar Rapid Reputation API.

Base Command

url

Input

Argument Name Description Required
url URL entities to check reputation. Supports comma-separated values. Required

Context Output

Path Type Description
SOCRadarRapidReputation.URL.Entity String The queried URL.
SOCRadarRapidReputation.URL.EntityType String Type of the entity (url).
SOCRadarRapidReputation.URL.Score Number Reputation score of the URL.
SOCRadarRapidReputation.URL.IsWhitelisted Boolean Whether the URL is whitelisted.
SOCRadarRapidReputation.URL.FindingSources Unknown List of threat sources that detected this URL.
SOCRadarRapidReputation.URL.FindingSources.SourceName String Name of the threat intelligence source.
SOCRadarRapidReputation.URL.FindingSources.MainCategory String Primary threat category.
SOCRadarRapidReputation.URL.FindingSources.MaintainerName String Organization maintaining the threat list.
SOCRadarRapidReputation.URL.FindingSources.FirstSeenDate Date First time the URL was seen on this source.
SOCRadarRapidReputation.URL.FindingSources.LastSeenDate Date Last time the URL was seen on this source.
SOCRadarRapidReputation.URL.FindingSources.SeenCount Number Number of times the URL was observed on this source.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
URL.Data String URL

Command Example

!url url="https://malicious.example.com/file.exe"

file

Checks reputation of provided file hash entities using SOCRadar Rapid Reputation API.

Base Command

file

Input

Argument Name Description Required
file File hash entities to check reputation. (MD5, SHA1, or SHA256). Supports comma-separated values. Required

Context Output

Path Type Description
SOCRadarRapidReputation.File.Entity String The queried file hash.
SOCRadarRapidReputation.File.EntityType String Type of the entity (hash).
SOCRadarRapidReputation.File.Score Number Reputation score of the hash.
SOCRadarRapidReputation.File.IsWhitelisted Boolean Whether the hash is whitelisted.
SOCRadarRapidReputation.File.FindingSources Unknown List of threat sources that detected this hash.
SOCRadarRapidReputation.File.FindingSources.SourceName String Name of the threat intelligence source.
SOCRadarRapidReputation.File.FindingSources.MainCategory String Primary threat category.
SOCRadarRapidReputation.File.FindingSources.MaintainerName String Organization maintaining the threat list.
SOCRadarRapidReputation.File.FindingSources.FirstSeenDate Date First time the hash was seen on this source.
SOCRadarRapidReputation.File.FindingSources.LastSeenDate Date Last time the hash was seen on this source.
SOCRadarRapidReputation.File.FindingSources.SeenCount Number Number of times the hash was observed on this source.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
File.MD5 String MD5 hash of the file
File.SHA1 String SHA1 hash of the file
File.SHA256 String SHA256 hash of the file

Command Example

!file file="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

socradar-reputation

Checks reputation of any entity type using SOCRadar Rapid Reputation API. This is a generic command that can handle any supported entity type.

Base Command

socradar-reputation

Input

Argument Name Description Required
entity_value Entity value to check (IP, domain, URL, or hash). Required
entity_type Type of entity to check. Possible values are: ip, hostname, url, hash. Required

Context Output

Path Type Description
SOCRadarRapidReputation.Reputation.Entity String The queried entity value.
SOCRadarRapidReputation.Reputation.EntityType String Type of the entity.
SOCRadarRapidReputation.Reputation.Score Number Reputation score of the entity.
SOCRadarRapidReputation.Reputation.IsWhitelisted Boolean Whether the entity is whitelisted.
SOCRadarRapidReputation.Reputation.FindingSources Unknown List of threat sources that detected this entity.
SOCRadarRapidReputation.Reputation.FindingSources.SourceName String Name of the threat intelligence source.
SOCRadarRapidReputation.Reputation.FindingSources.MainCategory String Primary threat category.
SOCRadarRapidReputation.Reputation.FindingSources.MaintainerName String Organization maintaining the threat list.
SOCRadarRapidReputation.Reputation.FindingSources.FirstSeenDate Date First time the entity was seen on this source.
SOCRadarRapidReputation.Reputation.FindingSources.LastSeenDate Date Last time the entity was seen on this source.
SOCRadarRapidReputation.Reputation.FindingSources.SeenCount Number Number of times the entity was observed on this source.

Command Example

!socradar-reputation entity_value="37.46.210.230" entity_type="ip"
!socradar-reputation entity_value="malicious.example.com" entity_type="hostname"
!socradar-reputation entity_value="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792" entity_type="hash"

DBot Score Interpretation

The integration converts SOCRadar reputation scores to DBot scores as follows:

SOCRadar Score DBot Score Classification
> 80 3 Malicious
40 - 80 2 Suspicious
0 - 40 1 Good
None/0 0 Unknown

Whitelisted entities are always assigned a DBot score of 1 (Good), regardless of their reputation score.

Additional Information

Threat Intelligence Sources

The Rapid Reputation API aggregates data from multiple threat intelligence sources, including:

  • CTU AIPP Blacklist
  • Abuse.ch URLhaus
  • Malware feeds
  • Botnet C&C lists
  • And many more

Each finding source provides detailed information about when and how many times the entity was observed.

Use Cases

  1. Incident Response: Quickly check if an IP, domain, or URL involved in an incident is known to be malicious
  2. Threat Hunting: Proactively search for indicators of compromise in your environment
  3. Automated Playbooks: Integrate reputation checks into your security automation workflows
  4. Alert Enrichment: Enhance security alerts with threat intelligence context

Best Practices

  • Use the generic socradar-reputation command when you need flexibility in entity type
  • Use specific commands (ip, domain, url, file) when you know the entity type for better context integration
  • Monitor the FindingSources field to understand which threat intelligence feeds detected the entity
  • Pay attention to the FirstSeenDate and LastSeenDate to understand the timeline of malicious activity

Configuration parameters

  • apikey — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (6)

  • domain

    Checks reputation of provided domain entities using SOCRadar Rapid Reputation API.

  • file

    Checks reputation of provided file hash entities using SOCRadar Rapid Reputation API.

  • ip

    Checks reputation of provided IP entities using SOCRadar Rapid Reputation API.

  • socradar-bulk-check

    Bulk check reputation for mixed list of indicators. Automatically detects and processes IPs, domains, URLs, and hashes. Maximum 100 indicators per batch. Rate limit - 1 req/sec (100 indicators = ~100 seconds).

  • socradar-reputation

    Checks reputation of any entity type using SOCRadar Rapid Reputation API.

  • url

    Checks reputation of provided URL entities using SOCRadar Rapid Reputation API.

Source

SOCRadarRapidReputation.py SOCRadarRapidReputation_test.py SOCRadarRapidReputation.yml SOCRadarRapidReputation_description.md
Download History Raw 
import json

import pytest
from CommonServerPython import CommandResults, DemistoException

SOCRADAR_API_ENDPOINT = "https://platform.socradar.com/api"
REPUTATION_SUFFIX = f"{SOCRADAR_API_ENDPOINT}/threatfeed/rapid/reputation"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def make_client(api_key="TestAPIKey"):
    from SOCRadarRapidReputation import Client

    return Client(base_url=SOCRADAR_API_ENDPOINT, api_key=api_key, verify=False, proxy=False)


# ---------- calculate_dbot_score ----------


def test_calculate_dbot_score_unknown():
    from SOCRadarRapidReputation import calculate_dbot_score

    assert calculate_dbot_score(0) == 0
    assert calculate_dbot_score(None) == 0


def test_calculate_dbot_score_suspicious():
    from SOCRadarRapidReputation import calculate_dbot_score

    assert calculate_dbot_score(1) == 2
    assert calculate_dbot_score(49) == 2


def test_calculate_dbot_score_malicious():
    from SOCRadarRapidReputation import calculate_dbot_score

    assert calculate_dbot_score(50) == 3
    assert calculate_dbot_score(100) == 3


# ---------- build_entry_context ----------


def test_build_entry_context():
    from SOCRadarRapidReputation import build_entry_context

    raw = util_load_json("test_data/ip_reputation_response.json")
    result = build_entry_context(raw, "1.2.3.4", "ip")

    assert result["Entity"] == "1.2.3.4"
    assert result["EntityType"] == "ip"
    assert result["Score"] == 85.5
    assert result["IsWhitelisted"] is False
    assert len(result["FindingSources"]) == 1
    assert result["FindingSources"][0]["SourceName"] == "MalwareList"
    assert result["FindingSources"][0]["SeenCount"] == 12


def test_build_entry_context_no_finding_sources():
    from SOCRadarRapidReputation import build_entry_context

    raw = {"is_success": True, "data": {"score": 0.0, "is_whitelisted": True, "finding_sources": []}}
    result = build_entry_context(raw, "8.8.8.8", "ip")

    assert result["IsWhitelisted"] is True
    assert result["FindingSources"] == []


# ---------- ip_command ----------


def test_ip_command(requests_mock):
    from SOCRadarRapidReputation import ip_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))

    results = ip_command(make_client(), {"ip": "1.2.3.4"}, reliability="B - Usually reliable")

    assert len(results) == 1
    assert isinstance(results[0], CommandResults)
    assert results[0].outputs["Entity"] == "1.2.3.4"
    assert results[0].outputs["Score"] == 85.5
    assert "1.2.3.4" in results[0].readable_output


def test_ip_command_invalid_ip():
    from SOCRadarRapidReputation import ip_command

    results = ip_command(make_client(), {"ip": "not-an-ip"}, reliability=None)

    assert len(results) == 1
    assert "not a type of IPv4 or IPv6" in results[0].readable_output


def test_ip_command_api_failure(requests_mock):
    from SOCRadarRapidReputation import ip_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "Service unavailable"})

    results = ip_command(make_client(), {"ip": "1.2.3.4"}, reliability=None)

    assert len(results) == 1
    assert "Error" in results[0].readable_output


# ---------- domain_command ----------


def test_domain_command(requests_mock):
    from SOCRadarRapidReputation import domain_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/domain_reputation_response.json"))

    results = domain_command(make_client(), {"domain": "example.com"}, reliability="B - Usually reliable")

    assert len(results) == 1
    assert results[0].outputs["Entity"] == "example.com"
    assert results[0].outputs["Score"] == 45.0


def test_domain_command_invalid_domain():
    from SOCRadarRapidReputation import domain_command

    results = domain_command(make_client(), {"domain": "not a domain!!"}, reliability=None)

    assert len(results) == 1
    assert "not a valid domain" in results[0].readable_output


# ---------- url_command ----------


def test_url_command(requests_mock):
    from SOCRadarRapidReputation import url_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))

    results = url_command(make_client(), {"url": "https://example.com/path"}, reliability=None)

    assert len(results) == 1
    assert results[0].outputs["Entity"] == "https://example.com/path"


def test_url_command_invalid_url():
    from SOCRadarRapidReputation import url_command

    results = url_command(make_client(), {"url": "not-a-url"}, reliability=None)

    assert len(results) == 1
    assert "not a valid URL" in results[0].readable_output


# ---------- file_command ----------


def test_file_command_md5(requests_mock):
    from SOCRadarRapidReputation import file_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))

    md5 = "d41d8cd98f00b204e9800998ecf8427e"
    results = file_command(make_client(), {"file": md5}, reliability=None)

    assert len(results) == 1
    assert results[0].outputs["Entity"] == md5


def test_file_command_invalid_hash():
    from SOCRadarRapidReputation import file_command

    results = file_command(make_client(), {"file": "notahash"}, reliability=None)

    assert len(results) == 1
    assert "not a valid hash" in results[0].readable_output


# ---------- handle_error_response ----------


def test_handle_error_response_401(requests_mock):
    from SOCRadarRapidReputation import MESSAGES

    requests_mock.get(REPUTATION_SUFFIX, json={"message": "Unauthorized"}, status_code=401)

    with pytest.raises(DemistoException, match=MESSAGES["AUTHORIZATION_ERROR"]):
        make_client(api_key="WrongKey").get_entity_reputation("1.2.3.4", "ip")


def test_handle_error_response_429(requests_mock):
    from SOCRadarRapidReputation import MESSAGES

    requests_mock.get(REPUTATION_SUFFIX, json={}, status_code=429)

    with pytest.raises(DemistoException, match=MESSAGES["RATE_LIMIT_EXCEED_ERROR"]):
        make_client().get_entity_reputation("1.2.3.4", "ip")


# ---------- detect_entity_type ----------


def test_detect_entity_type_ip():
    from SOCRadarRapidReputation import detect_entity_type

    assert detect_entity_type("1.2.3.4") == "ip"
    assert detect_entity_type("2001:db8::1") == "ip"


def test_detect_entity_type_url():
    from SOCRadarRapidReputation import detect_entity_type

    assert detect_entity_type("https://example.com") == "url"
    assert detect_entity_type("http://test.org/path") == "url"


def test_detect_entity_type_hash():
    from SOCRadarRapidReputation import detect_entity_type

    assert detect_entity_type("d41d8cd98f00b204e9800998ecf8427e") == "hash"


def test_detect_entity_type_domain():
    from SOCRadarRapidReputation import detect_entity_type

    assert detect_entity_type("example.com") == "hostname"


def test_detect_entity_type_unknown():
    from SOCRadarRapidReputation import detect_entity_type

    with pytest.raises(ValueError, match="Unable to determine entity type"):
        detect_entity_type("???not-valid???")


# ---------- test_module ----------


def test_test_module_success(requests_mock):
    from SOCRadarRapidReputation import test_module

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    result = test_module(make_client())
    assert result == "ok"


def test_test_module_api_failure(requests_mock, mocker):
    from SOCRadarRapidReputation import test_module

    mocker.patch("demistomock.error")
    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "API error"})
    with pytest.raises(Exception, match="API test failed"):
        test_module(make_client())


# ---------- process_entity_by_type ----------


def test_process_entity_by_type_success(requests_mock):
    from SOCRadarRapidReputation import process_entity_by_type

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    result = process_entity_by_type(make_client(), "1.2.3.4", "ip")

    assert result["success"] is True
    assert result["entity"] == "1.2.3.4"
    assert result["dbot_score"] == 3


def test_process_entity_by_type_whitelisted(requests_mock):
    from SOCRadarRapidReputation import process_entity_by_type

    requests_mock.get(
        REPUTATION_SUFFIX,
        json={"is_success": True, "data": {"score": 0, "is_whitelisted": True, "finding_sources": []}},
    )
    result = process_entity_by_type(make_client(), "8.8.8.8", "ip")

    assert result["success"] is True
    assert result["dbot_score"] == 1


def test_process_entity_by_type_api_failure(requests_mock):
    from SOCRadarRapidReputation import process_entity_by_type

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "Not found"})
    result = process_entity_by_type(make_client(), "1.2.3.4", "ip")

    assert result["success"] is False
    assert "Not found" in result["error"]


# ---------- socradar_reputation_command ----------


def test_socradar_reputation_command_ip(requests_mock):
    from SOCRadarRapidReputation import socradar_reputation_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    results = socradar_reputation_command(make_client(), {"entity_value": "1.2.3.4", "entity_type": "ip"})

    assert len(results) == 1
    assert results[0].outputs["Entity"] == "1.2.3.4"


def test_socradar_reputation_command_hostname(requests_mock):
    from SOCRadarRapidReputation import socradar_reputation_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/domain_reputation_response.json"))
    results = socradar_reputation_command(make_client(), {"entity_value": "example.com", "entity_type": "hostname"})

    assert len(results) == 1
    assert results[0].outputs["Entity"] == "example.com"


def test_socradar_reputation_command_url(requests_mock):
    from SOCRadarRapidReputation import socradar_reputation_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    results = socradar_reputation_command(make_client(), {"entity_value": "https://example.com/path", "entity_type": "url"})

    assert len(results) == 1


def test_socradar_reputation_command_hash(requests_mock):
    from SOCRadarRapidReputation import socradar_reputation_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    sha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    results = socradar_reputation_command(make_client(), {"entity_value": sha256, "entity_type": "hash"})

    assert len(results) == 1


def test_socradar_reputation_command_no_args():
    from SOCRadarRapidReputation import socradar_reputation_command

    results = socradar_reputation_command(make_client(), {})

    assert len(results) == 1
    assert "required" in results[0].readable_output


def test_socradar_reputation_command_api_failure(requests_mock):
    from SOCRadarRapidReputation import socradar_reputation_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "Server error"})
    results = socradar_reputation_command(make_client(), {"entity_value": "1.2.3.4", "entity_type": "ip"})

    assert len(results) == 1
    assert "Error" in results[0].readable_output


# ---------- socradar_bulk_check_command ----------


def test_socradar_bulk_check_command_no_indicators():
    from SOCRadarRapidReputation import socradar_bulk_check_command

    results = socradar_bulk_check_command(make_client(), {"indicators": ""})

    assert len(results) == 1
    assert "No indicators" in results[0].readable_output


def test_socradar_bulk_check_command_too_many():
    from SOCRadarRapidReputation import MAX_BULK_CHECK_INDICATORS, socradar_bulk_check_command

    indicators = ",".join([f"1.2.{i // 255}.{i % 255}" for i in range(MAX_BULK_CHECK_INDICATORS + 1)])
    results = socradar_bulk_check_command(make_client(), {"indicators": indicators})

    assert len(results) == 1
    assert "Too Many" in results[0].readable_output


def test_socradar_bulk_check_command_basic(requests_mock):
    from SOCRadarRapidReputation import socradar_bulk_check_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    results = socradar_bulk_check_command(make_client(), {"indicators": "1.2.3.4,5.6.7.8"})

    assert len(results) >= 2
    assert "Bulk Check Summary" in results[0].readable_output


def test_socradar_bulk_check_command_domain(requests_mock):
    from SOCRadarRapidReputation import socradar_bulk_check_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/domain_reputation_response.json"))
    results = socradar_bulk_check_command(make_client(), {"indicators": "example.com"})

    assert len(results) >= 1
    assert "Bulk Check Summary" in results[0].readable_output


def test_socradar_bulk_check_command_failed_entity(requests_mock):
    from SOCRadarRapidReputation import socradar_bulk_check_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "Service error"})
    results = socradar_bulk_check_command(make_client(), {"indicators": "1.2.3.4"})

    assert len(results) >= 2
    assert "Failed" in results[0].readable_output


def test_socradar_bulk_check_command_unknown_entity():
    from SOCRadarRapidReputation import socradar_bulk_check_command

    results = socradar_bulk_check_command(make_client(), {"indicators": "???invalid???"})

    assert len(results) >= 1


# ---------- ip_command additional paths ----------


def test_ip_command_whitelisted(requests_mock):
    from SOCRadarRapidReputation import ip_command

    requests_mock.get(
        REPUTATION_SUFFIX,
        json={"is_success": True, "data": {"score": 0, "is_whitelisted": True, "finding_sources": []}},
    )
    results = ip_command(make_client(), {"ip": "8.8.8.8"}, reliability=None)

    assert len(results) == 1
    assert results[0].outputs["IsWhitelisted"] is True


def test_ip_command_no_score(requests_mock):
    from SOCRadarRapidReputation import ip_command

    requests_mock.get(
        REPUTATION_SUFFIX,
        json={"is_success": True, "data": {"is_whitelisted": False, "finding_sources": []}},
    )
    results = ip_command(make_client(), {"ip": "1.2.3.4"}, reliability=None)

    assert len(results) == 1
    assert results[0].outputs["Score"] is None


# ---------- file_command additional hash types ----------


def test_file_command_sha256_indicator(requests_mock):
    from SOCRadarRapidReputation import file_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    sha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    results = file_command(make_client(), {"file": sha256}, reliability=None)

    assert len(results) == 1
    assert results[0].indicator.sha256 == sha256


def test_file_command_sha1_indicator(requests_mock):
    from SOCRadarRapidReputation import file_command

    requests_mock.get(REPUTATION_SUFFIX, json=util_load_json("test_data/ip_reputation_response.json"))
    sha1 = "da39a3ee5e6b4b0d3255bfef95601890afd80709"
    results = file_command(make_client(), {"file": sha1}, reliability=None)

    assert len(results) == 1


def test_file_command_api_failure(requests_mock):
    from SOCRadarRapidReputation import file_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "Error"})
    md5 = "d41d8cd98f00b204e9800998ecf8427e"
    results = file_command(make_client(), {"file": md5}, reliability=None)

    assert len(results) == 1
    assert "Error" in results[0].readable_output


# ---------- domain/url additional paths ----------


def test_domain_command_api_failure(requests_mock):
    from SOCRadarRapidReputation import domain_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "API error"})
    results = domain_command(make_client(), {"domain": "example.com"}, reliability=None)

    assert len(results) == 1
    assert "Error" in results[0].readable_output


def test_url_command_api_failure(requests_mock):
    from SOCRadarRapidReputation import url_command

    requests_mock.get(REPUTATION_SUFFIX, json={"is_success": False, "message": "API error"})
    results = url_command(make_client(), {"url": "https://example.com"}, reliability=None)

    assert len(results) == 1
    assert "Error" in results[0].readable_output