SOCRadarThreatFusion

Enrich indicators by obtaining enhanced information and reputation via ThreatFusion of SOCRadar.

Data Enrichment & Threat Intelligence · SOCRadar

Details

IDSOCRadarThreatFusion
ProviderSOCRadar
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Enrich indicators by obtaining enhanced information and reputation via ThreatFusion of SOCRadar.
This integration was integrated and tested with v21.11 of SOCRadar.

Configure SOCRadarThreatFusion on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SOCRadarThreatFusion.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    API Key The API Key to use for connection to SOCRadar ThreatFusion API. True
    insecure Trust any certificate (not secure). False
    proxy Whether to use XSOAR’s system proxy settings to connect to the API. False
  4. Click Test to validate API key and connection to SOCRadar ThreatFusion API.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

How to obtain SOCRadar ThreatFusion API key?

To obtain your SOCRadar ThreatFusion API key please contact with the SOCRadar operation team via operation@socradar.io

After obtaining the SOCRadar ThreatFusion API key insert it into API Key field and start using the SOCRadar ThreatFusion integration by creating the instance.

ip

Scores provided IP entities’ reputation in SOCRadar ThreatFusion.

Base Command

ip

Input

Argument Name Description Required
ip IP entities to score. (IPv4 or IPv6). Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.IP.Risk Score Number Reputation score of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Score Details JSON Risk score details of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Total Encounters Number Number of times that SOCRadar has encountered with the queried IP address in its threat sources.
SOCRadarThreatFusion.Reputation.IP.IP String Queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn String ASN field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_cidr String ASN CIDR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_country_code String ASN country code field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_date Date ASN date field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_description String ASN description field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_registry String ASN registry field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.address String Nets>address field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.cidr String Nets>CIDR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.city String Nets>city field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.country String Nets>country field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.created String Nets>created field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.description String Nets>description field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.emails String Nets>emails field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.handle String Nets>handle field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.name String Nets>name field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.postal_code Number Nets>postal code field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.range String Nets>range field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.state String Nets>state field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.updated Date Nets>updated field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nir String NIR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.query String Query field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.raw_referral String Raw referral field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.referral String Referral field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.DNS Details JSON DNS information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.ASN Number ASN field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnCode Number ASN code field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnName String ASN name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Cidr String CIDR field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CityName String City name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryCode String Country code field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryName String Country name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Latitude Number Latitude field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Longitude Number Longitude field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.RegionName String Region name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Timezone String Timezone field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.ZipCode String Zip code field Geographical location information of queried IP address.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
IP.Address String IP address
IP.ASN String The autonomous system name for the IP address, for example: “AS8948”.
IP.Geo.Location String The geolocation where the IP address is located, in the format: latitude:longitude.
IP.Geo.Country String The country in which the IP address is located.

Command Example

!ip ip="1.1.1.1"

Context Example

{
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 1,
        "Type": "ip",
        "Vendor": "SOCRadar ThreatFusion"
    },
    "IP": {
        "ASN": "[13335] CLOUDFLARENET, US",
        "Address": "1.1.1.1",
        "Geo": {
            "Country": "US",
            "Location": "0.0:0.0"
        },
        "Region": "California"
    },
    "SOCRadarThreatFusion": {
        "Reputation": {
            "IP": {
                "DNS Details": {
                    "PTR": [
                        "one.one.one.one"
                    ]
                },
                "Geo Location": {
                    "ASN": "[13335] CLOUDFLARENET, US",
                    "AsnCode": 13335,
                    "AsnName": "CloudFlare Inc",
                    "Cidr": "1.1.1.0/24",
                    "CityName": "Los Angeles",
                    "CountryCode": "US",
                    "CountryName": "United States of America",
                    "Latitude": 0.0,
                    "Longitude": 0.0,
                    "RegionName": "California",
                    "Timezone": "-07:00",
                    "ZipCode": "90001"
                },
                "IP": "1.1.1.1",
                "Risk Score (Out of 1000)": 0,
                "Score Details": {},
                "Total Encounters": 0,
                "Whois Details": {
                    "asn": "13335",
                    "asn_cidr": "1.1.1.0/24",
                    "asn_country_code": "AU",
                    "asn_date": "2011-08-11",
                    "asn_description": "CLOUDFLARENET, US",
                    "asn_registry": "apnic",
                    "nets": [
                        {
                            "address": "PO Box 3646\nSouth Brisbane, QLD 4101\nAustralia",
                            "cidr": "1.1.1.0/24",
                            "city": null,
                            "country": "AU",
                            "created": null,
                            "description": "APNIC and Cloudflare DNS Resolver project\nRouted globally by AS13335/Cloudflare\nResearch prefix for APNIC Labs",
                            "emails": [
                                "resolver-abuse@cloudflare.com"
                            ],
                            "handle": "AA1412-AP",
                            "name": "APNIC-LABS",
                            "postal_code": null,
                            "range": "1.1.1.0 - 1.1.1.255",
                            "state": null,
                            "updated": null
                        },
                        {
                            "address": null,
                            "cidr": "1.1.1.0/24",
                            "city": null,
                            "country": null,
                            "created": null,
                            "description": "APNIC Research and Development\n                6 Cordelia St",
                            "emails": null,
                            "handle": null,
                            "name": null,
                            "postal_code": null,
                            "range": "1.1.1.0 - 1.1.1.255",
                            "state": null,
                            "updated": null
                        }
                    ],
                    "nir": null,
                    "query": "1.1.1.1",
                    "raw_referral": null,
                    "referral": null
                }
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for IP: 1.1.1.1

DNS Details Geo Location IP Risk Score (Out of 1000) Score Details Total Encounters Whois Details
PTR: one.one.one.one Cidr: 1.1.1.0/24
AsnCode: 13335
AsnName: CloudFlare Inc
ZipCode: 90001
CityName: Los Angeles
Latitude: 0.0
Timezone: -07:00
Longitude: 0.0
RegionName: California
CountryCode: US
CountryName: United States of America
ASN: [13335] CLOUDFLARENET, US		 1.1.1.1 0   0 asn: 13335
nir: null
nets: {‘cidr’: ‘1.1.1.0/24’, ‘city’: None, ‘name’: ‘APNIC-LABS’, ‘range’: ‘1.1.1.0 - 1.1.1.255’, ‘state’: None, ‘emails’: [‘resolver-abuse@cloudflare.com’], ‘handle’: ‘AA1412-AP’, ‘address’: ‘PO Box 3646\nSouth Brisbane, QLD 4101\nAustralia’, ‘country’: ‘AU’, ‘created’: None, ‘updated’: None, ‘description’: ‘APNIC and Cloudflare DNS Resolver project\nRouted globally by AS13335/Cloudflare\nResearch prefix for APNIC Labs’, ‘postal_code’: None},
{‘cidr’: ‘1.1.1.0/24’, ‘city’: None, ‘name’: None, ‘range’: ‘1.1.1.0 - 1.1.1.255’, ‘state’: None, ‘emails’: None, ‘handle’: None, ‘address’: None, ‘country’: None, ‘created’: None, ‘updated’: None, ‘description’: ‘APNIC Research and Development\n 6 Cordelia St’, ‘postal_code’: None}
query: 1.1.1.1
asn_cidr: 1.1.1.0/24
asn_date: 2011-08-11
referral: null
asn_registry: apnic
raw_referral: null
asn_description: CLOUDFLARENET, US
asn_country_code: AU

domain

Scores provided domain entities’ reputation in SOCRadar ThreatFusion.

Base Command

domain

Input

Argument Name Description Required
domain Domain entities to score. Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.Domain.Risk Score Number Reputation score of queried domain.
SOCRadarThreatFusion.Reputation.IP.Score Details JSON Risk score details of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Total Encounters Number Number of times that SOCRadar has encountered with the queried domain in its threat sources.
SOCRadarThreatFusion.Reputation.Domain.Domain String Queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.org String Org field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.city String City field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.name String Name field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.state String State field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.dnssec String Dnssec field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.emails String Emails field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.status String Status field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.address String Address field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.country String Country field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.zipcode Number Zip code field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.registrar String Registrar field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.domain_name String Domain name field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.name_servers String Name servers field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.referral_url String Referral URL field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.updated_date Date Updated date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.whois_server String Whois server field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.creation_date Date Creation date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.expiration_date Date Expiration date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.DNS Details String DNS information of queried domain.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Domain.Name String The domain name, for example: “google.com”.
Domain.DNS String A list of IP objects resolved by DNS.
Domain.CreationDate Date The date that the domain was created.
Domain.UpdatedDate String The date that the domain was last updated.
Domain.ExpirationDate Date The expiration date of the domain.
Domain.NameServers Unknown (List<String>) Name servers of the domain.
Domain.Organization String The organization of the domain.
Domain.Registrant.Name String The name of the registrant.
Domain.WHOIS.CreationDate Date The date that the domain was created.
Domain.WHOIS.UpdatedDate Date The date that the domain was last updated.
Domain.WHOIS.ExpirationDate Date The expiration date of the domain.
Domain.WHOIS.NameServers String (List<String>) Name servers of the domain.
Domain.WHOIS.Registrant.Name String The name of the registrant.
Domain.WHOIS.Registrar.Name String The name of the registrar, for example: “GoDaddy”
Domain.Geo.Country String The country in which the domain address is located.
Domain.Subdomains Unknown (List<String>) Subdomains of the domain.
Domain.Registrant.Country String The country of the registrant.

Command Example

!domain domain="paloaltonetworks.com"

Context Example

{
    "DBotScore": {
        "Indicator": "paloaltonetworks.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "SOCRadar ThreatFusion"
    },
    "Domain": {
        "CreationDate": "Mon, 21 Feb 2005 02:42:10 GMT",
        "DNS": "1.1.1.1",
        "ExpirationDate": "Wed, 21 Feb 2024 02:42:10 GMT",
        "Geo": {
            "Country": "US"
        },
        "Name": "paloaltonetworks.com",
        "NameServers": [
            "ns record"
        ],
        "Organization": "Palo Alto Networks, Inc.",
        "Registrar": {
            "AbuseEmail": null,
            "AbusePhone": null,
            "Name": "MarkMonitor Inc."
        },
        "UpdatedDate": "Thu, 01 Jul 2021 00:32:38 GMT",
        "WHOIS": {
            "CreationDate": "Mon, 21 Feb 2005 02:42:10 GMT",
            "ExpirationDate": "Wed, 21 Feb 2024 02:42:10 GMT",
            "NameServers": [
                "ns record"
            ],
            "Registrar": {
                "AbuseEmail": null,
                "AbusePhone": null,
                "Name": "MarkMonitor Inc."
            },
            "UpdatedDate": "Thu, 01 Jul 2021 00:32:38 GMT"
        }
    },
    "SOCRadarThreatFusion": {
        "Reputation": {
            "Domain": {
                "DNS Details": {
                    "A": [
                        "1.1.1.1"
                    ],
                    "MX": [
                        "mx record"
                    ],
                    "NS": [
                        "ns record"
                    ],
                    "SOA": [
                        "domains.paloaltonetworks.com. 1627343953 3600 600 604800 3600"
                    ],
                    "TXT": [
                        "txt record"
                    ]
                },
                "Domain": "paloaltonetworks.com",
                "Risk Score (Out of 1000)": 0,
                "Score Details": {},
                "Subdomains": [],
                "Total Encounters": 0,
                "Whois Details": {
                    "address": null,
                    "city": null,
                    "country": "US",
                    "creation_date": "Mon, 21 Feb 2005 02:42:10 GMT",
                    "dnssec": "signedDelegation",
                    "domain_name": "PALOALTONETWORKS.COM",
                    "emails": [
                        "abusecomplaints@markmonitor.com",
                        "whoisrequest@markmonitor.com"
                    ],
                    "expiration_date": "Wed, 21 Feb 2024 02:42:10 GMT",
                    "name": null,
                    "name_servers": [
                        "ns record"
                    ],
                    "org": "Palo Alto Networks, Inc.",
                    "referral_url": null,
                    "registrar": "MarkMonitor Inc.",
                    "state": "CA",
                    "status": [
                        "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
                        "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
                        "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
                        "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
                        "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)",
                        "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited"
                    ],
                    "updated_date": "Thu, 01 Jul 2021 00:32:38 GMT",
                    "whois_server": "whois.markmonitor.com",
                    "zipcode": null
                }
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for domain: paloaltonetworks.com

DNS Details Domain Risk Score (Out of 1000) Score Details Subdomains Total Encounters Whois Details
A: 1.1.1.1
MX: mx record
NS: ns record
SOA: domains.paloaltonetworks.com. 1627343953 3600 600 604800 3600
TXT: txt record		 paloaltonetworks.com 0     0 org: Palo Alto Networks, Inc.
city: null
name: null
state: CA
dnssec: signedDelegation
emails: abusecomplaints@markmonitor.com,
whoisrequest@markmonitor.com
status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited,
clientTransferProhibited https://icann.org/epp#clientTransferProhibited,
clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited,
clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited),
clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited),
clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
address: null
country: US
zipcode: null
registrar: MarkMonitor Inc.
domain_name: PALOALTONETWORKS.COM
name_servers: ns record
referral_url: null
updated_date: Thu, 01 Jul 2021 00:32:38 GMT
whois_server: whois.markmonitor.com
creation_date: Mon, 21 Feb 2005 02:42:10 GMT
expiration_date: Wed, 21 Feb 2024 02:42:10 GMT

file

Scores provided hash entities’ reputation in SOCRadar ThreatFusion.

Base Command

file

Input

Argument Name Description Required
file Hash entities to score. (MD5 or SHA1). Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.Hash.Risk Score Number Reputation score of queried hash.
SOCRadarThreatFusion.Reputation.Hash.Score Details JSON Risk score details of queried hash.
SOCRadarThreatFusion.Reputation.Hash.Total Encounters Number Number of times that SOCRadar has encountered with the queried hash in its threat sources.
SOCRadarThreatFusion.Reputation.Hash.File String Queried hash.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
File.MD5 String The MD5 hash of the file.
File.SHA1 String The SHA1 hash of the file.

Command Example

!file file="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

Context Example

{
    "DBotScore": {
        "Indicator": "3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792",
        "Score": 1,
        "Type": "file",
        "Vendor": "SOCRadar ThreatFusion"
    },
    "File": {
        "MD5": "3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"
    },
    "SOCRadarThreatFusion": {
        "Reputation": {
            "Hash": {
                "File": "3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792",
                "Risk Score (Out of 1000)": 360,
                "Score Details": {
                    "Maldatabase": 360
                },
                "Total Encounters": 1
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for hash: 3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792

File Risk Score (Out of 1000) Score Details Total Encounters
3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792 360.0 Maldatabase: 360.0 1

socradar-score-ip

Scores provided IP entity’s reputation in SOCRadar ThreatFusion.

Base Command

socradar-score-ip

Input

Argument Name Description Required
ip IP entity to score. (IPv4 or IPv6). Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.IP.Risk Score Number Reputation score of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Score Details JSON Risk score details of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Total Encounters Number Number of times that SOCRadar has encountered with the queried IP address in its threat sources.
SOCRadarThreatFusion.Reputation.IP.IP String Queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn String ASN field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_cidr String ASN CIDR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_country_code String ASN country code field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_date Date ASN date field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_description String ASN description field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_registry String ASN registry field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.address String Nets>address field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.cidr String Nets>CIDR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.city String Nets>city field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.country String Nets>country field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.created String Nets>created field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.description String Nets>description field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.emails String Nets>emails field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.handle String Nets>handle field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.name String Nets>name field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.postal_code Number Nets>postal code field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.range String Nets>range field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.state String Nets>state field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.updated Date Nets>updated field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.nir String NIR field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.query String Query field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.raw_referral String Raw referral field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Whois Details.referral String Referral field Whois information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.DNS Details JSON DNS information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.ASN Number ASN field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnCode Number ASN code field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnName String ASN name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Cidr String CIDR field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CityName String City name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryCode String Country code field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryName String Country name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Latitude Number Latitude field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Longitude Number Longitude field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.RegionName String Region name field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.Timezone String Timezone field Geographical location information of queried IP address.
SOCRadarThreatFusion.Reputation.IP.Geo Location.ZipCode String Zip code field Geographical location information of queried IP address.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the indicator score.

Command Example

!socradar-score-ip ip="1.1.1.1"

Context Example

{
    "SOCRadarThreatFusion": {
        "Reputation": {
            "IP": {
                "DBotScore": {
                    "Indicator": "1.1.1.1",
                    "Score": 1,
                    "Type": "ip",
                    "Vendor": "SOCRadar ThreatFusion"
                },
                "DNS Details": {
                    "PTR": [
                        "one.one.one.one"
                    ]
                },
                "Geo Location": {
                    "ASN": "[13335] CLOUDFLARENET, US",
                    "AsnCode": 13335,
                    "AsnName": "CloudFlare Inc",
                    "Cidr": "1.1.1.0/24",
                    "CityName": "Los Angeles",
                    "CountryCode": "US",
                    "CountryName": "United States of America",
                    "Latitude": 0.0,
                    "Longitude": 0.0,
                    "RegionName": "California",
                    "Timezone": "-07:00",
                    "ZipCode": "90001"
                },
                "IP": "1.1.1.1",
                "Risk Score (Out of 1000)": 0,
                "Score Details": {},
                "Total Encounters": 0,
                "Whois Details": {
                    "asn": "13335",
                    "asn_cidr": "1.1.1.0/24",
                    "asn_country_code": "AU",
                    "asn_date": "2011-08-11",
                    "asn_description": "CLOUDFLARENET, US",
                    "asn_registry": "apnic",
                    "nets": [
                        {
                            "address": "PO Box 3646\nSouth Brisbane, QLD 4101\nAustralia",
                            "cidr": "1.1.1.0/24",
                            "city": null,
                            "country": "AU",
                            "created": null,
                            "description": "APNIC and Cloudflare DNS Resolver project\nRouted globally by AS13335/Cloudflare\nResearch prefix for APNIC Labs",
                            "emails": [
                                "resolver-abuse@cloudflare.com"
                            ],
                            "handle": "AA1412-AP",
                            "name": "APNIC-LABS",
                            "postal_code": null,
                            "range": "1.1.1.0 - 1.1.1.255",
                            "state": null,
                            "updated": null
                        },
                        {
                            "address": null,
                            "cidr": "1.1.1.0/24",
                            "city": null,
                            "country": null,
                            "created": null,
                            "description": "APNIC Research and Development\n                6 Cordelia St",
                            "emails": null,
                            "handle": null,
                            "name": null,
                            "postal_code": null,
                            "range": "1.1.1.0 - 1.1.1.255",
                            "state": null,
                            "updated": null
                        }
                    ],
                    "nir": null,
                    "query": "1.1.1.1",
                    "raw_referral": null,
                    "referral": null
                }
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for IP: 1.1.1.1

DNS Details Geo Location IP Risk Score (Out of 1000) Score Details Total Encounters Whois Details
PTR: one.one.one.one AsnCode: 13335
AsnName: CloudFlare Inc
Cidr: 1.1.1.0/24
CityName: Los Angeles
CountryCode: US
CountryName: United States of America
ASN: [13335] CLOUDFLARENET, US
Latitude: 0.0
Longitude: 0.0
RegionName: California
Timezone: -07:00
ZipCode: 90001		 1.1.1.1 0   0 asn: 13335
asn_cidr: 1.1.1.0/24
asn_country_code: AU
asn_date: 2011-08-11
asn_description: CLOUDFLARENET, US
asn_registry: apnic
nets: {‘address’: ‘PO Box 3646\nSouth Brisbane, QLD 4101\nAustralia’, ‘cidr’: ‘1.1.1.0/24’, ‘city’: None, ‘country’: ‘AU’, ‘created’: None, ‘description’: ‘APNIC and Cloudflare DNS Resolver project\nRouted globally by AS13335/Cloudflare\nResearch prefix for APNIC Labs’, ‘emails’: [‘resolver-abuse@cloudflare.com’], ‘handle’: ‘AA1412-AP’, ‘name’: ‘APNIC-LABS’, ‘postal_code’: None, ‘range’: ‘1.1.1.0 - 1.1.1.255’, ‘state’: None, ‘updated’: None},
{‘address’: None, ‘cidr’: ‘1.1.1.0/24’, ‘city’: None, ‘country’: None, ‘created’: None, ‘description’: ‘APNIC Research and Development\n 6 Cordelia St’, ‘emails’: None, ‘handle’: None, ‘name’: None, ‘postal_code’: None, ‘range’: ‘1.1.1.0 - 1.1.1.255’, ‘state’: None, ‘updated’: None}
nir: null
query: 1.1.1.1
raw_referral: null
referral: null

socradar-score-domain

Scores provided domain entity’s reputation in SOCRadar ThreatFusion.

Base Command

socradar-score-domain

Input

Argument Name Description Required
domain Domain entity to score. Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.Domain.Risk Score Number Reputation score of queried domain.
SOCRadarThreatFusion.Reputation.IP.Score Details JSON Risk score details of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Total Encounters Number Number of times that SOCRadar has encountered with the queried domain in its threat sources.
SOCRadarThreatFusion.Reputation.Domain.Domain String Queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.org String Org field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.city String City field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.name String Name field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.state String State field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.dnssec String Dnssec field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.emails String Emails field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.status String Status field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.address String Address field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.country String Country field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.zipcode Number Zip code field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.registrar String Registrar field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.domain_name String Domain name field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.name_servers String Name servers field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.referral_url String Referral URL field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.updated_date Date Updated date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.whois_server String Whois server field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.creation_date Date Creation date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.Whois Details.expiration_date Date Expiration date field Whois information of queried domain.
SOCRadarThreatFusion.Reputation.Domain.DNS Details String DNS information of queried domain.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the indicator score.

Command Example

!socradar-score-domain domain="paloaltonetworks.com"

Context Example

{
    "SOCRadarThreatFusion": {
        "Reputation": {
            "Domain": {
                "DBotScore": {
                    "Indicator": "paloaltonetworks.com",
                    "Score": 1,
                    "Type": "domain",
                    "Vendor": "SOCRadar ThreatFusion"
                },
                "DNS Details": {
                    "A": [
                        "1.1.1.1"
                    ],
                    "MX": [
                        "mx record"
                    ],
                    "NS": [
                        "ns record"
                    ],
                    "SOA": [
                        "domains.paloaltonetworks.com. 1627343953 3600 600 604800 3600"
                    ],
                    "TXT": [
                        "txt record"
                    ]
                },
                "Domain": "paloaltonetworks.com",
                "Risk Score (Out of 1000)": 0,
                "Score Details": {},
                "Subdomains": [],
                "Total Encounters": 0,
                "Whois Details": {
                    "address": null,
                    "city": null,
                    "country": "US",
                    "creation_date": "Mon, 21 Feb 2005 02:42:10 GMT",
                    "dnssec": "signedDelegation",
                    "domain_name": "PALOALTONETWORKS.COM",
                    "emails": [
                        "abusecomplaints@markmonitor.com",
                        "whoisrequest@markmonitor.com"
                    ],
                    "expiration_date": "Wed, 21 Feb 2024 02:42:10 GMT",
                    "name": null,
                    "name_servers": [
                        "ns record"
                    ],
                    "org": "Palo Alto Networks, Inc.",
                    "referral_url": null,
                    "registrar": "MarkMonitor Inc.",
                    "state": "CA",
                    "status": [
                        "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
                        "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
                        "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
                        "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
                        "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)",
                        "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited"
                    ],
                    "updated_date": "Thu, 01 Jul 2021 00:32:38 GMT",
                    "whois_server": "whois.markmonitor.com",
                    "zipcode": null
                }
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for domain: paloaltonetworks.com

DNS Details Domain Risk Score (Out of 1000) Score Details Subdomains Total Encounters Whois Details
A: 1.1.1.1
MX: mx record
NS: ns record
SOA: domains.paloaltonetworks.com. 1627343953 3600 600 604800 3600
TXT: txt record		 paloaltonetworks.com 0     0 org: Palo Alto Networks, Inc.
city: null
name: null
state: CA
dnssec: signedDelegation
emails: abusecomplaints@markmonitor.com,
whoisrequest@markmonitor.com
status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited,
clientTransferProhibited https://icann.org/epp#clientTransferProhibited,
clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited,
clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited),
clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited),
clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
address: null
country: US
zipcode: null
registrar: MarkMonitor Inc.
domain_name: PALOALTONETWORKS.COM
name_servers: ns record
referral_url: null
updated_date: Thu, 01 Jul 2021 00:32:38 GMT
whois_server: whois.markmonitor.com
creation_date: Mon, 21 Feb 2005 02:42:10 GMT
expiration_date: Wed, 21 Feb 2024 02:42:10 GMT

socradar-score-hash

Scores provided hash entity’s reputation in SOCRadar ThreatFusion.

Base Command

socradar-score-hash

Input

Argument Name Description Required
hash Hash entity to score. (MD5 or SHA1). Required

Context Output

Path Type Description
SOCRadarThreatFusion.Reputation.Hash.Risk Score Number Reputation score of queried hash.
SOCRadarThreatFusion.Reputation.Hash.Score Details JSON Risk score details of queried hash.
SOCRadarThreatFusion.Reputation.Hash.Total Encounters Number Number of times that SOCRadar has encountered with the queried hash in its threat sources.
SOCRadarThreatFusion.Reputation.Hash.File String Queried hash.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the indicator score.

Command Example

!socradar-score-hash hash="3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792"

Context Example

{
    "SOCRadarThreatFusion": {
        "Reputation": {
            "Hash": {
                "DBotScore": {
                    "Indicator": "3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792",
                    "Score": 1,
                    "Type": "file",
                    "Vendor": "SOCRadar ThreatFusion"
                },
                "File": "3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792",
                "Risk Score (Out of 1000)": 360,
                "Score Details": {
                    "Maldatabase": 360
                },
                "Total Encounters": 1
            }
        }
    }
}

Human Readable Output

SOCRadar - Analysis results for hash: 3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792

File Risk Score (Out of 1000) Score Details Total Encounters
3b7b359ea17ac76341957573e332a2d6bcac363401ac71c8df94dac93df6d792 360.0 Maldatabase: 360.0 1

Configuration parameters

  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (6)

  • domain

    Scores provided domain entities' reputation in SOCRadar ThreatFusion.

  • file

    Scores provided hash entities' reputation in SOCRadar ThreatFusion.

  • ip

    Scores provided IP entities' reputation in SOCRadar ThreatFusion.

  • socradar-score-domain

    Scores provided domain entity's reputation in SOCRadar ThreatFusion.

  • socradar-score-hash

    Scores provided hash entity's reputation in SOCRadar ThreatFusion.

  • socradar-score-ip

    Scores provided IP entity's reputation in SOCRadar ThreatFusion.

Source

SOCRadarThreatFusion.py SOCRadarThreatFusion_test.py SOCRadarThreatFusion.yml SOCRadarThreatFusion_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: SOCRadar
commonfields:
  id: SOCRadarThreatFusion
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The API Key to use for connection
  display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  section: Collect
  required: false
defaultclassifier: 'null'
description: Enrich indicators by obtaining enhanced information and reputation via ThreatFusion of SOCRadar.
display: SOCRadar ThreatFusion
name: SOCRadarThreatFusion
script:
  commands:
  - arguments:
    - default: true
      description: IP entities to score. (IPv4 or IPv6).
      isArray: true
      name: ip
      required: true
    description: Scores provided IP entities' reputation in SOCRadar ThreatFusion.
    name: ip
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Risk Score
      description: Reputation score of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Score Details
      description: Risk score details of queried IP address.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried IP address in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.IP
      description: Queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn
      description: ASN field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_cidr
      description: ASN CIDR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_country_code
      description: ASN country code field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_date
      description: ASN date field Whois information of queried IP address.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_description
      description: ASN description field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_registry
      description: ASN registry field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.address
      description: Nets>address field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.cidr
      description: Nets>CIDR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.city
      description: Nets>city field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.country
      description: Nets>country field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.created
      description: Nets>created field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.description
      description: Nets>description field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.emails
      description: Nets>emails field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.handle
      description: Nets>handle field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.name
      description: Nets>name field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.postal_code
      description: Nets>postal code field Whois information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.range
      description: Nets>range field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.state
      description: Nets>state field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.updated
      description: Nets>updated field Whois information of queried IP address.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nir
      description: NIR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.query
      description: Query field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.raw_referral
      description: Raw referral field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.referral
      description: Referral field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.DNS Details
      description: DNS information of queried IP address.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.ASN
      description: ASN field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnCode
      description: ASN code field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnName
      description: ASN name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Cidr
      description: CIDR field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CityName
      description: City name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryCode
      description: Country code field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryName
      description: Country name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Latitude
      description: Latitude field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Longitude
      description: Longitude field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.RegionName
      description: Region name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Timezone
      description: Timezone field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.ZipCode
      description: Zip code field Geographical location information of queried IP address.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.Geo.Location
      description: 'The geolocation where the IP address is located, in the format: latitude:longitude.'
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
  - arguments:
    - default: true
      description: Domain entities to score.
      isArray: true
      name: domain
      required: true
    description: Scores provided domain entities' reputation in SOCRadar ThreatFusion.
    name: domain
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Risk Score
      description: Reputation score of queried domain.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Score Details
      description: Risk score details of queried domain.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried domain in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Domain
      description: Queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.org
      description: Org field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.city
      description: City field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.name
      description: Name field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.state
      description: State field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.dnssec
      description: Dnssec field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.emails
      description: Emails field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.status
      description: Status field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.address
      description: Address field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.country
      description: Country field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.zipcode
      description: Zip code field Whois information of queried domain.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.registrar
      description: Registrar field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.domain_name
      description: Domain name field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.name_servers
      description: Name servers field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.referral_url
      description: Referral URL field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.updated_date
      description: Updated date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.whois_server
      description: Whois server field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.creation_date
      description: Creation date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.expiration_date
      description: Expiration date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.DNS Details
      description: DNS information of queried domain.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: Domain.DNS
      description: A list of IP objects resolved by DNS.
      type: String
    - contextPath: Domain.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.UpdatedDate
      description: The date that the domain was last updated.
      type: String
    - contextPath: Domain.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.NameServers
      description: (List<String>) Name servers of the domain.
      type: Unknown
    - contextPath: Domain.Organization
      description: The organization of the domain.
      type: String
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated.
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.WHOIS.NameServers
      description: (List<String>) Name servers of the domain.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Name
      description: 'The name of the registrar, for example: "GoDaddy".'
      type: String
    - contextPath: Domain.Geo.Country
      description: The country in which the domain address is located.
      type: String
    - contextPath: Domain.Subdomains
      description: (List<String>) Subdomains of the domain.
      type: Unknown
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: String
  - arguments:
    - default: true
      description: Hash entities to score. (MD5 or SHA1).
      isArray: true
      name: file
      required: true
    description: Scores provided hash entities' reputation in SOCRadar ThreatFusion.
    name: file
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Risk Score
      description: Reputation score of queried hash.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Score Details
      description: Risk score details of queried hash.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried hash in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.File
      description: Queried hash.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
  - arguments:
    - description: IP entity to score. (IPv4 or IPv6).
      name: ip
      required: true
    description: Scores provided IP entity's reputation in SOCRadar ThreatFusion.
    name: socradar-score-ip
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Risk Score
      description: Reputation score of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Score Details
      description: Risk score details of queried IP address.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried IP address in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.IP
      description: Queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn
      description: ASN field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_cidr
      description: ASN CIDR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_country_code
      description: ASN country code field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_date
      description: ASN date field Whois information of queried IP address.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_description
      description: ASN description field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.asn_registry
      description: ASN registry field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.address
      description: Nets>address field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.cidr
      description: Nets>CIDR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.city
      description: Nets>city field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.country
      description: Nets>country field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.created
      description: Nets>created field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.description
      description: Nets>description field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.emails
      description: Nets>emails field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.handle
      description: Nets>handle field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.name
      description: Nets>name field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.postal_code
      description: Nets>postal code field Whois information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.range
      description: Nets>range field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.state
      description: Nets>state field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nets.updated
      description: Nets>updated field Whois information of queried IP address.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.nir
      description: NIR field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.query
      description: Query field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.raw_referral
      description: Raw referral field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Whois Details.referral
      description: Referral field Whois information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.DNS Details
      description: DNS information of queried IP address.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.ASN
      description: ASN field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnCode
      description: ASN code field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.AsnName
      description: ASN name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Cidr
      description: CIDR field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CityName
      description: City name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryCode
      description: Country code field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.CountryName
      description: Country name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Latitude
      description: Latitude field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Longitude
      description: Longitude field Geographical location information of queried IP address.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.RegionName
      description: Region name field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.Timezone
      description: Timezone field Geographical location information of queried IP address.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Geo Location.ZipCode
      description: Zip code field Geographical location information of queried IP address.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the indicator score.
      type: String
  - arguments:
    - description: Domain entity to score.
      name: domain
      required: true
    description: Scores provided domain entity's reputation in SOCRadar ThreatFusion.
    name: socradar-score-domain
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Risk Score
      description: Reputation score of queried domain.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.IP.Score Details
      description: Risk score details of queried domain.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried domain in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Domain
      description: Queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.org
      description: Org field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.city
      description: City field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.name
      description: Name field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.state
      description: State field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.dnssec
      description: Dnssec field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.emails
      description: Emails field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.status
      description: Status field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.address
      description: Address field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.country
      description: Country field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.zipcode
      description: Zip code field Whois information of queried domain.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.registrar
      description: Registrar field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.domain_name
      description: Domain name field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.name_servers
      description: Name servers field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.referral_url
      description: Referral URL field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.updated_date
      description: Updated date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.whois_server
      description: Whois server field Whois information of queried domain.
      type: String
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.creation_date
      description: Creation date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.Whois Details.expiration_date
      description: Expiration date field Whois information of queried domain.
      type: Date
    - contextPath: SOCRadarThreatFusion.Reputation.Domain.DNS Details
      description: DNS information of queried domain.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the indicator score.
      type: String
  - arguments:
    - description: Hash entity to score. (MD5 or SHA1).
      name: hash
      required: true
    description: Scores provided hash entity's reputation in SOCRadar ThreatFusion.
    name: socradar-score-hash
    outputs:
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Risk Score
      description: Reputation score of queried hash.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Score Details
      description: Risk score details of queried hash.
      type: JSON
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.Total Encounters
      description: Number of times that SOCRadar has encountered with the queried hash in its threat sources.
      type: Number
    - contextPath: SOCRadarThreatFusion.Reputation.Hash.File
      description: Queried hash.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the indicator score.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SOCRadarThreatFusion-Test
fromversion: 6.0.0