SOCRadar Takedown

Submit and track takedown requests for phishing domains, social media impersonation, source code leaks, and rogue mobile apps through SOCRadar platform.

Data Enrichment & Threat Intelligence · SOCRadarTakedown

Details

IDSOCRadar Takedown
ProviderSOCRadar
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.11.3982393
Supported ModulesXSIAM Agentix

README

Submit and monitor takedown requests for phishing domains, impersonating accounts, and other digital risks

Configure SOCRadar Takedown in Cortex

Parameter Required
API Key True
Company ID True
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

socradar-submit-phishing-domain

Submits a takedown request for a phishing domain or URL

Base Command

socradar-submit-phishing-domain

Input

Argument Name Description Required
domain The phishing domain or URL to submit for takedown. Required
abuse_type Type of abuse (default is potential_phishing). Possible values are: potential_phishing, confirmed_phishing. Optional
type Type of domain/URL (default is phishing_domain). Possible values are: phishing_domain, phishing_url. Optional
notes Additional information about the takedown request. Optional
send_alarm Whether to send an alarm (default is true). Possible values are: true, false. Optional
email Email to receive notifications about the takedown request. Required

Context Output

Path Type Description
SOCRadarTakedown.PhishingDomain.Domain string The domain submitted for takedown
SOCRadarTakedown.PhishingDomain.AbuseType string Type of abuse
SOCRadarTakedown.PhishingDomain.Status string Status of the takedown request
SOCRadarTakedown.PhishingDomain.Message string Message returned from the API
SOCRadarTakedown.PhishingDomain.SendAlarm boolean Whether an alarm was sent
SOCRadarTakedown.PhishingDomain.Notes string Notes provided with the takedown request

socradar-submit-social-media-impersonation

Submits a takedown request for an impersonating social media account

Base Command

socradar-submit-social-media-impersonation

Input

Argument Name Description Required
username Username of the impersonating account. Required
full_name Full name shown on the impersonating account. Required
account_type Type of social media platform. Possible values are: facebook, instagram, twitter, tiktok, linkedin, youtube, meta, other. Required
notes Additional information about the takedown request. Optional
send_alarm Whether to send an alarm (default is true). Possible values are: true, false. Optional
email Email to receive notifications about the takedown request. Required

Context Output

Path Type Description
SOCRadarTakedown.SocialMediaImpersonation.Username string Username of the impersonating account
SOCRadarTakedown.SocialMediaImpersonation.FullName string Full name shown on the impersonating account
SOCRadarTakedown.SocialMediaImpersonation.AccountType string Type of social media platform
SOCRadarTakedown.SocialMediaImpersonation.AbuseType string Type of abuse reported
SOCRadarTakedown.SocialMediaImpersonation.Status string Status of the takedown request
SOCRadarTakedown.SocialMediaImpersonation.Message string Message returned from the API
SOCRadarTakedown.SocialMediaImpersonation.SendAlarm boolean Whether an alarm was sent
SOCRadarTakedown.SocialMediaImpersonation.Notes string Notes provided with the takedown request

socradar-submit-source-code-leak

Submits a takedown request for leaked source code

Base Command

socradar-submit-source-code-leak

Input

Argument Name Description Required
id ID of the source code leak to takedown. Required
notes Additional information about the takedown request. Optional
email Email to receive notifications about the takedown request. Optional

Context Output

Path Type Description
SOCRadarTakedown.SourceCodeLeak.LeakID number ID of the source code leak
SOCRadarTakedown.SourceCodeLeak.AbuseType string Type of abuse reported
SOCRadarTakedown.SourceCodeLeak.Status string Status of the takedown request
SOCRadarTakedown.SourceCodeLeak.Message string Message returned from the API
SOCRadarTakedown.SourceCodeLeak.Notes string Notes provided with the takedown request
SOCRadarTakedown.SourceCodeLeak.Email string Email provided for notifications

socradar-submit-rogue-app

Submits a takedown request for a rogue mobile app

Base Command

socradar-submit-rogue-app

Input

Argument Name Description Required
id ID of the rogue mobile app to takedown. Required
notes Additional information about the takedown request. Optional
send_alarm Whether to send an alarm (default is true). Possible values are: true, false. Optional
email Email to receive notifications about the takedown request. Optional

Context Output

Path Type Description
SOCRadarTakedown.RogueApp.AppID string ID of the rogue mobile app
SOCRadarTakedown.RogueApp.AbuseType string Type of abuse reported
SOCRadarTakedown.RogueApp.Status string Status of the takedown request
SOCRadarTakedown.RogueApp.Message string Message returned from the API
SOCRadarTakedown.RogueApp.SendAlarm boolean Whether alarm notification is enabled
SOCRadarTakedown.RogueApp.Notes string Additional notes for the request
SOCRadarTakedown.RogueApp.Email string Email provided for notifications

Configuration parameters

  • credentials — Company ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (4)

  • socradar-submit-phishing-domain

    Submit a takedown request for a phishing domain.

  • socradar-submit-rogue-app

    Submit a takedown request for a rogue mobile app.

  • socradar-submit-social-media-impersonation

    Submit a takedown request for social media impersonation.

  • socradar-submit-source-code-leak

    Submit a takedown request for leaked source code.

Source

SOCRadarTakedown.py SOCRadarTakedown.yml SOCRadarTakedown_description.md
Download History Raw 
commonfields:
  id: SOCRadar Takedown
  version: -1
sectionorder:
- Connect
- Collect
name: SOCRadar Takedown
display: SOCRadar Takedown
category: Data Enrichment & Threat Intelligence
provider: SOCRadar
description: Submit and track takedown requests for phishing domains, social media impersonation, source code leaks, and rogue mobile apps through SOCRadar platform.
configuration:
- name: credentials
  display: Company ID
  required: true
  type: 9
  displaypassword: API Key
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true

script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.11.3982393
  commands:
  - name: socradar-submit-phishing-domain
    description: Submit a takedown request for a phishing domain.
    arguments:
    - name: domain
      description: The phishing domain or URL to be taken down.
      required: true
    - name: abuse_type
      description: Type of abuse.
      defaultValue: potential_phishing
      predefined:
      - potential_phishing
      - confirmed_phishing
    - name: type
      description: Domain/URL type.
      defaultValue: phishing_domain
      predefined:
      - phishing_domain
      - phishing_url
    - name: notes
      description: Additional notes for the takedown request.
      required: false
    - name: send_alarm
      description: Whether to send alarm notification.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - name: email
      description: Email address for notifications.
      required: true
    outputs:
    - contextPath: SOCRadarTakedown.PhishingDomain.Domain
      description: The domain that was reported.
      type: String
    - contextPath: SOCRadarTakedown.PhishingDomain.AbuseType
      description: Type of abuse reported.
      type: String
    - contextPath: SOCRadarTakedown.PhishingDomain.Status
      description: Status of the takedown request.
      type: String
    - contextPath: SOCRadarTakedown.PhishingDomain.Message
      description: Response message from the API.
      type: String
    - contextPath: SOCRadarTakedown.PhishingDomain.SendAlarm
      description: Whether alarm notification is enabled.
      type: Boolean
    - contextPath: SOCRadarTakedown.PhishingDomain.Notes
      description: Additional notes for the request.
      type: String
  
  - name: socradar-submit-social-media-impersonation
    description: Submit a takedown request for social media impersonation.
    arguments:
    - name: username
      description: Username of the impersonating account.
      required: true
    - name: full_name
      description: Full name shown on the impersonating account.
      required: true
    - name: account_type
      description: Type of social media platform.
      required: true
      predefined:
      - facebook
      - instagram
      - twitter
      - tiktok
      - linkedin
      - youtube
      - meta
      - other
    - name: notes
      description: Additional notes for the takedown request.
      required: false
    - name: send_alarm
      description: Whether to send alarm notification.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - name: email
      description: Email address for notifications.
      required: true
    outputs:
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.Username
      description: Username of the impersonating account.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.FullName
      description: Full name shown on the impersonating account.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.AccountType
      description: Type of social media platform.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.AbuseType
      description: Type of abuse reported.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.Status
      description: Status of the takedown request.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.Message
      description: Response message from the API.
      type: String
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.SendAlarm
      description: Whether alarm notification is enabled.
      type: Boolean
    - contextPath: SOCRadarTakedown.SocialMediaImpersonation.Notes
      description: Additional notes for the request.
      type: String
  
  - name: socradar-submit-source-code-leak
    description: Submit a takedown request for leaked source code.
    arguments:
    - name: id
      description: ID of the source code leak to takedown.
      required: true
    - name: notes
      description: Additional notes for the takedown request.
      required: false
    - name: email
      description: Email address for notifications.
      required: false
    outputs:
    - contextPath: SOCRadarTakedown.SourceCodeLeak.LeakID
      description: ID of the source code leak.
      type: Number
    - contextPath: SOCRadarTakedown.SourceCodeLeak.AbuseType
      description: Type of abuse reported.
      type: String
    - contextPath: SOCRadarTakedown.SourceCodeLeak.Status
      description: Status of the takedown request.
      type: String
    - contextPath: SOCRadarTakedown.SourceCodeLeak.Message
      description: Response message from the API.
      type: String
    - contextPath: SOCRadarTakedown.SourceCodeLeak.Notes
      description: Additional notes for the request.
      type: String
    - contextPath: SOCRadarTakedown.SourceCodeLeak.Email
      description: Email provided for notifications.
      type: String
  
  - name: socradar-submit-rogue-app
    description: Submit a takedown request for a rogue mobile app.
    arguments:
    - name: id
      description: ID of the rogue mobile app to takedown.
      required: true
    - name: notes
      description: Additional notes for the takedown request.
      required: false
    - name: send_alarm
      description: Whether to send alarm notification.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - name: email
      description: Email address for notifications.
      required: false
    outputs:
    - contextPath: SOCRadarTakedown.RogueApp.AppID
      description: ID of the rogue mobile app.
      type: String
    - contextPath: SOCRadarTakedown.RogueApp.AbuseType
      description: Type of abuse reported.
      type: String
    - contextPath: SOCRadarTakedown.RogueApp.Status
      description: Status of the takedown request.
      type: String
    - contextPath: SOCRadarTakedown.RogueApp.Message
      description: Response message from the API.
      type: String
    - contextPath: SOCRadarTakedown.RogueApp.SendAlarm
      description: Whether alarm notification is enabled.
      type: Boolean
    - contextPath: SOCRadarTakedown.RogueApp.Notes
      description: Additional notes for the request.
      type: String
    - contextPath: SOCRadarTakedown.RogueApp.Email
      description: Email provided for notifications.
      type: String
  
  runonce: false
  ismappable: false
  isremotesyncin: false
  isremotesyncout: false

fromversion: 6.0.0
tests:
- No tests (auto formatted)