SilentPush

The Silent Push Platform uses first-party data and a proprietary scanning engine to enrich global DNS data with risk and reputation scoring, giving security teams the ability to join the dots across the entire IPv4 and IPv6 range, and identify adversary infrastructure before an attack is launched. The content pack integrates with the Silent Push system to gain insights into domain/IP information, reputations, enrichment, and infratag-related details. It also provides functionality to live-scan URLs and take screenshots of them. Additionally, it allows fetching future attack feeds from the Silent Push system.

Data Enrichment & Threat Intelligence · Silent Push

Details

IDSilentPush
ProviderSilent Push Inc.
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

The Silent Push Platform uses first-party data and a proprietary scanning engine to enrich global DNS data with risk and reputation scoring, giving security teams the ability to join the dots across the entire IPv4 and IPv6 range, and identify adversary infrastructure before an attack is launched. The content pack integrates with the Silent Push system to gain insights into domain/IP information, reputations, enrichment, and infratag-related details. It also provides functionality to live-scan URLs and take screenshots of them. Additionally, it allows fetching future attack feeds from the Silent Push system.
This integration was integrated and tested with version 4.2 of SilentPush.

Configure SilentPush in Cortex

Parameter Required
Base URL True
API Key True
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

silentpush-density-lookup

This command queries granular DNS/IP parameters (e.g., NS servers, MX servers, IPaddresses, ASNs) for density information.

Base Command

silentpush-density-lookup

Input

Argument Name Description Required
qtype Query type. Required
query Value to query. Required
scope Match level (optional). Optional

Context Output

Path Type Description
SilentPush.DensityLookup.qtype String The following qtypes are supported: nssrv, mxsrv.
SilentPush.DensityLookup.query String The query value to lookup, which can be the name of an NS or MX server.
SilentPush.DensityLookup.records.density Number The density value associated with the query result.
SilentPush.DensityLookup.records.nssrv String The name server (NS) for the query result.

Command example

!silentpush-density-lookup qtype="nssrv" query="vida.ns.cloudflare.com"

Context Example

{
 "qtype": "nssrv",
 "query": "vida.ns.cloudflare.com",
 "records": [
  {
   "density": 100601,
   "nssrv": "vida.ns.cloudflare.com"
  }
 ]
}

Human Readable Output

Results

Field Value
Density 100601
NSSRV vida.ns.cloudflare.com

silentpush-forward-padns-lookup

This command performs a forward PADNS lookup using various filtering parameters.

Base Command

silentpush-forward-padns-lookup

Input

Argument Name Description Required
qtype DNS record type. Required
qname The DNS record name to lookup. Required
netmask The netmask to filter the lookup results. Optional
subdomains Flag to include subdomains in the lookup results. Optional
regex Regular expression to filter the DNS records. Optional
match Type of match for the query (e.g., exact, partial). Optional
first_seen_after Filter results to include only records first seen after this date. Optional
first_seen_before Filter results to include only records first seen before this date. Optional
last_seen_after Filter results to include only records last seen after this date. Optional
last_seen_before Filter results to include only records last seen before this date. Optional
as_of Date or time to get the DNS records as of a specific point in time. Optional
sort Sort the results by the specified field (e.g., date, score). Optional
output_format The format in which the results should be returned (e.g., JSON, XML). Optional
prefer Preference for specific DNS servers or sources. Optional
with_metadata Flag to include metadata in the DNS records. Optional
max_wait Maximum number of seconds to wait for results before timing out. Optional
skip Number of results to skip for pagination purposes. Optional
limit Maximum number of results to return. Optional

Context Output

Path Type Description
SilentPush.PADNSLookup.qname String The DNS record name that was looked up.
SilentPush.PADNSLookup.qtype String The DNS record type queried (e.g., NS).
SilentPush.PADNSLookup.records.answer String The answer (e.g., name server) for the DNS record.
SilentPush.PADNSLookup.records.count Number The number of occurrences for this DNS record.
SilentPush.PADNSLookup.records.first_seen String The timestamp when this DNS record was first seen.
SilentPush.PADNSLookup.records.last_seen String The timestamp when this DNS record was last seen.
SilentPush.PADNSLookup.records.nshash String Unique hash for the DNS record.
SilentPush.PADNSLookup.records.query String The DNS record query name (e.g., silentpush.com).
SilentPush.PADNSLookup.records.ttl Number Time to live (TTL) value for the DNS record.
SilentPush.PADNSLookup.records.type String The type of the DNS record (e.g., NS).

Command Example

!silentpush-forward-padns-lookup qtype="ns" qname="silentpush.com"

Context Example

{
 "qtype": "ns",
 "qname": "silentpush.com",
 "records": [
  {
   "answer": "henry.ns.cloudflare.com",
   "count": 23043,
   "first_seen": "2020-12-24 19:04:43",
   "last_seen": "2025-04-08 07:06:24",
   "nshash": "850c47a684c9ea9c32ece18e7be4cddc",
   "query": "silentpush.com"
  }
 ]
}

Human Readable Output

Results

Field Value
Answer henry.ns.cloudflare.com
Count 23043
First Seen 2020-12-24 19:04:43
Last Seen 2025-04-08 07:06:24
NSHash 850c47a684c9ea9c32ece18e7be4cddc
Query silentpush.com

silentpush-get-asn-reputation

This command retrieve the reputation information for an IPv4.

Base Command

silentpush-get-asn-reputation

Input

Argument Name Description Required
asn The ASN to lookup. Required
explain Show the information used to calculate the reputation score. Optional
limit The maximum number of reputation history records to retrieve. Optional

Context Output

Path Type Description
SilentPush.ASNReputation.asn Number Autonomous System Number (ASN) associated with the reputation history.
SilentPush.ASNReputation.asn_reputation Number Reputation score of the ASN at a given point in time.
SilentPush.ASNReputation.asn_reputation_explain.ips_in_asn Number Total number of IPs within the ASN.
SilentPush.ASNReputation.asn_reputation_explain.ips_num_active Number Number of actively used IPs in the ASN.
SilentPush.ASNReputation.asn_reputation_explain.ips_num_listed Number Number of IPs in the ASN that are listed as malicious.
SilentPush.ASNReputation.asname String Name of the ASN provider or organization.
SilentPush.ASNReputation.date Number Date of the recorded reputation history in YYYYMMDD format.

Command Example

!silentpush-get-asn-reputation asn="12345"

Context Example

{
 "asn": "12345",
 "reputation": 0,
 "as_name": "AS12345, IT",
 "date": "20250408"
}

Human Readable Output

Results

Field Value
ASN 12345
Reputation 0
AS Name AS12345, IT
Date 2025-04-08

silentpush-get-asn-takedown-reputation

This command retrieve the takedown reputation information for an Autonomous System Number (ASN).

Base Command

silentpush-get-asn-takedown-reputation

Input

Argument Name Description Required
asn The ASN to lookup. Required
explain Show the information used to calculate the reputation score. Optional
limit The maximum number of reputation history records to retrieve. Optional

Context Output

Path Type Description
SilentPush.ASNTakedownReputation.takedown_reputation.asname String The name of the Autonomous System (AS).
SilentPush.ASNTakedownReputation.takedown_reputation.asn String The Autonomous System Number (ASN).
SilentPush.ASNTakedownReputation.takedown_reputation.allocation_age Number The age of the ASN allocation in days.
SilentPush.ASNTakedownReputation.takedown_reputation.allocation_date Number The date when the ASN was allocated (YYYYMMDD).
SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation Number The takedown reputation score for the ASN.
SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.ips_in_asn Number The total number of IP addresses associated with the ASN.
SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.ips_num_listed Number The number of IP addresses within the ASN that are flagged or listed in security threat databases.
SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.items_num_listed Number The total number of security-related listings associated with the ASN, including IP addresses and domains.
SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.listings_max_age Number The maximum age (in hours) of the listings, indicating how recent the flagged IPs/domains are.

Command Example

!silentpush-get-asn-takedown-reputation asn="211298"

Context Example

{
 "asn": "211298",
 "asn_allocation_age": 1420,
 "asn_allocation_date": "2021-05-19",
 "asn_takedown_reputation": 0,
 "as_name": "INTERNET-MEASUREMENT, GB"
}

Human Readable Output

Results

Field Value
ASN 211298
ASN Allocation Age 1420 days
ASN Allocation Date 2021-05-19
ASN Takedown Reputation 0
AS Name INTERNET-MEASUREMENT, GB

silentpush-get-asns-for-domain

This command retrieves Autonomous System Numbers (ASNs) associated with a domain.

Base Command

silentpush-get-asns-for-domain

Input

Argument Name Description Required
domain Domain name to search ASNs for. Retrieves ASNs associated with a records for the specified domain and its subdomains in the last 30 days. Required

Context Output

Path Type Description
SilentPush.DomainASNs.domain String The domain name for which ASNs are retrieved.
SilentPush.DomainASNs.asns Unknown Dictionary of Autonomous System Numbers (ASNs) associated with the domain.

Command Example

!silentpush-get-asns-for-domain domain="silentpush.com"

Context Example

{
 "domain": "silentpush.com",
 "asns": [
  {
   "asn": "13335",
   "description": "CLOUDFLARENET, US"
  },
  {
   "asn": "14618",
   "description": "AMAZON-AES, US"
  },
  {
   "asn": "16509",
   "description": "AMAZON-02, US"
  },
  {
   "asn": "209242",
   "description": "CLOUDFLARESPECTRUM Cloudflare, Inc., US"
  },
  {
   "asn": "213230",
   "description": "HETZNER-CLOUD2-AS, DE"
  },
  {
   "asn": "24940",
   "description": "HETZNER-AS, DE"
  }
 ]
}

Human Readable Output

Results

ASN Description
13335 CLOUDFLARENET, US
14618 AMAZON-AES, US
16509 AMAZON-02, US
209242 CLOUDFLARESPECTRUM Cloudflare, Inc., US
213230 HETZNER-CLOUD2-AS, DE
24940 HETZNER-AS, DE

silentpush-get-domain-certificates

This command get certificate data collected from domain scanning.

Base Command

silentpush-get-domain-certificates

Input

Argument Name Description Required
domain The domain to query certificates for. Required
domain_regex Regular expression to match domains. Optional
certificate_issuer Filter by certificate issuer. Optional
date_min Filter certificates issued on or after this date. Optional
date_max Filter certificates issued on or before this date. Optional
prefer Prefer to wait for results for longer running queries or to return job_id immediately (Defaults to Silent Push API behaviour). Optional
max_wait Number of seconds to wait for results before returning a job_id, with a range from 0 to 25 seconds. Optional
with_metadata Includes a metadata object in the response, containing returned results, total results, and job_id. Optional
skip Number of results to skip. Optional
limit Number of results to return. Optional

Context Output

Path Type Description
SilentPush.Certificate.domain String Queried domain.
SilentPush.Certificate.metadata String Metadata of the response
SilentPush.Certificate.certificates.cert_index Number Index of the certificate.
SilentPush.Certificate.certificates.chain Unknown Certificate chain.
SilentPush.Certificate.certificates.date Number Certificate issue date.
SilentPush.Certificate.certificates.domain String Primary domain of the certificate.
SilentPush.Certificate.certificates.domains Unknown List of domains covered by the certificate.
SilentPush.Certificate.certificates.fingerprint String SHA-1 fingerprint of the certificate.
SilentPush.Certificate.certificates.fingerprint_md5 String MD5 fingerprint of the certificate.
SilentPush.Certificate.certificates.fingerprint_sha1 String SHA-1 fingerprint of the certificate.
SilentPush.Certificate.certificates.fingerprint_sha256 String SHA-256 fingerprint of the certificate.
SilentPush.Certificate.certificates.host String Host associated with the certificate.
SilentPush.Certificate.certificates.issuer String Issuer of the certificate.
SilentPush.Certificate.certificates.not_after String Expiration date of the certificate.
SilentPush.Certificate.certificates.not_before String Start date of the certificate validity.
SilentPush.Certificate.certificates.serial_dec String Decimal representation of the serial number.
SilentPush.Certificate.certificates.serial_hex String Hexadecimal representation of the serial number.
SilentPush.Certificate.certificates.serial_number String Serial number of the certificate.
SilentPush.Certificate.certificates.source_name String Source log name of the certificate.
SilentPush.Certificate.certificates.source_url String URL of the certificate log source.
SilentPush.Certificate.certificates.subject String Subject details of the certificate.
SilentPush.Certificate.certificates.wildcard Number Indicates if the certificate is a wildcard certificate.
SilentPush.Certificate.job_details.get String URL to get the data of the job or its status.
SilentPush.Certificate.job_details.job_id String ID of the job.
SilentPush.Certificate.job_details.status String Status of the job.

Command Example

!silentpush-get-domain-certificates domain="silentpush.com"

Context Example

{
 "domain": "silentpush.com",
 "certificates": [
  {
   "common_name": "silentpush.com",
   "expires_on": "2025-07-03 16:02:40",
   "fingerprint_sha256": "f7ec9de47a7b22181e6a394a2af8a59793c6ea07538fc49a2351b25c6dc20d69",
   "issued_on": "2025-04-04 16:02:41",
   "issuer": "E5",
   "serial_number": "6E51EEDAA93109DCA31CE852A8D0C27C001",
   "subject_alternative_names": ["silentpush.com"]
  }
 ]
}

Human Readable Output

Result

Field Value
Common Name silentpush.com
Expires On 2025-07-03 16:02:40
Fingerprint (SHA256) f7ec9de47a7b22181e6a394a2af8a59793c6ea07538fc49a2351b25c6dc20d69
Issued On 2025-04-04 16:02:41
Issuer E5
Serial Number 6E51EEDAA93109DCA31CE852A8D0C27C001
Subject Alternative Names silentpush.com

silentpush-get-enrichment-data

This command retrieves comprehensive enrichment information for a given resource (domain, IPv4, or IPv6).

Base Command

silentpush-get-enrichment-data

Input

Argument Name Description Required
resource Type of resource for which information needs to be retrieved {e.g. domain}. Required
value Value corresponding to the selected “resource” for which information needs to be retrieved {e.g. silentpush.com}. Required
explain Include explanation of data calculations. Optional
scan_data Include scan data (IPv4 only). Optional

Context Output

Path Type Description
SilentPush.Enrichment.value String Queried value.
SilentPush.Enrichment.domain_string_frequency_probability.avg_probability Number Average probability score of the domain string.
SilentPush.Enrichment.domain_string_frequency_probability.dga_probability_score Number Probability score indicating likelihood of being a DGA domain.
SilentPush.Enrichment.domain_string_frequency_probability.domain String Domain name analyzed.
SilentPush.Enrichment.domain_string_frequency_probability.domain_string_freq_probabilities Unknown List of frequency probabilities for different domain string components.
SilentPush.Enrichment.domain_string_frequency_probability.query String Domain name queried.
SilentPush.Enrichment.domain_urls.results_summary.alexa_rank Number Alexa rank of the domain.
SilentPush.Enrichment.domain_urls.results_summary.alexa_top10k Boolean Indicates if the domain is in the Alexa top 10k.
SilentPush.Enrichment.domain_urls.results_summary.alexa_top10k_score Number Score indicating domain’s Alexa top 10k ranking.
SilentPush.Enrichment.domain_urls.results_summary.dynamic_domain_score Number Score indicating likelihood of domain being dynamically generated.
SilentPush.Enrichment.domain_urls.results_summary.is_dynamic_domain Boolean Indicates if the domain is dynamic.
SilentPush.Enrichment.domain_urls.results_summary.is_url_shortener Boolean Indicates if the domain is a known URL shortener.
SilentPush.Enrichment.domain_urls.results_summary.results Number Number of results found for the domain.
SilentPush.Enrichment.domain_urls.results_summary.url_shortner_score Number Score of the shortned URL.
SilentPush.Enrichment.domaininfo.domain String Domain name analyzed.
SilentPush.Enrichment.domaininfo.error String Error message if no data is available for the domain.
SilentPush.Enrichment.domaininfo.zone String TLD zone of the domain.
SilentPush.Enrichment.domaininfo.registrar String registrar of the domain.
SilentPush.Enrichment.domaininfo.whois_age String The age of the domain based on WHOIS records.
SilentPush.Enrichment.domaininfo.whois_created_date String The created date on WHOIS records.
SilentPush.Enrichment.domaininfo.query String The domain name that was queried in the system.
SilentPush.Enrichment.domaininfo.last_seen Number The first recorded observation of the domain in the database.
SilentPush.Enrichment.domaininfo.first_seen Number The last recorded observation of the domain in the database.
SilentPush.Enrichment.domaininfo.is_new Boolean Indicates whether the domain is considered “new.”.
SilentPush.Enrichment.domaininfo.is_new_score Number A scoring metric indicating how “new” the domain is.
SilentPush.Enrichment.domaininfo.age Number Represents the age of the domain in days.
SilentPush.Enrichment.domaininfo.age_score Number A scoring metric indicating the trustworthiness of the domain based on its age.
SilentPush.Enrichment.ip_diversity.asn_diversity String Number of different ASNs associated with the domain.
SilentPush.Enrichment.ip_diversity.ip_diversity_all String Total number of unique IPs observed for the domain.
SilentPush.Enrichment.ip_diversity.host String The hostname being analyzed.
SilentPush.Enrichment.ip_diversity.ip_diversity_groups String The number of distinct IP groups (e.g., IPs belonging to different ranges or providers).
SilentPush.Enrichment.ns_reputation.is_expired Boolean Indicates if the domain’s nameserver is expired.
SilentPush.Enrichment.ns_reputation.is_parked Boolean The domain is not parked (a parked domain is one without active content).
SilentPush.Enrichment.ns_reputation.is_sinkholed Boolean The domain is not sinkholed (not forcibly redirected to a security researcher’s trap).
SilentPush.Enrichment.ns_reputation.ns_reputation_max Number Maximum reputation score for nameservers.
SilentPush.Enrichment.ns_reputation.ns_reputation_score Number Reputation score of the domain’s nameservers.
SilentPush.Enrichment.ns_reputation.ns_srv_reputation.domain String The nameservers of domain.
SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server String Provided nameserver.
SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_domain_density Number Number of domains sharing this NS.
SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_domains_listed Number Number of listed domains using this NS.
SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_reputation Number Reputation score for this NS.
SilentPush.Enrichment.scan_data.certificates.domain String Domain for which the SSL certificate was issued.
SilentPush.Enrichment.scan_data.certificates.domains Unknown Other Domains for which the SSL certificate was issued.
SilentPush.Enrichment.scan_data.certificates.issuer_organization String Issuer organization of the SSL certificate.
SilentPush.Enrichment.scan_data.certificates.fingerprint_sha1 String A unique identifier for the certificate.
SilentPush.Enrichment.scan_data.certificates.hostname String The hostname associated with the certificate.
SilentPush.Enrichment.scan_data.certificates.ip String The IP address of the server using this certificate.
SilentPush.Enrichment.scan_data.certificates.is_expired String Indicates whether the certificate has expired.
SilentPush.Enrichment.scan_data.certificates.issuer_common_name String he Common Name (CN) of the Certificate Authority (CA) that issued this certificate.
SilentPush.Enrichment.scan_data.certificates.not_after String Expiry date of the certificate.
SilentPush.Enrichment.scan_data.certificates.not_before String Start date of the certificate validity.
SilentPush.Enrichment.scan_data.certificates.scan_date String The date when this certificate data was last scanned.
SilentPush.Enrichment.scan_data.headers.response String HTTP response code for the domain scan.
SilentPush.Enrichment.scan_data.headers.hostname String The hostname that sent this response.
SilentPush.Enrichment.scan_data.headers.ip String The IP address responding to the request.
SilentPush.Enrichment.scan_data.headers.scan_date String The date when the headers were scanned.
SilentPush.Enrichment.scan_data.headers.headers.cache-control String HTTP cache-control.
SilentPush.Enrichment.scan_data.headers.headers.content-length” String Content lenght of the HTTP response.
SilentPush.Enrichment.scan_data.headers.headers.date String The date/time of the response.
SilentPush.Enrichment.scan_data.headers.headers.expires String Indicates an already expired response.
SilentPush.Enrichment.scan_data.headers.headers.server String The web server handling the request (Cloudflare proxy).
SilentPush.Enrichment.scan_data.html.hostname String HTTP response code for the domain scan.
SilentPush.Enrichment.scan_data.html.html_body_murmur3 String hash of the page content.
SilentPush.Enrichment.scan_data.html.html_body_ssdeep String SSDEEP hash (used for fuzzy matching similar HTML content).
SilentPush.Enrichment.scan_data.html.html_title String The page title (suggests a Cloudflare challenge page, likely due to bot protection).
SilentPush.Enrichment.scan_data.html.ip String The IP address responding to the request.
SilentPush.Enrichment.scan_data.html.scan_date String The date when the headers were scanned.
SilentPush.Enrichment.scan_data.favicon.favicon2_md5 String MD5 hash of a secondary favicon.
SilentPush.Enrichment.scan_data.favicon.favicon2_mmh3 String Murmur3 hash of a secondary favicon.
SilentPush.Enrichment.scan_data.favicon.favicon2_path String The file path of the secondary favicon.
SilentPush.Enrichment.scan_data.favicon.favicon_md5 String MD5 hash of the primary favicon.
SilentPush.Enrichment.scan_data.favicon.favicon_mmh3 String Murmur3 hash of the primary favicon.
SilentPush.Enrichment.scan_data.favicon.hostname String The hostname where this favicon was found.
SilentPush.Enrichment.scan_data.favicon.ip String The IP address associated with the favicon.
SilentPush.Enrichment.scan_data.favicon.scan_date String Date when this favicon was last scanned.
SilentPush.Enrichment.scan_data.jarm.hostname String The hostname where this jarm was found.
SilentPush.Enrichment.scan_data.jarm.ip String The IP address responding to the request.
SilentPush.Enrichment.scan_data.jarm.jarm_hash String Unique identifier for the TLS configuration of the server.
SilentPush.Enrichment.scan_data.jarm.scan_date String Date when this jarm was last scanned.
SilentPush.Enrichment.sp_risk_score Number Overall risk score for the domain.
SilentPush.Enrichment.sp_risk_score_explain.sp_risk_score_decider String Factor that determined the final risk score.
SilentPush.Enrichment.ip2asn.asn Number Autonomous System Number (ASN) associated with the IP.
SilentPush.Enrichment.ip2asn.asn_allocation_age Number Age of ASN allocation in days.
SilentPush.Enrichment.ip2asn.asn_allocation_date Number Date of ASN allocation.
SilentPush.Enrichment.ip2asn.asn_rank Number Rank of the ASN.
SilentPush.Enrichment.ip2asn.asn_rank_score Number Rank score of the ASN.
SilentPush.Enrichment.ip2asn.asn_reputation Number Reputation score of the ASN.
SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_in_asn Number Total number of IPs in the ASN.
SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_num_active Number Number of active IPs in the ASN.
SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_num_listed Number Number of listed IPs in the ASN.
SilentPush.Enrichment.ip2asn.asn_reputation_score Number Reputation score of the ASN.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation Number Takedown reputation score of the ASN.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.ips_in_asn Number Total number of IPs in the ASN with takedown reputation.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.ips_num_listed Number Number of listed IPs in the ASN with takedown reputation.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.items_num_listed Number Number of flagged items in the ASN with takedown reputation.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.listings_max_age Number Maximum age of listings for the ASN with takedown reputation.
SilentPush.Enrichment.ip2asn.asn_takedown_reputation_score Number Takedown reputation score of the ASN.
SilentPush.Enrichment.ip2asn.asname String Name of the Autonomous System (AS).
SilentPush.Enrichment.ip2asn.benign_info.actor String This field is usually used to indicate a known organization or individual associated with the IP.
SilentPush.Enrichment.ip2asn.benign_info.known_benign Boolean Indicates whether this IP/ASN is explicitly known to be safe (e.g., a reputable cloud provider or public service)
SilentPush.Enrichment.ip2asn.benign_info.tags Unknown Contains descriptive tags if the IP/ASN has a known role (e.g., “Google Bot”, “Cloudflare Proxy”).
SilentPush.Enrichment.ip2asn.date Number Date of the scan data (YYYYMMDD format).
SilentPush.Enrichment.ip2asn.density Number The density value associated with the IP.
SilentPush.Enrichment.ip2asn.ip String IP address associated with the ASN.
SilentPush.Enrichment.ip2asn.ip_has_expired_certificate Boolean Indicates whether the IP has an expired SSL/TLS certificate.
SilentPush.Enrichment.ip2asn.ip_has_open_directory Boolean Indicates whether the IP hosts an open directory listing.
SilentPush.Enrichment.ip2asn.ip_is_dsl_dynamic Boolean the IP is from a dynamic DSL pool.
SilentPush.Enrichment.ip2asn.ip_is_dsl_dynamic_score Number A score indicating how likely this IP is dynamic.
SilentPush.Enrichment.ip2asn.ip_is_ipfs_node Boolean the InterPlanetary File System (IPFS), a decentralized file storage system.
SilentPush.Enrichment.ip2asn.ip_is_tor_exit_node Boolean Tor exit node (used for anonymous internet browsing).
SilentPush.Enrichment.ip2asn.ip_location.continent_code String abbreviation for the continent where the IP is located.
SilentPush.Enrichment.ip2asn.ip_location.continent_name String The full name of the continent.
SilentPush.Enrichment.ip2asn.ip_location.country_code String The ISO 3166-1 alpha-2 country code representing the country.
SilentPush.Enrichment.ip2asn.ip_location.country_is_in_european_union Boolean A Boolean value (true/false) indicating if the country is part of the European Union (EU).
SilentPush.Enrichment.ip2asn.ip_location.country_name String The full name of the country where the IP is registered.
SilentPush.Enrichment.ip2asn.ip_ptr String The reverse DNS (PTR) record for the IP.
SilentPush.Enrichment.ip2asn.listing_score Number Measures how frequently the IP appears in threat intelligence or blacklist databases.
SilentPush.Enrichment.ip2asn.listing_score_explain Unknown A breakdown of why the listing score is assigned.
SilentPush.Enrichment.ip2asn.malscore Number Malicious activity score for the IP.
SilentPush.Enrichment.ip2asn.scan_data.certificates.hostname String Hostname associated with the SSL certificate.
SilentPush.Enrichment.ip2asn.scan_data.certificates.domain String Domain for which the SSL certificate was issued.
SilentPush.Enrichment.ip2asn.scan_data.certificates.fingerprint_sha1 String SHA-1 fingerprint of the SSL certificate.
SilentPush.Enrichment.ip2asn.scan_data.certificates.issuer_common_name String Common name of the certificate issuer.
SilentPush.Enrichment.ip2asn.scan_data.certificates.issuer_organization String Organization that issued the SSL certificate.
SilentPush.Enrichment.ip2asn.scan_data.certificates.not_before String Start date of SSL certificate validity.
SilentPush.Enrichment.ip2asn.scan_data.certificates.not_after String Expiration date of SSL certificate validity.
SilentPush.Enrichment.ip2asn.scan_data.certificates.domains Unknown Other domains for which the SSL certificate was issued.
SilentPush.Enrichment.ip2asn.scan_data.certificates.is_expired Boolean Is certificate expired.
SilentPush.Enrichment.ip2asn.scan_data.certificates.scan_date String Scan date of the certificate.
SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_md5 String MD5 hash of the second favicon.
SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_mmh3 Number MurmurHash3 value of the second favicon.
SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon_md5 String MD5 hash of the favicon.
SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon_mmh3 Number MurmurHash3 value of the favicon.
SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_path String Path to the second favicon file.
SilentPush.Enrichment.ip2asn.scan_data.favicon.scan_date String Scan date of favicon file.
SilentPush.Enrichment.ip2asn.scan_data.headers.response String HTTP response code from the scan.
SilentPush.Enrichment.ip2asn.scan_data.headers.scan_date String The date and time when the scan was performed.
SilentPush.Enrichment.ip2asn.scan_data.headers.headers.server String Server header from the HTTP response.
SilentPush.Enrichment.ip2asn.scan_data.headers.headers.content-type String Content-Type header from the HTTP response.
SilentPush.Enrichment.ip2asn.scan_data.headers.headers.content-length String Content-Length header from the HTTP response.
SilentPush.Enrichment.ip2asn.scan_data.headers.headers.cache-control String Cache-control header from the HTTP response.
SilentPush.Enrichment.ip2asn.scan_data.headers.headers.date String Date header from the HTTP response.
SilentPush.Enrichment.ip2asn.scan_data.html.html_title String Title of the scanned HTML page.
SilentPush.Enrichment.ip2asn.scan_data.html.html_body_murmur3 String MurmurHash3 of the HTML body content.
SilentPush.Enrichment.ip2asn.scan_data.html.html_body_ssdeep String SSDEEP fuzzy hash of the HTML body content.
SilentPush.Enrichment.ip2asn.scan_data.html.scan_date String The date and time when the scan was performed.
SilentPush.Enrichment.ip2asn.scan_data.jarm.scan_date String The date and time when the scan was performed.
SilentPush.Enrichment.ip2asn.scan_data.jarm.jarm_hash String JARM fingerprint hash for TLS analysis.
SilentPush.Enrichment.ip2asn.sp_risk_score Number Security risk score for the IP.
SilentPush.Enrichment.ip2asn.sp_risk_score_explain.sp_risk_score_decider String Factor that determined the final risk score.
SilentPush.Enrichment.ip2asn.subnet String Subnet associated with the IP.
SilentPush.Enrichment.ip2asn.sinkhole_info.known_sinkhole_ip Boolean Indicates whether the IP is part of a sinkhole (a controlled system that captures malicious traffic).
SilentPush.Enrichment.ip2asn.sinkhole_info.tags Unknown If the IP were a known sinkhole, this field would contain tags describing its purpose.
SilentPush.Enrichment.ip2asn.subnet_allocation_age Number Represents the age (in days) since the subnet was allocated.
SilentPush.Enrichment.ip2asn.subnet_allocation_date Number The date when the subnet was assigned to an organization or ISP.
SilentPush.Enrichment.ip2asn.subnet_reputation Number A measure of how frequently IPs from this subnet appear in threat intelligence databases.
SilentPush.Enrichment.ip2asn.subnet_reputation_explain Unknown A breakdown of why the subnet received its reputation score.
SilentPush.Enrichment.ip2asn.subnet_reputation_score Number A numerical risk score (typically 0-100, with higher values indicating higher risk).

Command Example

!silentpush-get-enrichment-data resource="ipv4" value="0.0.0.0"

Context Example

{
 "resource": "ipv4",
 "value": "0.0.0.0",
 "enrichment_data": {
  "asn": "15169",
  "asn_allocation_age": 9140,
  "asn_allocation_date": "2000-03-30",
  "asn_rank": 0,
  "asn_rank_score": 0,
  "asn_reputation": 0,
  "asn_reputation_score": 0,
  "asn_takedown_reputation": 80,
  "asn_takedown_reputation_score": 80,
  "as_name": "GOOGLE, US",
  "benign_info": {
   "actor": "",
   "known_benign": false
  },
  "tags": [],
  "date": "2025-04-08",
  "density": 0,
  "ip": "0.0.0.0",
  "ip_flags": {
   "is_proxy": false,
   "is_sinkhole": false,
   "is_vpn": false
  },
  "ip_has_expired_certificate": false,
  "ip_has_open_directory": false,
  "ip_is_dsl_dynamic": false,
  "ip_is_dsl_dynamic_score": 0,
  "ip_is_ipfs_node": false
 }
}

Human Readable Output

Result

Field Value
ASN 15169
ASN Allocation Age 9140 days
ASN Allocation Date 2000-03-30
ASN Rank 0
ASN Rank Score 0
ASN Reputation 0
ASN Reputation Score 0
ASN Takedown Reputation 80
ASN Takedown Reputation Score 80
AS Name GOOGLE, US
Known Benign No
Date 2025-04-08
Density 0
IP Flags (Proxy, Sinkhole, VPN) No, No, No
Expired Certificate No
Open Directory No
DSL Dynamic No
DSL Dynamic Score 0
IPFS Node No

silentpush-get-future-attack-indicators

This command fetch indicators of potential future attacks using a feed UUID.

Base Command

silentpush-get-future-attack-indicators

Input

Argument Name Description Required
feed_uuid Unique ID for the feed. Required
page_no The page number to fetch results from. Optional
page_size The number of indicators to fetch per page. Optional

Context Output

Path Type Description
SilentPush.FutureAttackIndicators.feed_uuid String Unique identifier for the feed.
SilentPush.FutureAttackIndicators.page_no Number Current page number for pagination.
SilentPush.FutureAttackIndicators.page_size Number Number of items to be retrieved per page.
SilentPush.FutureAttackIndicators.indicators.total_ioc Number Total number of Indicators of Compromise (IOCs) associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.total Number Total occurrences of the indicator across all sources.
SilentPush.FutureAttackIndicators.indicators.total_source_score Number Cumulative score assigned to the indicator by all sources.
SilentPush.FutureAttackIndicators.indicators.name String Name associated with the indicator, such as a domain name.
SilentPush.FutureAttackIndicators.indicators.total_custom Number Total number of custom indicators for the specific entry.
SilentPush.FutureAttackIndicators.indicators.source_name String Name of the source providing the indicator.
SilentPush.FutureAttackIndicators.indicators.first_seen_on String Date and time when the indicator was first observed.
SilentPush.FutureAttackIndicators.indicators.last_seen_on String Date and time when the indicator was last observed.
SilentPush.FutureAttackIndicators.indicators.type String Type of the indicator (e.g., domain, IP address, URL).
SilentPush.FutureAttackIndicators.indicators.uuid String Unique identifier assigned to the indicator.
SilentPush.FutureAttackIndicators.indicators.ioc_template String Template type describing the indicator (e.g., domain template).
SilentPush.FutureAttackIndicators.indicators.ioc_uuid String Unique identifier for the IOC related to the indicator.
SilentPush.FutureAttackIndicators.indicators.source_vendor_name String Name of the vendor providing the indicator source (e.g., Silent Push).
SilentPush.FutureAttackIndicators.indicators.source_uuid String Unique identifier for the source of the indicator.
SilentPush.FutureAttackIndicators.indicators.total_ioc Number Total count of Indicators of Compromise associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.collected_tags Unknown Tags associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.listing_score Number Score assigned by the source indicating the severity or importance of the indicator.
SilentPush.FutureAttackIndicators.indicators.sp_risk_score Number Risk score calculated by the source for the indicator, reflecting its potential threat level.
SilentPush.FutureAttackIndicators.indicators.ip_is_tor_exit_node Boolean Indicates whether the IP address is a known TOR exit node.
SilentPush.FutureAttackIndicators.indicators.ip_is_dsl_dynamic Boolean Indicates whether the IP address is a DSL dynamic IP.
SilentPush.FutureAttackIndicators.indicators.ip_reputation_score Number Reputation score assigned to the IP address based on its history and activities.
SilentPush.FutureAttackIndicators.indicators.known_sinkhole_ip String Indicates if the IP address is associated with a known sinkhole.
SilentPush.FutureAttackIndicators.indicators.known_benign Number Indicates whether the indicator is known to be benign or harmless.
SilentPush.FutureAttackIndicators.indicators.asn_rank_score Number Score indicating the reputation rank of the ASN.
SilentPush.FutureAttackIndicators.indicators.asn_reputation_score Number Reputation score assigned to the ASN based on its activities.
SilentPush.FutureAttackIndicators.indicators.ip_is_dsl_dynamic_score Number Score indicating the likelihood of the IP being a DSL dynamic IP.
SilentPush.FutureAttackIndicators.indicators.subnet_reputation_score Number Reputation score assigned to a subnet based on its history and activities.
SilentPush.FutureAttackIndicators.indicators.asn_takedown_reputation_score Number Reputation score of the ASN considering takedown activities or abuse reports.
SilentPush.FutureAttackIndicators.indicators.asn Number Autonomous System Number (ASN) associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.density Number Indicator density score based on traffic or other relevant factors.
SilentPush.FutureAttackIndicators.indicators.asn_rank Number Rank of the ASN indicating its reputation or trustworthiness.
SilentPush.FutureAttackIndicators.indicators.malscore Number Maliciousness score assigned to the indicator based on threat analysis.
SilentPush.FutureAttackIndicators.indicators.asn_reputation Number Reputation score associated with the ASN.
SilentPush.FutureAttackIndicators.indicators.subnet_reputation Number Reputation score associated with the subnet.
SilentPush.FutureAttackIndicators.indicators.asn_allocation_age Number Age of the ASN allocation in days.
SilentPush.FutureAttackIndicators.indicators.subnet_allocation_age Number Age of the subnet allocation in days.
SilentPush.FutureAttackIndicators.indicators.asn_takedown_reputation Number Reputation score of the ASN considering takedown reports or abuse.
SilentPush.FutureAttackIndicators.indicators.ipv4 String IPv4 address associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.asname String Autonomous System Name (ASName) associated with the ASN.
SilentPush.FutureAttackIndicators.indicators.ip_ptr String PTR (reverse DNS) record associated with the IP address.
SilentPush.FutureAttackIndicators.indicators.subnet String Subnet associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.country_code Number Country code associated with the indicator (e.g., US, CA).
SilentPush.FutureAttackIndicators.indicators.continent_code Number Continent code associated with the indicator (e.g., NA, EU).
SilentPush.FutureAttackIndicators.indicators.it_exists Boolean Indicates if the indicator currently exists in the dataset.
SilentPush.FutureAttackIndicators.indicators.is_new Boolean Indicates if the indicator is newly detected.
SilentPush.FutureAttackIndicators.indicators.is_alexa_top10k Boolean Indicates if the domain is part of the Alexa Top 10K list.
SilentPush.FutureAttackIndicators.indicators.is_dynamic_domain Boolean Indicates if the domain is classified as dynamic.
SilentPush.FutureAttackIndicators.indicators.is_url_shortener Boolean Indicates if the URL is associated with a URL shortener service.
SilentPush.FutureAttackIndicators.indicators.is_parked Boolean Indicates if the domain is a parked domain.
SilentPush.FutureAttackIndicators.indicators.is_expired Boolean Indicates if the domain registration has expired.
SilentPush.FutureAttackIndicators.indicators.is_sinkholed Boolean Indicates if the domain is associated with a sinkhole operation.
SilentPush.FutureAttackIndicators.indicators.ns_entropy_score Number Entropy score of the nameserver, indicating randomness or irregularity.
SilentPush.FutureAttackIndicators.indicators.age_score Number Score indicating the age of the domain, with higher scores for older domains.
SilentPush.FutureAttackIndicators.indicators.is_new_score Boolean Score indicating the likelihood of the domain being newly registered.
SilentPush.FutureAttackIndicators.indicators.ns_avg_ttl_score Number Score representing the average TTL of the nameservers.
SilentPush.FutureAttackIndicators.indicators.ns_reputation_max Number Maximum reputation score of the nameservers.
SilentPush.FutureAttackIndicators.indicators.ns_reputation_score Number Overall reputation score of the nameservers.
SilentPush.FutureAttackIndicators.indicators.avg_probability_score Number Average probability score indicating the likelihood of malicious activity.
SilentPush.FutureAttackIndicators.indicators.alexa_top10k_score Number Score indicating the rank within the Alexa Top 10K list.
SilentPush.FutureAttackIndicators.indicators.url_shortener_score Number Score indicating the likelihood of the URL being a URL shortener.
SilentPush.FutureAttackIndicators.indicators.dynamic_domain_score Number Score indicating the likelihood of the domain being dynamic.
SilentPush.FutureAttackIndicators.indicators.ns_entropy Number Entropy value of the nameserver, indicating randomness or irregularity.
SilentPush.FutureAttackIndicators.indicators.age Number Age of the domain in days.
SilentPush.FutureAttackIndicators.indicators.whois_age Number Age of the domain based on the WHOIS creation date.
SilentPush.FutureAttackIndicators.indicators.alexa_rank Number Alexa rank of the domain, indicating its popularity.
SilentPush.FutureAttackIndicators.indicators.asn_diversity Number Diversity score of the ASN, indicating the variety of ASNs associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.ip_diversity_all Number Count of all unique IP addresses associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.ip_diversity_groups Number Count of unique IP address groups associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.avg_probability Number Average probability indicating the likelihood of malicious activity.
SilentPush.FutureAttackIndicators.indicators.whois_created_date String Creation date of the domain from WHOIS records.
SilentPush.FutureAttackIndicators.indicators.domain String Domain name associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.subdomain String Subdomain associated with the indicator, if applicable.
SilentPush.FutureAttackIndicators.indicators.host String Host associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.nameservers_tags String Tags related to the nameservers associated with the indicator.
SilentPush.FutureAttackIndicators.indicators.source_false_positive_ratio Number Ratio of false positives reported by the source.
SilentPush.FutureAttackIndicators.indicators.source_true_positive_ratio Number Ratio of true positives reported by the source.
SilentPush.FutureAttackIndicators.indicators.source_last_updated_score Number Score indicating the last update time of the source.
SilentPush.FutureAttackIndicators.indicators.source_frequency_score Number Score representing the frequency of updates from the source.
SilentPush.FutureAttackIndicators.indicators.source_accuracy_score Number Score indicating the accuracy of the source reporting.
SilentPush.FutureAttackIndicators.indicators.source_geographic_spread_score Number Score indicating the geographic spread of the indicator.
SilentPush.FutureAttackIndicators.indicators.source_custom_score Number Custom score provided by the source for the indicator.
SilentPush.FutureAttackIndicators.indicators.source_score Number Overall score assigned by the source to the indicator.
SilentPush.FutureAttackIndicators.indicators.source_frequency Number Frequency of the indicator appearance in the source data.
SilentPush.FutureAttackIndicators.indicators.source_geographic_spread_explain Unknown Explanation of the geographic spread of the indicator as provided by the source.

Command Example

!silentpush-get-future-attack-indicators feed_uuid="99da9b6a-146b-4a4d-9929-5fd5c6e2c257"

Context Example

{
 "feed_uuid": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
 "future_attack_indicators": {
  "total_source_score": 100,
  "total_ioc": 100,
  "total_custom": 0,
  "total": 100,
  "name": "capital-gainers.com",
  "uuid": "560ee6da03f56cec",
  "ioc_uuid": "f2556a5a18607c70",
  "type": "domain",
  "ioc_template": "domain",
  "last_seen_on": "2025-04-08T01:24:57",
  "source_uuid": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
  "source_name": "AI Generated Investment/Banks Domains",
  "source_vendor_name": "Silent Push",
  "first_seen_on": "2025-04-07T07:24:36"
 }
}

Human Readable Output

Result

Field Value
Feed Name capital-gainers.com
Feed UUID 560ee6da03f56cec
IOC UUID f2556a5a18607c70
Type Domain
IOC Template Domain
Source UUID 99da9b6a-146b-4a4d-9929-5fd5c6e2c257
Source Name AI Generated Investment/Banks Domains
Source Vendor Name Silent Push
First Seen 2025-04-07T07:24:36
Last Seen 2025-04-08T01:24:57
Total Source Score 100
Total IOCs 100
Total Custom IOCs 0
Total IOCs Reported 100

silentpush-get-ipv4-reputation

This command retrieve the reputation information for an IPv4.

Base Command

silentpush-get-ipv4-reputation

Input

Argument Name Description Required
ipv4 IPv4 address for which information needs to be retrieved. Required
explain Show the information used to calculate the reputation score. Optional
limit The maximum number of reputation history to retrieve. Optional

Context Output

Path Type Description
SilentPush.IPv4Reputation.date Number Date when the reputation information was retrieved.
SilentPush.IPv4Reputation.ip String IPv4 address for which the reputation is calculated.
SilentPush.IPv4Reputation.reputation_score Number Reputation score for the given IP address.
SilentPush.IPv4Reputation.ip_reputation_explain.ip_density Number The number of domain names or services associated with this IP. A higher value may indicate shared hosting or potential abuse.
SilentPush.IPv4Reputation.ip_reputation_explain.names_num_listed Number The number of domain names linked to this IP that are flagged or listed in security threat databases.

Command Example

!silentpush-get-nameserver-reputation nameserver="a.dns-servers.net.ru" limit="5"

Context Example

{
 "nameserver": "a.dns-servers.net.ru",
 "limit": 5,
 "nameserver_reputation_data": {
  "date": "2025-04-05",
  "ns_server": "a.dns-servers.net.ru",
  "ns_server_reputation": 0
 }
}

Human Readable Output

Result

Field Value
Nameserver a.dns-servers.net.ru
Date 2025-04-05
Nameserver Reputation 0

silentpush-get-job-status

This command retrieve status of running job or results from completed job.

Base Command

silentpush-get-job-status

Input

Argument Name Description Required
job_id ID of the job returned by Silent Push actions. Required
max_wait Number of seconds to wait for results (0-25 seconds). Optional
status_only Return job status, even if job is complete. Optional
force_metadata_on Always return query metadata, even if original request did not include metadata. Optional
force_metadata_off Never return query metadata, even if original request did include metadata. Optional

Context Output

Path Type Description
SilentPush.JobStatus.get String URL to retrieve the job status.
SilentPush.JobStatus.job_id String Unique identifier for the job.
SilentPush.JobStatus.status String Current status of the job.

Command Example

!silentpush-get-job-status job_id="d4067541-eafb-424c-98d3-de12d7a91331"

Context Example

{
 "job_id": "d4067541-eafb-424c-98d3-de12d7a91331",
 "job_status": {
  "job_id": "d4067541-eafb-424c-98d3-de12d7a91331",
  "status": "PENDING"
 }
}

Human Readable Output

Result

Field Value
Job ID d4067541-eafb-424c-98d3-de12d7a91331
Status PENDING

silentpush-get-nameserver-reputation

This command retrieve historical reputation data for a specified nameserver, including reputation scores and optional detailed calculation information.

Base Command

silentpush-get-nameserver-reputation

Input

Argument Name Description Required
nameserver Nameserver name for which information needs to be retrieved. Required
explain Show the information used to calculate the reputation score. Optional
limit The maximum number of reputation history to retrieve. Optional

Context Output

Path Type Description
SilentPush.NameserverReputation.nameserver Number The nameserver associated with the reputation history entry.
SilentPush.NameserverReputation.reputation_data.date Number Date of the reputation history entry (in YYYYMMDD format).
SilentPush.NameserverReputation.reputation_data.ns_server String Name of the nameserver associated with the reputation history entry.
SilentPush.NameserverReputation.reputation_data.ns_server_reputation Number Reputation score of the nameserver on the specified date.
SilentPush.NameserverReputation.reputation_data.ns_server_reputation_explain.ns_server_domain_density Number Number of domains associated with the nameserver.
SilentPush.NameserverReputation.reputation_data.ns_server_reputation_explain.ns_server_domains_listed Number Number of domains listed in reputation databases.

Command Example

!silentpush-get-nameserver-reputation nameserver="a.dns-servers.net.ru" limit="5"

Context Example

{
 "nameserver": "a.dns-servers.net.ru",
 "limit": 5,
 "nameserver_reputation_data": {
  "date": "2025-04-05",
  "ns_server": "a.dns-servers.net.ru",
  "ns_server_reputation": 0
 }
}

Human Readable Output

Result

Field Value
Nameserver a.dns-servers.net.ru
Date 2025-04-05
Nameserver Reputation 0

silentpush-get-subnet-reputation

This command retrieves the reputation history for a specific subnet.

Base Command

silentpush-get-subnet-reputation

Input

Argument Name Description Required
subnet IPv4 subnet for which reputation information needs to be retrieved. Required
explain Show the detailed information used to calculate the reputation score. Optional
limit Maximum number of reputation history entries to retrieve. Optional

Context Output

Path Type Description
SilentPush.SubnetReputation.subnet String The subnet associated with the reputation history.
SilentPush.SubnetReputation.reputation_history.date Number The date of the subnet reputation record.
SilentPush.SubnetReputation.reputation_history.subnet String The subnet associated with the reputation record.
SilentPush.SubnetReputation.reputation_history.subnet_reputation Number The reputation score of the subnet.
SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_in_subnet Number Total number of IPs in the subnet.
SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_num_active Number Number of active IPs in the subnet.
SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_num_listed Number Number of listed IPs in the subnet.

Command Example

!silentpush-get-subnet-reputation subnet="192.168.0.0/16"

Context Example

{
 "subnet": "192.168.0.0/16",
 "subnet_reputation_data": {
  "date": "2025-04-08",
  "subnet": "192.168.0.0/16",
  "subnet_reputation": 0
 }
}

Human Readable Output

Result

Field Value
Subnet 192.168.0.0/16
Date 2025-04-08
Subnet Reputation 0

silentpush-list-domain-information

This command get domain information along with Silent Push risk score and live whois information for multiple domains.

Base Command

silentpush-list-domain-information

Input

Argument Name Description Required
domains Comma-separated list of domains to query. Required
fetch_risk_score Whether to fetch risk scores for the domains. Optional
fetch_whois_info Whether to fetch WHOIS information for the domains. Optional

Context Output

Path Type Description
SilentPush.Domain.domain String The domain name queried.
SilentPush.Domain.last_seen Number The last seen date of the domain in YYYYMMDD format.
SilentPush.Domain.query String The domain name used for the query.
SilentPush.Domain.whois_age Number The age of the domain in days based on WHOIS creation date.
SilentPush.Domain.first_seen Number The first seen date of the domain in YYYYMMDD format.
SilentPush.Domain.is_new Boolean Indicates whether the domain is newly observed.
SilentPush.Domain.zone String The top-level domain (TLD) or zone of the queried domain.
SilentPush.Domain.registrar String The registrar responsible for the domain registration.
SilentPush.Domain.age_score Number A risk score based on the domain’s age.
SilentPush.Domain.whois_created_date String The WHOIS creation date of the domain in YYYY-MM-DD HH:MM:SS format.
SilentPush.Domain.is_new_score Number A risk score indicating how new the domain is.
SilentPush.Domain.age Number The age of the domain in days.

Command Example

!silentpush-list-domain-information domains="silentpush.com"

Context Example

{
 "domains": ["silentpush.com"],
 "domain_information": {
  "domain": "silentpush.com",
  "age": 1904,
  "age_score": 0,
  "first_seen": "2020-01-21",
  "is_new": false,
  "is_new_score": 0,
  "last_seen": "2025-04-08",
  "registrar": "ENOM, INC.",
  "whois_age": 1904,
  "whois_created_date": "2020-01-20 08:14:27",
  "zone": "com"
 }
}

Human Readable Output

Results

Field Value
Domain silentpush.com
Age 1904 years
Age Score 0
First Seen 2020-01-21
Is New No
Is New Score 0
Last Seen 2025-04-08
Registrar ENOM, INC.
WHOIS Age 1904 years
WHOIS Created Date 2020-01-20 08:14:27
Zone com

silentpush-list-domain-infratags

This command get infratags for multiple domains with optional clustering.

Base Command

silentpush-list-domain-infratags

Input

Argument Name Description Required
domains Comma-separated list of domains. Required
cluster Whether to cluster the results. Optional
mode Mode for lookup (live/padns). Defaults to “live”. Default is live. Optional
match Handling of self-hosted infrastructure. Defaults to “self”. Default is self. Optional
as_of Build infratags from padns data where the as_of timestamp equivalent is between the first_seen and the last_seen timestamp - automatically sets mode to padns. Example :- date: yyyy-mm-dd (2021-07-09) - fixed date, epoch: number (1625834953) - fixed time in epoch format, sec: negative number (-172800) - relative time <sec> seconds ago. Default is self. Optional

Context Output

Path Type Description
SilentPush.InfraTags.infratags.domain String The domain associated with the infratag.
SilentPush.InfraTags.infratags.mode String The mode associated with the domain infratag.
SilentPush.InfraTags.infratags.tag String The tag associated with the domain infratag.
SilentPush.InfraTags.tag_clusters.25.domains Unknown List of domains in the tag cluster with score 25.
SilentPush.InfraTags.tag_clusters.25.match String The match string associated with the domains in the tag cluster with score 25.
SilentPush.InfraTags.tag_clusters.50.domains Unknown List of domains in the tag cluster with score 50.
SilentPush.InfraTags.tag_clusters.50.match String The match string associated with the domains in the tag cluster with score 50.
SilentPush.InfraTags.tag_clusters.75.domains Unknown List of domains in the tag cluster with score 75.
SilentPush.InfraTags.tag_clusters.75.match String The match string associated with the domains in the tag cluster with score 75.
SilentPush.InfraTags.tag_clusters.100.domains Unknown List of domains in the tag cluster with score 100.
SilentPush.InfraTags.tag_clusters.100.match String The match string associated with the domains in the tag cluster with score 100.

Command Example

!silentpush-list-domain-infratags domains="silentpush.com" mode="live" match="self" as_of="self"

Context Example

{
 "domains": ["silentpush.com"],
 "mode": "live",
 "match": "self",
 "as_of": "self",
 "infratags": {
  "domain": "silentpush.com",
  "mode": "padns",
  "tags": ["outlook.com", "cloudflare.com", "cloudflarenet", "enom"]
 }
}

Human Readable Output

Results

Field Value
Domain silentpush.com
Mode padns
Tags outlook.com, cloudflare.com, cloudflarenet, enom

silentpush-list-ip-information

This command get IP information for multiple IPv4s and IPv6s.

Base Command

silentpush-list-ip-information

Input

Argument Name Description Required
ips Comma-separated list of IP addresses. Required

Context Output

Path Type Description
SilentPush.IPInformation.ip_is_dsl_dynamic Boolean Indicates if the IP is a DSL dynamic IP.
SilentPush.IPInformation.ip_has_expired_certificate Boolean Indicates if the IP has an expired certificate.
SilentPush.IPInformation.subnet_allocation_age String Age of the subnet allocation.
SilentPush.IPInformation.asn_rank_score Number Rank score of the ASN.
SilentPush.IPInformation.asn_allocation_age Number Age of the ASN allocation in days.
SilentPush.IPInformation.sp_risk_score Number Risk score of the service provider (SP).
SilentPush.IPInformation.asn_takedown_reputation_explain.ips_active Number Number of active IPs in the ASN takedown reputation.
SilentPush.IPInformation.asn_takedown_reputation_explain.ips_in_asn Number Total number of IPs in the ASN.
SilentPush.IPInformation.asn_takedown_reputation_explain.ips_num_listed Number Number of IPs listed in the ASN takedown reputation.
SilentPush.IPInformation.asn_takedown_reputation_explain.items_num_listed Number Number of items listed in the ASN takedown reputation.
SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_avg Number Average lifetime of items in the ASN takedown reputation.
SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_max Number Maximum lifetime of items in the ASN takedown reputation.
SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_total Number Total lifetime of items in the ASN takedown reputation.
SilentPush.IPInformation.ip_reputation_score Number Reputation score of the IP.
SilentPush.IPInformation.listing_score_feeds_explain String Explanation of the listing score feeds.
SilentPush.IPInformation.ip String The IP address being evaluated.
SilentPush.IPInformation.density Number Density score of the IP.
SilentPush.IPInformation.benign_info.actor String Actor associated with the benign info.
SilentPush.IPInformation.benign_info.known_benign Boolean Indicates if the IP is known benign.
SilentPush.IPInformation.benign_info.tags String Tags associated with the benign info.
SilentPush.IPInformation.ip_reputation_explain String Explanation of the IP reputation.
SilentPush.IPInformation.asn_allocation_date Number The ASN allocation date.
SilentPush.IPInformation.subnet_allocation_date String The subnet allocation date.
SilentPush.IPInformation.asn_takedown_reputation Number Reputation score of ASN takedown.
SilentPush.IPInformation.ip_location.continent_code String Continent code of the IP location.
SilentPush.IPInformation.ip_location.continent_name String Continent name of the IP location.
SilentPush.IPInformation.ip_location.country_code String Country code of the IP location.
SilentPush.IPInformation.ip_location.country_is_in_european_union Boolean Indicates if the country is in the European Union.
SilentPush.IPInformation.ip_location.country_name String Country name of the IP location.
SilentPush.IPInformation.date Number Date associated with the IP data.
SilentPush.IPInformation.subnet_reputation_score Number Reputation score of the subnet.
SilentPush.IPInformation.asn_rank Number Rank of the ASN.
SilentPush.IPInformation.listing_score_explain String Explanation of the listing score.
SilentPush.IPInformation.asn_reputation_score Number Reputation score of the ASN.
SilentPush.IPInformation.ip_is_ipfs_node Boolean Indicates if the IP is an IPFS node.
SilentPush.IPInformation.ip_reputation Number Reputation score of the IP.
SilentPush.IPInformation.subnet_reputation_explain String Explanation of the subnet reputation.
SilentPush.IPInformation.ip_is_dsl_dynamic_score Number Score indicating if the IP is a DSL dynamic IP.
SilentPush.IPInformation.asn_reputation_explain String Explanation of the ASN reputation.
SilentPush.IPInformation.ip_has_open_directory Boolean Indicates if the IP has an open directory.
SilentPush.IPInformation.ip_ptr String Pointer (PTR) record for the IP.
SilentPush.IPInformation.listing_score Number Listing score of the IP.
SilentPush.IPInformation.malscore Number Malware score associated with the IP.
SilentPush.IPInformation.sinkhole_info.known_sinkhole_ip Boolean Indicates if the IP is a known sinkhole IP.
SilentPush.IPInformation.sinkhole_info.tags String Tags associated with the sinkhole information.
SilentPush.IPInformation.subnet_reputation Number Reputation score of the subnet.
SilentPush.IPInformation.asn_reputation Number Reputation score of the ASN.
SilentPush.IPInformation.asn Number Autonomous System Number (ASN) of the IP.
SilentPush.IPInformation.sp_risk_score_explain.sp_risk_score_decider String Decider for the service provider risk score.
SilentPush.IPInformation.asname String Name of the ASN.
SilentPush.IPInformation.subnet String The subnet the IP belongs to.
SilentPush.IPInformation.ip_is_tor_exit_node Boolean Indicates if the IP is a TOR exit node.
SilentPush.IPInformation.asn_takedown_reputation_score Number Reputation score of ASN takedown.
SilentPush.IPInformation.ip_flags.is_proxy Boolean Indicates if the IP is a proxy (True/False).
SilentPush.IPInformation.ip_flags.is_sinkhole Boolean Indicates if the IP is a sinkhole (True/False).
SilentPush.IPInformation.ip_flags.is_vpn Boolean Indicates if the IP is a VPN (True/False).
SilentPush.IPInformation.ip_flags.proxy_tags Unknown List of proxy-related tags or null if not a proxy.
SilentPush.IPInformation.ip_flags.vpn_tags Unknown List of VPN-related tags or null if not a VPN.

Command Example

!silentpush-list-ip-information ips="0.0.0.0"

Context Example

{
 "ips": ["0.0.0.0"],
 "ip_information": {
  "asn": "15169",
  "asn_allocation_age": 9140,
  "asn_allocation_date": "2000-03-30",
  "asn_rank": 0,
  "asn_rank_score": 0,
  "asn_reputation": 0,
  "asn_reputation_score": 0,
  "asn_takedown_reputation": 10,
  "asn_takedown_reputation_explain": "ips_active: 327064, ips_in_asn: 15309568, ips_num_listed: 5",
  "asn_takedown_reputation_score": 10,
  "as_name": "GOOGLE, US",
  "benign_info": {
   "actor": "",
   "known_benign": false
  },
  "tags": [],
  "date": "2025-04-08",
  "density": 0,
  "ip": "0.0.0.0",
  "ip_flags": {
   "is_proxy": false,
   "is_sinkhole": false,
   "is_vpn": false
  },
  "ip_has_expired_certificate": false,
  "ip_has_open_directory": false,
  "ip_is_dsl_dynamic": false,
  "ip_is_dsl_dynamic_score": 0
 }
}

Human Readable Output

Results

Field Value
ASN 15169
ASN Allocation Age 9140 days
ASN Allocation Date 2000-03-30
ASN Rank 0
ASN Rank Score 0
ASN Reputation 0
ASN Reputation Score 0
ASN Takedown Reputation 10
Takedown Explanation ips_active: 327064, ips_in_asn: 15309568, ips_num_listed: 5
ASN Takedown Reputation Score 10
AS Name GOOGLE, US
Known Benign No
Date 2025-04-08
Density 0
IP Flags (Proxy, Sinkhole, VPN) No, No, No
Expired Certificate No
Open Directory No
DSL Dynamic No
DSL Dynamic Score 0

silentpush-live-url-scan

This command scan a URL to retrieve hosting metadata..

Base Command

silentpush-live-url-scan

Input

Argument Name Description Required
url URL to scan. Required
platform Platform to scan the URL on. Optional
os Operating system to scan the URL on. Optional
browser Browser to scan the URL on. Optional
region Region to scan the URL in. Optional

Context Output

Path Type Description
SilentPush.URLScan.HHV String Unique identifier for HHV.
SilentPush.URLScan.adtech.ads_txt Boolean Indicates if ads_txt is present.
SilentPush.URLScan.adtech.app_ads_txt Boolean Indicates if app_ads_txt is present.
SilentPush.URLScan.adtech.sellers_json Boolean Indicates if sellers_json is present.
SilentPush.URLScan.datahash String Hash value of the data.
SilentPush.URLScan.domain String The domain name.
SilentPush.URLScan.favicon2_avg String Hash value for favicon2 average.
SilentPush.URLScan.favicon2_md5 String MD5 hash for favicon2.
SilentPush.URLScan.favicon2_murmur3 Number Murmur3 hash for favicon2.
SilentPush.URLScan.favicon2_path String Path to favicon2 image.
SilentPush.URLScan.favicon_avg String Hash value for favicon average.
SilentPush.URLScan.favicon_md5 String MD5 hash for favicon.
SilentPush.URLScan.favicon_murmur3 String Murmur3 hash for favicon.
SilentPush.URLScan.favicon_path String Path to favicon image.
SilentPush.URLScan.favicon_urls Unknown List of favicon URLs.
SilentPush.URLScan.header.cache-control String Cache control header value.
SilentPush.URLScan.header.content-encoding String Content encoding header value.
SilentPush.URLScan.header.content-type String Content type header value.
SilentPush.URLScan.header.server String Server header value.
SilentPush.URLScan.header.x-powered-by String X-Powered-By header value.
SilentPush.URLScan.hostname String The hostname of the server.
SilentPush.URLScan.html_body_length Number Length of the HTML body.
SilentPush.URLScan.html_body_murmur3 Number Murmur3 hash for the HTML body.
SilentPush.URLScan.html_body_sha256 String SHA256 hash for the HTML body.
SilentPush.URLScan.html_body_similarity Number Similarity score of the HTML body.
SilentPush.URLScan.html_body_ssdeep String ssdeep hash for the HTML body.
SilentPush.URLScan.htmltitle String The HTML title of the page.
SilentPush.URLScan.ip String IP address associated with the domain.
SilentPush.URLScan.jarm String JARM (TLS fingerprint) value.
SilentPush.URLScan.mobile_enabled Boolean Indicates if the mobile version is enabled.
SilentPush.URLScan.opendirectory Boolean Indicates if open directory is enabled.
SilentPush.URLScan.origin_domain String Origin domain of the server.
SilentPush.URLScan.origin_hostname String Origin hostname of the server.
SilentPush.URLScan.origin_ip String Origin IP address of the server.
SilentPush.URLScan.origin_jarm String JARM (TLS fingerprint) value for the origin.
SilentPush.URLScan.origin_path String Origin path for the URL.
SilentPush.URLScan.origin_port Number Port used for the origin server.
SilentPush.URLScan.origin_ssl.CHV String SSL Certificate Chain Value (CHV).
SilentPush.URLScan.origin_ssl.SHA1 String SHA1 hash of the SSL certificate.
SilentPush.URLScan.origin_ssl.SHA256 String SHA256 hash of the SSL certificate.
SilentPush.URLScan.origin_ssl.authority_key_id String Authority Key Identifier for SSL certificate.
SilentPush.URLScan.origin_ssl.expired Boolean Indicates if the SSL certificate is expired.
SilentPush.URLScan.origin_ssl.issuer.common_name String Issuer common name for SSL certificate.
SilentPush.URLScan.origin_ssl.issuer.country String Issuer country for SSL certificate.
SilentPush.URLScan.origin_ssl.issuer.organization String Issuer organization for SSL certificate.
SilentPush.URLScan.origin_ssl.not_after String Expiration date of the SSL certificate.
SilentPush.URLScan.origin_ssl.not_before String Start date of the SSL certificate validity.
SilentPush.URLScan.origin_ssl.sans Unknown List of Subject Alternative Names (SANs) for the SSL certificate.
SilentPush.URLScan.origin_ssl.sans_count Number Count of SANs for the SSL certificate.
SilentPush.URLScan.origin_ssl.serial_number String Serial number of the SSL certificate.
SilentPush.URLScan.origin_ssl.sigalg String Signature algorithm used for the SSL certificate.
SilentPush.URLScan.origin_ssl.subject.common_name String Subject common name for the SSL certificate.
SilentPush.URLScan.origin_ssl.subject_key_id String Subject Key Identifier for SSL certificate.
SilentPush.URLScan.origin_ssl.valid Boolean Indicates if the SSL certificate is valid.
SilentPush.URLScan.origin_ssl.wildcard Boolean Indicates if the SSL certificate is a wildcard.
SilentPush.URLScan.origin_subdomain String Subdomain of the origin.
SilentPush.URLScan.origin_tld String Top-level domain of the origin.
SilentPush.URLScan.origin_url String Complete URL of the origin.
SilentPush.URLScan.path String Path for the URL.
SilentPush.URLScan.port Number Port for the URL.
SilentPush.URLScan.proxy_enabled Boolean Indicates if the proxy is enabled.
SilentPush.URLScan.redirect Boolean Indicates if a redirect occurs.
SilentPush.URLScan.redirect_count Number Count of redirects.
SilentPush.URLScan.redirect_list Unknown List of redirect URLs.
SilentPush.URLScan.resolves_to Unknown List of IPs the domain resolves to.
SilentPush.URLScan.response Number HTTP response code.
SilentPush.URLScan.scheme String URL scheme (e.g., https).
SilentPush.URLScan.screenshot String URL for the domain screenshot.
SilentPush.URLScan.ssl.CHV String SSL Certificate Chain Value (CHV).
SilentPush.URLScan.ssl.SHA1 String SHA1 hash of the SSL certificate.
SilentPush.URLScan.ssl.SHA256 String SHA256 hash of the SSL certificate.
SilentPush.URLScan.ssl.authority_key_id String Authority Key Identifier for SSL certificate.
SilentPush.URLScan.ssl.expired Boolean Indicates if the SSL certificate is expired.
SilentPush.URLScan.ssl.issuer.common_name String Issuer common name for SSL certificate.
SilentPush.URLScan.ssl.issuer.country String Issuer country for SSL certificate.
SilentPush.URLScan.ssl.issuer.organization String Issuer organization for SSL certificate.
SilentPush.URLScan.ssl.not_after String Expiration date of the SSL certificate.
SilentPush.URLScan.ssl.not_before String Start date of the SSL certificate validity.
SilentPush.URLScan.ssl.sans Unknown List of Subject Alternative Names (SANs) for the SSL certificate.
SilentPush.URLScan.ssl.sans_count Number Count of SANs for the SSL certificate.
SilentPush.URLScan.ssl.serial_number String Serial number of the SSL certificate.
SilentPush.URLScan.ssl.sigalg String Signature algorithm used for the SSL certificate.
SilentPush.URLScan.ssl.subject.common_name String Subject common name for the SSL certificate.
SilentPush.URLScan.ssl.subject_key_id String Subject Key Identifier for SSL certificate.
SilentPush.URLScan.ssl.valid Boolean Indicates if the SSL certificate is valid.
SilentPush.URLScan.ssl.wildcard Boolean Indicates if the SSL certificate is a wildcard.
SilentPush.URLScan.body_analysis.SHV String Unique identifier for body analysis.
SilentPush.URLScan.body_analysis.body_sha256 String SHA-256 hash of the body content.
SilentPush.URLScan.body_analysis.google-GA4 Unknown List of Google GA4 tracking IDs.
SilentPush.URLScan.body_analysis.google-UA Unknown List of Google Universal Analytics tracking IDs.
SilentPush.URLScan.body_analysis.google-adstag Unknown List of Google Adstag tracking IDs.
SilentPush.URLScan.body_analysis.js_sha256 Unknown List of SHA-256 hashes of JavaScript files.
SilentPush.URLScan.body_analysis.js_ssdeep Unknown List of ssdeep fuzzy hashes of JavaScript files.

Command Example

!silentpush-live-url-scan url="https://example.com"

Context Example

{
 "url": "https://example.com",
 "scan_results": {
  "status": "No scan results found",
  "url": "https://example.com"
 }
}

Human Readable Output

Results

Field Value
URL https://example.com
Scan Status No scan results found

silentpush-reverse-padns-lookup

This command retrieve reverse Passive DNS data for specific DNS record types.

Base Command

silentpush-reverse-padns-lookup

Input

Argument Name Description Required
qtype Type of DNS record. Required
qname The DNS record name to lookup. Required
netmask The netmask for the lookup. Optional
subdomains Whether to include subdomains in the lookup. Optional
regex Regular expression to filter the DNS records. Optional
first_seen_after Filter for records first seen after a specific date/time. Optional
first_seen_before Filter for records first seen before a specific date/time. Optional
last_seen_after Filter for records last seen after a specific date/time. Optional
last_seen_before Filter for records last seen before a specific date/time. Optional
as_of Specify a date/time for the PADNS lookup. Optional
sort Sort the results by specified criteria. Optional
output_format Format for the output (e.g., JSON, XML). Optional
prefer Preference for certain record types during the lookup. Optional
with_metadata Include metadata in the results. Optional
max_wait Maximum wait time in seconds for the lookup results. Optional
skip Number of results to skip in pagination. Optional
limit Limit the number of results returned. Optional

Context Output

Path Type Description
SilentPush.ReversePADNSLookup.qname String The DNS record name looked up.
SilentPush.ReversePADNSLookup.qtype String The type of the DNS record.
SilentPush.ReversePADNSLookup.records.answer String The answer for the DNS query.
SilentPush.ReversePADNSLookup.records.count Number The number of occurrences of the DNS record.
SilentPush.ReversePADNSLookup.records.first_seen String Timestamp of when the record was first seen.
SilentPush.ReversePADNSLookup.records.last_seen String Timestamp of the most recent occurrence of the record.
SilentPush.ReversePADNSLookup.records.nshash String The hash of the NS record.
SilentPush.ReversePADNSLookup.records.query String The DNS query associated with the record.
SilentPush.ReversePADNSLookup.records.ttl Number Time-to-live (TTL) of the DNS record.
SilentPush.ReversePADNSLookup.records.type String The type of DNS record (e.g., NS).

Command Example

!silentpush-reverse-padns-lookup qtype="ns" qname="vida.ns.cloudflare.com"

Context Example

{
 "qtype": "ns",
 "qname": "vida.ns.cloudflare.com",
 "reverse_padns_lookup": {
  "answer": "vida.ns.cloudflare.com",
  "count": 541,
  "first_seen": "2023-10-25 18:46:27",
  "last_seen": "2025-04-08 09:37:41",
  "nshash": "9448b4ad541f0e539d2f5ad271d6d581",
  "query": "ernestchadwick.com"
 }
}

Human Readable Output

Results

Field Value
Answer vida.ns.cloudflare.com
Query Count 541
First Seen 2023-10-25 18:46:27
Last Seen 2025-04-08 09:37:41
NS Hash 9448b4ad541f0e539d2f5ad271d6d581
Query Domain ernestchadwick.com

silentpush-screenshot-url

This commandGenerate screenshot of a URL.

Base Command

silentpush-screenshot-url

Input

Argument Name Description Required
url URL for the screenshot. Required

Context Output

Path Type Description
SilentPush.Screenshot.file_id String Unique identifier for the generated screenshot file.
SilentPush.Screenshot.file_name String Name of the screenshot file.
SilentPush.Screenshot.screenshot_url String URL to access the generated screenshot.
SilentPush.Screenshot.status String Status of the screenshot generation process.
SilentPush.Screenshot.status_code Number HTTP status code of the response.
SilentPush.Screenshot.url String The URL that was used to generate the screenshot.

Command Example

!silentpush-screenshot-url url="https://www.virustotal.com/gui/domain/tbibank-bg.com"

Context Example

{
 "url": "https://www.virustotal.com/gui/domain/tbibank-bg.com",
 "screenshot_data": {
  "status": "Success",
  "screenshot_url": "https://fs.silentpush.com/screenshots/virustotal.com/f2fa9440ee769ad6f6702529c006522b.jpg",
  "file_name": "www.virustotal.com_screenshot.jpg"
 }
}

Human Readable Output

Results

Field Value
URL https://www.virustotal.com/gui/domain/tbibank-bg.com
Status Success
Screenshot URL View Screenshot
File Name www.virustotal.com_screenshot.jpg

silentpush-search-domains

This command search for domains with optional filters.

Base Command

silentpush-search-domains

Input

Argument Name Description Required
domain Name or wildcard pattern of domain names to search for. Optional
domain_regex A valid RE2 regex pattern to match domains. Overrides the domain argument. Optional
name_server Name server name or wildcard pattern of the name server used by domains. Optional
asnum Autonomous System (AS) number to filter domains. Optional
asname Search for all AS numbers where the AS Name begins with the specified value. Optional
min_ip_diversity Minimum IP diversity limit to filter domains. Optional
registrar Name or partial name of the registrar used to register domains. Optional
min_asn_diversity Minimum ASN diversity limit to filter domains. Optional
certificate_issuer Filter domains that had SSL certificates issued by the specified certificate issuer. Wildcards supported. Optional
whois_date_after Filter domains with a WHOIS creation date after this date (YYYY-MM-DD). Optional
skip Number of results to skip in the search query. Optional
limit Number of results to return. Defaults to the SilentPush API’s behavior. Optional

Context Output

Path Type Description
SilentPush.Domain.asn_diversity Number The diversity of Autonomous System Numbers (ASNs) associated with the domain.
SilentPush.Domain.host String The domain name (host) associated with the record.
SilentPush.Domain.ip_diversity_all Number The total number of unique IPs associated with the domain.
SilentPush.Domain.ip_diversity_groups Number The number of unique IP groups associated with the domain.

Command Example

!silentpush-search-domains

Context Example

{
 "domain_search_results": [
  {
   "asn_diversity": 1,
   "host": "0-------------------------------------------------------------0.com",
   "ip_diversity_all": 1,
   "ip_diversity_groups": 1
  }
 ]
}

Human Readable Output

Results

Field Value
ASN Diversity 1
Host 0————————————————————-0.com
IP Diversity (All) 1
IP Diversity Groups 1

silentpush-search-scan-data

This command search Silent Push scan data repositories using SPQL queries.

Base Command

silentpush-search-scan-data

Input

Argument Name Description Required
query SPQL query string. Required
fields Fields to return in the response. Optional
sort Sorting criteria for results. Optional
skip Number of records to skip in the response. Optional
limit Maximum number of results to return. Optional
with_metadata Whether to include metadata in the response. Optional

Context Output

Path Type Description
SilentPush.ScanData.HHV String Unique identifier for the scan data entry.
SilentPush.ScanData.adtech Unknown Adtech information for the scan data entry.
SilentPush.ScanData.adtech.ads_txt Boolean Indicates if ads.txt is used.
SilentPush.ScanData.adtech.app_ads_txt Boolean Indicates if app_ads.txt is used.
SilentPush.ScanData.adtech.sellers_json Boolean Indicates if sellers.json is used.
SilentPush.ScanData.body_analysis Unknown Body analysis for the scan data entry.
SilentPush.ScanData.body_analysis.body_sha256 String SHA256 hash of the body.
SilentPush.ScanData.body_analysis.language Unknown Languages detected in the body.
SilentPush.ScanData.body_analysis.ICP_license String ICP License information.
SilentPush.ScanData.body_analysis.SHV String Server Hash Verification value.
SilentPush.ScanData.body_analysis.adsense Unknown List of AdSense data.
SilentPush.ScanData.body_analysis.footer_sha256 String SHA-256 hash of the footer content.
SilentPush.ScanData.body_analysis.google-GA4 Unknown List of Google GA4 identifiers.
SilentPush.ScanData.body_analysis.google-UA Unknown List of Google Universal Analytics identifiers.
SilentPush.ScanData.body_analysis.google-adstag Unknown List of Google adstag identifiers.
SilentPush.ScanData.body_analysis.header_sha256 Unknown SHA-256 hash of the header content.
SilentPush.ScanData.body_analysis.js_sha256 Unknown List of JavaScript files with SHA-256 hash values.
SilentPush.ScanData.body_analysis.js_ssdeep Unknown List of JavaScript files with SSDEEP hash values.
SilentPush.ScanData.body_analysis.onion Unknown List of Onion URLs detected.
SilentPush.ScanData.body_analysis.telegram Unknown List of Telegram-related information.
SilentPush.ScanData.datahash String Hash of the data.
SilentPush.ScanData.datasource String Source of the scan data.
SilentPush.ScanData.domain String Domain associated with the scan data.
SilentPush.ScanData.geoip Unknown GeoIP information related to the scan.
SilentPush.ScanData.geoip.city_name String City where the scan data was retrieved.
SilentPush.ScanData.geoip.country_name String Country name from GeoIP information.
SilentPush.ScanData.geoip.location Unknown Geo-location coordinates.
SilentPush.ScanData.geoip.location.lat Number Latitude from GeoIP location.
SilentPush.ScanData.geoip.location.lon Number Longitude from GeoIP location.
SilentPush.ScanData.header Unknown HTTP header information for the scan.
SilentPush.ScanData.header.content-length String Content length from HTTP response header.
SilentPush.ScanData.header.location String Location from HTTP response header.
SilentPush.ScanData.header.connection String Connection type used, e.g., keep-alive.
SilentPush.ScanData.header.server String Server software used to serve the content, e.g., openresty.
SilentPush.ScanData.hostname String Hostname associated with the scan data.
SilentPush.ScanData.html_body_sha256 String SHA256 hash of the HTML body.
SilentPush.ScanData.htmltitle String Title of the HTML page scanned.
SilentPush.ScanData.ip String IP address associated with the scan.
SilentPush.ScanData.jarm String JARM hash value.
SilentPush.ScanData.mobile_enabled Boolean Indicates if the page is mobile-enabled.
SilentPush.ScanData.origin_domain String Origin domain associated with the scan.
SilentPush.ScanData.origin_geoip Unknown GeoIP information of the origin domain.
SilentPush.ScanData.origin_geoip.city_name String City of the origin domain from GeoIP information.
SilentPush.ScanData.origin_hostname String Origin hostname associated with the scan data.
SilentPush.ScanData.origin_ip String Origin IP address of the scan.
SilentPush.ScanData.origin_jarm String JARM hash value of the origin domain.
SilentPush.ScanData.origin_ssl Unknown SSL certificate information for the origin domain.
SilentPush.ScanData.origin_ssl.SHA256 String SHA256 of the SSL certificate.
SilentPush.ScanData.origin_ssl.subject Unknown Subject of the SSL certificate.
SilentPush.ScanData.origin_ssl.subject.common_name String Common name in the SSL certificate.
SilentPush.ScanData.port Number Port used during the scan.
SilentPush.ScanData.redirect Boolean Indicates if a redirect occurred during the scan.
SilentPush.ScanData.redirect_count Number Count of redirects encountered.
SilentPush.ScanData.redirect_list Unknown List of redirect URLs encountered during the scan.
SilentPush.ScanData.response Number HTTP response code received during the scan.
SilentPush.ScanData.scan_date String Timestamp of the scan date.
SilentPush.ScanData.scheme String URL scheme used in the scan.
SilentPush.ScanData.ssl Unknown SSL certificate details for the scan.
SilentPush.ScanData.ssl.SHA256 String SHA256 of the SSL certificate.
SilentPush.ScanData.ssl.subject Unknown Subject of the SSL certificate.
SilentPush.ScanData.ssl.subject.common_name String Common name in the SSL certificate.
SilentPush.ScanData.subdomain String Subdomain associated with the scan data.
SilentPush.ScanData.tld String Top-level domain (TLD) of the scanned URL.
SilentPush.ScanData.url String The URL scanned.

Command Example

!silentpush-search-scan-data query="tld=cool" limit="5"

Context Example

{
 "query": "tld=cool",
 "limit": 5,
 "scan_data": [
  {
   "domain": "volunteering.cool",
   "ip": "0.0.0.0",
   "asn": "16509",
   "asn_org": "AMAZON-02",
   "city": "Boardman",
   "country": "United States",
   "region": "Oregon",
   "latitude": 45.8401,
   "longitude": -119.705,
   "timezone": "America/Los_Angeles",
   "server": "openresty",
   "ssl": "http",
   "favicon": "http://example.cool/favicon.ico",
   "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0.0.0.0 Safari/537.3",
   "scan_date": "2025-04-08T09:12:45Z",
   "status_code": 200
  }
 ]
}

Human Readable Output

Results

Field Value
Domain volunteering.cool
IP Address 0.0.0.0
ASN 16509
ASN Organization AMAZON-02
City Boardman
Country United States
Region Oregon
Latitude 45.8401
Longitude -119.705
Timezone America/Los_Angeles
Server openresty
SSL/TLS Status HTTP (No SSL)
Favicon Favicon
User Agent Mozilla/5.0 (Linux x86_64)
Scan Date 2025-04-08T09:12:45Z
HTTP Status Code 200

silentpush-run-threat-check

This command runs the threat check on the specified

Base Command

silentpush-run-threat-check

Input

Argument Name Description Required
data The name of the data source to query. Required
query The value to check for threats (e.g., IP or domain). Required
type The type of the value being queried (e.g., ip, domain). Required
user_identifier A unique identifier for the user making the request. Required

Context Output

Path Type Description
SilentPush.RunThreatCheck.is_listed Boolean Indicates whether the queried value is listed as a threat.
SilentPush.RunThreatCheck.listed_txt String Textual description of the listing status.
SilentPush.RunThreatCheck.query String The original value that was checked.

silentpush-add-indicators

This command add indicators to the feed

Base Command

silentpush-add-indicators

Input

Argument Name Description Required
feed_uuid UUID of the feed. Required
indicators Indicators for the feed. Required

Context Output

Path Type Description
SilentPush.AddIndicators.created_or_updated Unknown List of indicator names that were created or updated in the feed.
SilentPush.AddIndicators.invalid_indicators Unknown List of indicators that were considered invalid and not added to the feed.

silentpush-add-feed

This command add the new feed

Base Command

silentpush-add-feed

Input

Argument Name Description Required
name Name of the feed. Required
type Feed Type. Required
category Feed Category. Optional
vendor Vendor. Optional
feed_description URL for the screenshot. Optional
tags Tags that should be attached with the feed. Optional

Context Output

Path Type Description
SilentPush.Feed.name String The name of the feed.
SilentPush.Feed.type String The type of the feed.
SilentPush.Feed.vendor String The vendor of the feed.
SilentPush.Feed.feed_description String A description of the feed.
SilentPush.Feed.category String The category of the feed.
SilentPush.Feed.tags Unknown Tags associated with the feed.

silentpush-add-feed-tags

This command add indicators to the feed

Base Command

silentpush-add-feed-tags

Input

Argument Name Description Required
feed_uuid Never return query metadata, even if original request did include metadata. Optional
tags Comma separated tags to be updated to the feed. Optional

Context Output

Path Type Description
SilentPush.AddFeedTags.created_or_updated Unknown List of indicator names that were created or updated in the feed.
SilentPush.AddFeedTags.invalid_indicators Unknown List of indicators that were considered invalid and not added to the feed.

silentpush-get-data-exports

This command runs the threat check on the specified

Base Command

silentpush-get-data-exports

Input

Argument Name Description Required
feed_url The URL from which to export the feed data. Required

Context Output

Path Type Description
SilentPush.GetDataExports.EntryID Unknown The EntryID of the report file.
SilentPush.GetDataExports.Extension String The extension of the report file.
SilentPush.GetDataExports.Name String The name of the report file.
SilentPush.GetDataExports.Info String The info of the report file.
SilentPush.GetDataExports.Size Number The size of the report file.
SilentPush.GetDataExports.Type String The type of the report file.

silentpush-add-indicator-tags

This command updates tags to the indicators

Base Command

silentpush-add-indicator-tags

Input

Argument Name Description Required
feed_uuid UUID of the feed. Required
indicator_name The name of the indicator to tag. Required
tags Tags to be added to the indicator. Required

Context Output

Path Type Description
SilentPush.AddIndicatorTags.uuid String The UUID of the indicator.
SilentPush.AddIndicatorTags.name String The name of the indicator.
SilentPush.AddIndicatorTags.tags String The tags assigned to the indicator.

Configuration parameters

  • url — Base URL (required)
  • credentials — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (26)

  • silentpush-add-feed

    This command add the new feed

  • silentpush-add-feed-tags

    This command add indicators to the feed

  • silentpush-add-indicator-tags

    This command updates tags to the indicators

  • silentpush-add-indicators

    This command add indicators to the feed

  • silentpush-density-lookup

    This command queries granular DNS/IP parameters (e.g., NS servers, MX servers, IPaddresses, ASNs) for density information.

  • silentpush-forward-padns-lookup

    This command performs a forward PADNS lookup using various filtering parameters.

  • silentpush-get-asn-reputation

    This command retrieve the reputation information for an IPv4.

  • silentpush-get-asn-takedown-reputation

    This command retrieve the takedown reputation information for an Autonomous System Number (ASN).

  • silentpush-get-asns-for-domain

    This command retrieves Autonomous System Numbers (ASNs) associated with a domain.

  • silentpush-get-data-exports

    This command runs the threat check on the specified

  • silentpush-get-domain-certificates

    This command get certificate data collected from domain scanning.

  • silentpush-get-enrichment-data

    This command retrieves comprehensive enrichment information for a given resource (domain, IPv4, or IPv6).

  • silentpush-get-future-attack-indicators

    This command fetch indicators of potential future attacks using a feed UUID.

  • silentpush-get-ipv4-reputation

    This command retrieves the reputation information for an IPv4.

  • silentpush-get-job-status

    This command retrieve status of running job or results from completed job.

  • silentpush-get-nameserver-reputation

    This command retrieves historical reputation data for a specified nameserver,including reputation scores and optional detailed calculation information.

  • silentpush-get-subnet-reputation

    This command retrieves the reputation history for a specific subnet.

  • silentpush-list-domain-information

    This command get domain information along with Silent Push risk score and live whois information for multiple domains.

  • silentpush-list-domain-infratags

    This command get infratags for multiple domains with optional clustering.

  • silentpush-list-ip-information

    This command get IP information for multiple IPv4s and IPv6s.

  • silentpush-live-url-scan

    This command scan a URL to retrieve hosting metadata.

  • silentpush-reverse-padns-lookup

    This command retrieve reverse Passive DNS data for specific DNS record types.

  • silentpush-run-threat-check

    This command runs the threat check on the specified

  • silentpush-screenshot-url

    This commandGenerate screenshot of a URL.

  • silentpush-search-domains

    This command search for domains with optional filters.

  • silentpush-search-scan-data

    This command search Silent Push scan data repositories using SPQL queries.

Source

SilentPush.py SilentPush_test.py SilentPush.yml SilentPush_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Silent Push Inc.
description: The Silent Push Platform uses first-party data and a proprietary scanning engine to enrich global DNS data with risk and reputation scoring, giving security teams the ability to join the dots across the entire IPv4 and IPv6 range, and identify adversary infrastructure before an attack is launched. The content pack integrates with the Silent Push system to gain insights into domain/IP information, reputations, enrichment, and infratag-related details. It also provides functionality to live-scan URLs and take screenshots of them. Additionally, it allows fetching future attack feeds from the Silent Push system.
commonfields:
  id: SilentPush
  version: -1
name: SilentPush
display: SilentPush
configuration:
- display: Base URL
  name: url
  type: 0
  required: true
  defaultvalue: https://api.silentpush.com
  section: Connect
- display: API Key
  hiddenusername: true
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  commands:
  - deprecated: false
    description: This command add the new feed
    name: silentpush-add-feed
    arguments:
    - name: name
      isArray: false
      description: Name of the feed.
      required: true
      secret: false
      default: false
    - auto: PREDEFINED
      default: false
      description: Feed Type.
      name: type
      required: true
      predefined:
      - domain
      - ip
      - URL
    - name: category
      isArray: false
      description: Feed Category.
      required: false
      secret: false
      default: false
    - name: vendor
      isArray: false
      description: Vendor.
      required: false
      secret: false
      default: false
    - name: feed_description
      isArray: false
      description: URL for the screenshot.
      required: false
      secret: false
      default: false
    - name: tags
      isArray: false
      description: Tags that should be attached with the feed.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Feed.name
      description: The name of the feed.
      type: String
    - contextPath: SilentPush.Feed.type
      description: The type of the feed.
      type: String
    - contextPath: SilentPush.Feed.vendor
      description: The vendor of the feed.
      type: String
    - contextPath: SilentPush.Feed.feed_description
      description: A description of the feed.
      type: String
    - contextPath: SilentPush.Feed.category
      description: The category of the feed.
      type: String
    - contextPath: SilentPush.Feed.tags
      description: Tags associated with the feed.
      type: Unknown
  - deprecated: false
    description: This command add indicators to the feed
    name: silentpush-add-feed-tags
    arguments:
    - name: feed_uuid
      isArray: false
      description: Never return query metadata, even if original request did include metadata.
      required: true
      secret: false
      default: false
    - name: tags
      isArray: false
      description: Comma separated tags to be updated to the feed.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.AddFeedTags.created_or_updated
      description: List of indicator names that were created or updated in the feed.
      type: Unknown
    - contextPath: SilentPush.AddFeedTags.invalid_indicators
      description: List of indicators that were considered invalid and not added to the feed.
      type: Unknown
  - deprecated: false
    description: This command add indicators to the feed
    name: silentpush-add-indicators
    arguments:
    - name: feed_uuid
      isArray: false
      description: UUID of the feed.
      required: true
      secret: false
      default: false
    - name: indicators
      isArray: false
      description: Indicators for the feed.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.AddIndicators.created_or_updated
      description: List of indicator names that were created or updated in the feed.
      type: Unknown
    - contextPath: SilentPush.AddIndicators.invalid_indicators
      description: List of indicators that were considered invalid and not added to the feed.
      type: Unknown
  - deprecated: false
    description: This command updates tags to the indicators
    name: silentpush-add-indicator-tags
    arguments:
    - name: feed_uuid
      isArray: false
      description: UUID of the feed.
      required: true
      secret: false
      default: false
    - name: indicator_name
      isArray: false
      description: The name of the indicator to tag.
      required: true
      secret: false
      default: false
    - name: tags
      isArray: false
      description: Tags to be added to the indicator.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.AddIndicatorTags.uuid
      description: The UUID of the indicator.
      type: String
    - contextPath: SilentPush.AddIndicatorTags.name
      description: The name of the indicator.
      type: String
    - contextPath: SilentPush.AddIndicatorTags.tags
      description: The tags assigned to the indicator.
      type: String
  - deprecated: false
    description: This command queries granular DNS/IP parameters (e.g., NS servers, MX servers, IPaddresses, ASNs) for density information.
    name: silentpush-density-lookup
    arguments:
    - name: qtype
      isArray: false
      description: Query type.
      required: true
      secret: false
      default: false
    - name: query
      isArray: false
      description: Value to query.
      required: true
      secret: false
      default: false
    - name: scope
      isArray: false
      description: Match level (optional).
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.DensityLookup.qtype
      description: 'The following qtypes are supported: nssrv, mxsrv.'
      type: String
    - contextPath: SilentPush.DensityLookup.query
      description: The query value to lookup, which can be the name of an NS or MX server.
      type: String
    - contextPath: SilentPush.DensityLookup.records.density
      description: The density value associated with the query result.
      type: Number
    - contextPath: SilentPush.DensityLookup.records.nssrv
      description: The name server (NS) for the query result.
      type: String
  - deprecated: false
    description: This command performs a forward PADNS lookup using various filtering parameters.
    name: silentpush-forward-padns-lookup
    arguments:
    - name: qtype
      isArray: false
      description: DNS record type.
      required: true
      secret: false
      default: false
    - name: qname
      isArray: false
      description: The DNS record name to lookup.
      required: true
      secret: false
      default: false
    - name: netmask
      isArray: false
      description: The netmask to filter the lookup results.
      required: false
      secret: false
      default: false
    - name: subdomains
      isArray: false
      description: Flag to include subdomains in the lookup results.
      required: false
      secret: false
      default: false
    - name: regex
      isArray: false
      description: Regular expression to filter the DNS records.
      required: false
      secret: false
      default: false
    - name: match
      isArray: false
      description: Type of match for the query (e.g., exact, partial).
      required: false
      secret: false
      default: false
    - name: first_seen_after
      isArray: false
      description: Filter results to include only records first seen after this date.
      required: false
      secret: false
      default: false
    - name: first_seen_before
      isArray: false
      description: Filter results to include only records first seen before this date.
      required: false
      secret: false
      default: false
    - name: last_seen_after
      isArray: false
      description: Filter results to include only records last seen after this date.
      required: false
      secret: false
      default: false
    - name: last_seen_before
      isArray: false
      description: Filter results to include only records last seen before this date.
      required: false
      secret: false
      default: false
    - name: as_of
      isArray: false
      description: Date or time to get the DNS records as of a specific point in time.
      required: false
      secret: false
      default: false
    - name: sort
      isArray: false
      description: Sort the results by the specified field (e.g., date, score).
      required: false
      secret: false
      default: false
    - name: output_format
      isArray: false
      description: The format in which the results should be returned (e.g., JSON, XML).
      required: false
      secret: false
      default: false
    - name: prefer
      isArray: false
      description: Preference for specific DNS servers or sources.
      required: false
      secret: false
      default: false
    - name: with_metadata
      isArray: false
      description: Flag to include metadata in the DNS records.
      required: false
      secret: false
      default: false
    - name: max_wait
      isArray: false
      description: Maximum number of seconds to wait for results before timing out.
      required: false
      secret: false
      default: false
    - name: skip
      isArray: false
      description: Number of results to skip for pagination purposes.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Maximum number of results to return.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.PADNSLookup.qname
      description: The DNS record name that was looked up.
      type: String
    - contextPath: SilentPush.PADNSLookup.qtype
      description: The DNS record type queried (e.g., NS).
      type: String
    - contextPath: SilentPush.PADNSLookup.records.answer
      description: The answer (e.g., name server) for the DNS record.
      type: String
    - contextPath: SilentPush.PADNSLookup.records.count
      description: The number of occurrences for this DNS record.
      type: Number
    - contextPath: SilentPush.PADNSLookup.records.first_seen
      description: The timestamp when this DNS record was first seen.
      type: String
    - contextPath: SilentPush.PADNSLookup.records.last_seen
      description: The timestamp when this DNS record was last seen.
      type: String
    - contextPath: SilentPush.PADNSLookup.records.nshash
      description: Unique hash for the DNS record.
      type: String
    - contextPath: SilentPush.PADNSLookup.records.query
      description: The DNS record query name (e.g., silentpush.com).
      type: String
    - contextPath: SilentPush.PADNSLookup.records.ttl
      description: Time to live (TTL) value for the DNS record.
      type: Number
    - contextPath: SilentPush.PADNSLookup.records.type
      description: The type of the DNS record (e.g., NS).
      type: String
  - deprecated: false
    description: This command retrieve the reputation information for an IPv4.
    name: silentpush-get-asn-reputation
    arguments:
    - name: asn
      isArray: false
      description: The ASN to lookup.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Show the information used to calculate the reputation score.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: The maximum number of reputation history records to retrieve.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.ASNReputation.asn
      description: Autonomous System Number (ASN) associated with the reputation history.
      type: Number
    - contextPath: SilentPush.ASNReputation.asn_reputation
      description: Reputation score of the ASN at a given point in time.
      type: Number
    - contextPath: SilentPush.ASNReputation.asn_reputation_explain.ips_in_asn
      description: Total number of IPs within the ASN.
      type: Number
    - contextPath: SilentPush.ASNReputation.asn_reputation_explain.ips_num_active
      description: Number of actively used IPs in the ASN.
      type: Number
    - contextPath: SilentPush.ASNReputation.asn_reputation_explain.ips_num_listed
      description: Number of IPs in the ASN that are listed as malicious.
      type: Number
    - contextPath: SilentPush.ASNReputation.asname
      description: Name of the ASN provider or organization.
      type: String
    - contextPath: SilentPush.ASNReputation.date
      description: Date of the recorded reputation history in YYYYMMDD format.
      type: Number
  - deprecated: false
    description: This command retrieve the takedown reputation information for an Autonomous System Number (ASN).
    name: silentpush-get-asn-takedown-reputation
    arguments:
    - name: asn
      isArray: false
      description: The ASN to lookup.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Show the information used to calculate the reputation score.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: The maximum number of reputation history records to retrieve.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asname
      description: The name of the Autonomous System (AS).
      type: String
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn
      description: The Autonomous System Number (ASN).
      type: String
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.allocation_age
      description: The age of the ASN allocation in days.
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.allocation_date
      description: The date when the ASN was allocated (YYYYMMDD).
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation
      description: The takedown reputation score for the ASN.
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.ips_in_asn
      description: The total number of IP addresses associated with the ASN.
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.ips_num_listed
      description: The number of IP addresses within the ASN that are flagged or listed in security threat databases.
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.items_num_listed
      description: The total number of security-related listings associated with the ASN, including IP addresses and domains.
      type: Number
    - contextPath: SilentPush.ASNTakedownReputation.takedown_reputation.asn_takedown_reputation_explain.listings_max_age
      description: The maximum age (in hours) of the listings, indicating how recent the flagged IPs/domains are.
      type: Number
  - deprecated: false
    description: This command retrieves Autonomous System Numbers (ASNs) associated with a domain.
    name: silentpush-get-asns-for-domain
    arguments:
    - name: domain
      isArray: false
      description: Domain name to search ASNs for. Retrieves ASNs associated with a records for the specified domain and its subdomains in the last 30 days.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.DomainASNs.domain
      description: The domain name for which ASNs are retrieved.
      type: String
    - contextPath: SilentPush.DomainASNs.asns
      description: Dictionary of Autonomous System Numbers (ASNs) associated with the domain.
      type: Unknown
  - deprecated: false
    description: 'This command runs the threat check on the specified '
    name: silentpush-get-data-exports
    arguments:
    - name: feed_url
      isArray: false
      description: The URL from which to export the feed data.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.GetDataExports.EntryID
      description: The EntryID of the report file.
      type: Unknown
    - contextPath: SilentPush.GetDataExports.Extension
      description: The extension of the report file.
      type: String
    - contextPath: SilentPush.GetDataExports.Name
      description: The name of the report file.
      type: String
    - contextPath: SilentPush.GetDataExports.Info
      description: The info of the report file.
      type: String
    - contextPath: SilentPush.GetDataExports.Size
      description: The size of the report file.
      type: Number
    - contextPath: SilentPush.GetDataExports.Type
      description: The type of the report file.
      type: String
  - deprecated: false
    description: This command get certificate data collected from domain scanning.
    name: silentpush-get-domain-certificates
    arguments:
    - name: domain
      isArray: false
      description: The domain to query certificates for.
      required: true
      secret: false
      default: false
    - name: domain_regex
      isArray: false
      description: Regular expression to match domains.
      required: false
      secret: false
      default: false
    - name: certificate_issuer
      isArray: false
      description: Filter by certificate issuer.
      required: false
      secret: false
      default: false
    - name: date_min
      isArray: false
      description: Filter certificates issued on or after this date.
      required: false
      secret: false
      default: false
    - name: date_max
      isArray: false
      description: Filter certificates issued on or before this date.
      required: false
      secret: false
      default: false
    - name: prefer
      isArray: false
      description: Prefer to wait for results for longer running queries or to return job_id immediately (Defaults to Silent Push API behaviour).
      required: false
      secret: false
      default: false
    - name: max_wait
      isArray: false
      description: Number of seconds to wait for results before returning a job_id, with a range from 0 to 25 seconds.
      required: false
      secret: false
      default: false
    - name: with_metadata
      isArray: false
      description: Includes a metadata object in the response, containing returned results, total results, and job_id.
      required: false
      secret: false
      default: false
    - name: skip
      isArray: false
      description: Number of results to skip.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Number of results to return.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Certificate.domain
      description: Queried domain.
      type: String
    - contextPath: SilentPush.Certificate.metadata
      description: Metadata of the response.
      type: String
    - contextPath: SilentPush.Certificate.certificates.cert_index
      description: Index of the certificate.
      type: Number
    - contextPath: SilentPush.Certificate.certificates.chain
      description: Certificate chain.
      type: Unknown
    - contextPath: SilentPush.Certificate.certificates.date
      description: Certificate issue date.
      type: Number
    - contextPath: SilentPush.Certificate.certificates.domain
      description: Primary domain of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.domains
      description: List of domains covered by the certificate.
      type: Unknown
    - contextPath: SilentPush.Certificate.certificates.fingerprint
      description: SHA-1 fingerprint of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.fingerprint_md5
      description: MD5 fingerprint of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.fingerprint_sha1
      description: SHA-1 fingerprint of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.fingerprint_sha256
      description: SHA-256 fingerprint of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.host
      description: Host associated with the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.issuer
      description: Issuer of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.not_after
      description: Expiration date of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.not_before
      description: Start date of the certificate validity.
      type: String
    - contextPath: SilentPush.Certificate.certificates.serial_dec
      description: Decimal representation of the serial number.
      type: String
    - contextPath: SilentPush.Certificate.certificates.serial_hex
      description: Hexadecimal representation of the serial number.
      type: String
    - contextPath: SilentPush.Certificate.certificates.serial_number
      description: Serial number of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.source_name
      description: Source log name of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.source_url
      description: URL of the certificate log source.
      type: String
    - contextPath: SilentPush.Certificate.certificates.subject
      description: Subject details of the certificate.
      type: String
    - contextPath: SilentPush.Certificate.certificates.wildcard
      description: Indicates if the certificate is a wildcard certificate.
      type: Number
    - contextPath: SilentPush.Certificate.job_details.get
      description: URL to get the data of the job or its status.
      type: String
    - contextPath: SilentPush.Certificate.job_details.job_id
      description: ID of the job.
      type: String
    - contextPath: SilentPush.Certificate.job_details.status
      description: Status of the job.
      type: String
  - deprecated: false
    description: This command retrieves comprehensive enrichment information for a given resource (domain, IPv4, or IPv6).
    name: silentpush-get-enrichment-data
    arguments:
    - name: resource
      isArray: false
      description: Type of resource for which information needs to be retrieved {e.g. domain}.
      required: true
      secret: false
      default: false
    - name: value
      isArray: false
      description: Value corresponding to the selected "resource" for which information needs to be retrieved {e.g. silentpush.com}.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Include explanation of data calculations.
      required: false
      secret: false
      default: false
    - name: scan_data
      isArray: false
      description: Include scan data (IPv4 only).
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Enrichment.value
      description: Queried value.
      type: String
    - contextPath: SilentPush.Enrichment.domain_string_frequency_probability.avg_probability
      description: Average probability score of the domain string.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_string_frequency_probability.dga_probability_score
      description: Probability score indicating likelihood of being a DGA domain.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_string_frequency_probability.domain
      description: Domain name analyzed.
      type: String
    - contextPath: SilentPush.Enrichment.domain_string_frequency_probability.domain_string_freq_probabilities
      description: List of frequency probabilities for different domain string components.
      type: Unknown
    - contextPath: SilentPush.Enrichment.domain_string_frequency_probability.query
      description: Domain name queried.
      type: String
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.alexa_rank
      description: Alexa rank of the domain.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.alexa_top10k
      description: Indicates if the domain is in the Alexa top 10k.
      type: Boolean
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.alexa_top10k_score
      description: Score indicating domain's Alexa top 10k ranking.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.dynamic_domain_score
      description: Score indicating likelihood of domain being dynamically generated.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.is_dynamic_domain
      description: Indicates if the domain is dynamic.
      type: Boolean
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.is_url_shortener
      description: Indicates if the domain is a known URL shortener.
      type: Boolean
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.results
      description: Number of results found for the domain.
      type: Number
    - contextPath: SilentPush.Enrichment.domain_urls.results_summary.url_shortner_score
      description: Score of the shortned URL.
      type: Number
    - contextPath: SilentPush.Enrichment.domaininfo.domain
      description: Domain name analyzed.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.error
      description: Error message if no data is available for the domain.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.zone
      description: TLD zone of the domain.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.registrar
      description: registrar of the domain.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.whois_age
      description: The age of the domain based on WHOIS records.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.whois_created_date
      description: The created date on WHOIS records.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.query
      description: The domain name that was queried in the system.
      type: String
    - contextPath: SilentPush.Enrichment.domaininfo.last_seen
      description: The first recorded observation of the domain in the database.
      type: Number
    - contextPath: SilentPush.Enrichment.domaininfo.first_seen
      description: The last recorded observation of the domain in the database.
      type: Number
    - contextPath: SilentPush.Enrichment.domaininfo.is_new
      description: Indicates whether the domain is considered "new.".
      type: Boolean
    - contextPath: SilentPush.Enrichment.domaininfo.is_new_score
      description: A scoring metric indicating how "new" the domain is.
      type: Number
    - contextPath: SilentPush.Enrichment.domaininfo.age
      description: Represents the age of the domain in days.
      type: Number
    - contextPath: SilentPush.Enrichment.domaininfo.age_score
      description: A scoring metric indicating the trustworthiness of the domain based on its age.
      type: Number
    - contextPath: SilentPush.Enrichment.ip_diversity.asn_diversity
      description: Number of different ASNs associated with the domain.
      type: String
    - contextPath: SilentPush.Enrichment.ip_diversity.ip_diversity_all
      description: Total number of unique IPs observed for the domain.
      type: String
    - contextPath: SilentPush.Enrichment.ip_diversity.host
      description: The hostname being analyzed.
      type: String
    - contextPath: SilentPush.Enrichment.ip_diversity.ip_diversity_groups
      description: The number of distinct IP groups (e.g., IPs belonging to different ranges or providers).
      type: String
    - contextPath: SilentPush.Enrichment.ns_reputation.is_expired
      description: Indicates if the domain`s nameserver is expired.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ns_reputation.is_parked
      description: ' The domain is not parked (a parked domain is one without active content).'
      type: Boolean
    - contextPath: SilentPush.Enrichment.ns_reputation.is_sinkholed
      description: The domain is not sinkholed (not forcibly redirected to a security researcher`s trap).
      type: Boolean
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_reputation_max
      description: Maximum reputation score for nameservers.
      type: Number
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_reputation_score
      description: Reputation score of the domain`s nameservers.
      type: Number
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_srv_reputation.domain
      description: The nameservers of domain.
      type: String
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server
      description: Provided nameserver.
      type: String
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_domain_density
      description: Number of domains sharing this NS.
      type: Number
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_domains_listed
      description: Number of listed domains using this NS.
      type: Number
    - contextPath: SilentPush.Enrichment.ns_reputation.ns_srv_reputation.ns_server_reputation
      description: Reputation score for this NS.
      type: Number
    - contextPath: SilentPush.Enrichment.scan_data.certificates.domain
      description: Domain for which the SSL certificate was issued.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.domains
      description: Other Domains for which the SSL certificate was issued.
      type: Unknown
    - contextPath: SilentPush.Enrichment.scan_data.certificates.issuer_organization
      description: Issuer organization of the SSL certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.fingerprint_sha1
      description: A unique identifier for the certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.hostname
      description: The hostname associated with the certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.ip
      description: The IP address of the server using this certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.is_expired
      description: Indicates whether the certificate has expired.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.issuer_common_name
      description: he Common Name (CN) of the Certificate Authority (CA) that issued this certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.not_after
      description: Expiry date of the certificate.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.not_before
      description: Start date of the certificate validity.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.certificates.scan_date
      description: The date when this certificate data was last scanned.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.response
      description: HTTP response code for the domain scan.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.hostname
      description: The hostname that sent this response.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.ip
      description: The IP address responding to the request.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.scan_date
      description: The date when the headers were scanned.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.headers.cache-control
      description: HTTP cache-control.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.headers.content-length"
      description: Content lenght of the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.headers.date
      description: The date/time of the response.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.headers.expires
      description: Indicates an already expired response.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.headers.headers.server
      description: The web server handling the request (Cloudflare proxy).
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.hostname
      description: HTTP response code for the domain scan.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.html_body_murmur3
      description: hash of the page content.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.html_body_ssdeep
      description: SSDEEP hash (used for fuzzy matching similar HTML content).
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.html_title
      description: The page title (suggests a Cloudflare challenge page, likely due to bot protection).
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.ip
      description: The IP address responding to the request.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.html.scan_date
      description: The date when the headers were scanned.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.favicon2_md5
      description: MD5 hash of a secondary favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.favicon2_mmh3
      description: Murmur3 hash of a secondary favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.favicon2_path
      description: The file path of the secondary favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.favicon_md5
      description: MD5 hash of the primary favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.favicon_mmh3
      description: Murmur3 hash of the primary favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.hostname
      description: The hostname where this favicon was found.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.ip
      description: The IP address associated with the favicon.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.favicon.scan_date
      description: Date when this favicon was last scanned.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.jarm.hostname
      description: The hostname where this jarm was found.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.jarm.ip
      description: The IP address responding to the request.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.jarm.jarm_hash
      description: Unique identifier for the TLS configuration of the server.
      type: String
    - contextPath: SilentPush.Enrichment.scan_data.jarm.scan_date
      description: Date when this jarm was last scanned.
      type: String
    - contextPath: SilentPush.Enrichment.sp_risk_score
      description: Overall risk score for the domain.
      type: Number
    - contextPath: SilentPush.Enrichment.sp_risk_score_explain.sp_risk_score_decider
      description: Factor that determined the final risk score.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.asn
      description: Autonomous System Number (ASN) associated with the IP.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_allocation_age
      description: Age of ASN allocation in days.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_allocation_date
      description: Date of ASN allocation.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_rank
      description: Rank of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_rank_score
      description: Rank score of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_reputation
      description: Reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_in_asn
      description: Total number of IPs in the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_num_active
      description: Number of active IPs in the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_reputation_explain.ips_num_listed
      description: Number of listed IPs in the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_reputation_score
      description: Reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation
      description: Takedown reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.ips_in_asn
      description: Total number of IPs in the ASN with takedown reputation.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.ips_num_listed
      description: Number of listed IPs in the ASN with takedown reputation.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.items_num_listed
      description: Number of flagged items in the ASN with takedown reputation.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation_explain.listings_max_age
      description: Maximum age of listings for the ASN with takedown reputation.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asn_takedown_reputation_score
      description: Takedown reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.asname
      description: Name of the Autonomous System (AS).
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.benign_info.actor
      description: This field is usually used to indicate a known organization or individual associated with the IP.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.benign_info.known_benign
      description: Indicates whether this IP/ASN is explicitly known to be safe (e.g., a reputable cloud provider or public service).
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.benign_info.tags
      description: Contains descriptive tags if the IP/ASN has a known role (e.g., "Google Bot", "Cloudflare Proxy").
      type: Unknown
    - contextPath: SilentPush.Enrichment.ip2asn.date
      description: Date of the scan data (YYYYMMDD format).
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.density
      description: The density value associated with the IP.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.ip
      description: IP address associated with the ASN.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.ip_has_expired_certificate
      description: Indicates whether the IP has an expired SSL/TLS certificate.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_has_open_directory
      description: Indicates whether the IP hosts an open directory listing.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_is_dsl_dynamic
      description: the IP is from a dynamic DSL pool.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_is_dsl_dynamic_score
      description: A score indicating how likely this IP is dynamic.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.ip_is_ipfs_node
      description: the InterPlanetary File System (IPFS), a decentralized file storage system.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_is_tor_exit_node
      description: Tor exit node (used for anonymous internet browsing).
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_location.continent_code
      description: abbreviation for the continent where the IP is located.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.ip_location.continent_name
      description: The full name of the continent.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.ip_location.country_code
      description: The ISO 3166-1 alpha-2 country code representing the country.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.ip_location.country_is_in_european_union
      description: A Boolean value (true/false) indicating if the country is part of the European Union (EU).
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.ip_location.country_name
      description: The full name of the country where the IP is registered.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.ip_ptr
      description: The reverse DNS (PTR) record for the IP.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.listing_score
      description: Measures how frequently the IP appears in threat intelligence or blacklist databases.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.listing_score_explain
      description: A breakdown of why the listing score is assigned.
      type: Unknown
    - contextPath: SilentPush.Enrichment.ip2asn.malscore
      description: Malicious activity score for the IP.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.hostname
      description: Hostname associated with the SSL certificate.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.domain
      description: Domain for which the SSL certificate was issued.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.fingerprint_sha1
      description: SHA-1 fingerprint of the SSL certificate.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.issuer_common_name
      description: Common name of the certificate issuer.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.issuer_organization
      description: Organization that issued the SSL certificate.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.not_before
      description: Start date of SSL certificate validity.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.not_after
      description: Expiration date of SSL certificate validity.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.domains
      description: Other domains for which the SSL certificate was issued.
      type: Unknown
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.is_expired
      description: Is certificate expired.
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.certificates.scan_date
      description: Scan date of the certificate.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_md5
      description: MD5 hash of the second favicon.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_mmh3
      description: MurmurHash3 value of the second favicon.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon_md5
      description: MD5 hash of the favicon.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon_mmh3
      description: MurmurHash3 value of the favicon.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.favicon2_path
      description: Path to the second favicon file.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.favicon.scan_date
      description: Scan date of favicon file.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.response
      description: HTTP response code from the scan.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.scan_date
      description: The date and time when the scan was performed.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.headers.server
      description: Server header from the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.headers.content-type
      description: Content-Type header from the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.headers.content-length
      description: Content-Length header from the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.headers.cache-control
      description: Cache-control header from the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.headers.headers.date
      description: Date header from the HTTP response.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.html.html_title
      description: Title of the scanned HTML page.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.html.html_body_murmur3
      description: MurmurHash3 of the HTML body content.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.html.html_body_ssdeep
      description: SSDEEP fuzzy hash of the HTML body content.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.html.scan_date
      description: The date and time when the scan was performed.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.jarm.scan_date
      description: The date and time when the scan was performed.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.scan_data.jarm.jarm_hash
      description: JARM fingerprint hash for TLS analysis.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.sp_risk_score
      description: Security risk score for the IP.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.sp_risk_score_explain.sp_risk_score_decider
      description: Factor that determined the final risk score.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.subnet
      description: Subnet associated with the IP.
      type: String
    - contextPath: SilentPush.Enrichment.ip2asn.sinkhole_info.known_sinkhole_ip
      description: Indicates whether the IP is part of a sinkhole (a controlled system that captures malicious traffic).
      type: Boolean
    - contextPath: SilentPush.Enrichment.ip2asn.sinkhole_info.tags
      description: If the IP were a known sinkhole, this field would contain tags describing its purpose.
      type: Unknown
    - contextPath: SilentPush.Enrichment.ip2asn.subnet_allocation_age
      description: Represents the age (in days) since the subnet was allocated.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.subnet_allocation_date
      description: The date when the subnet was assigned to an organization or ISP.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.subnet_reputation
      description: A measure of how frequently IPs from this subnet appear in threat intelligence databases.
      type: Number
    - contextPath: SilentPush.Enrichment.ip2asn.subnet_reputation_explain
      description: A breakdown of why the subnet received its reputation score.
      type: Unknown
    - contextPath: SilentPush.Enrichment.ip2asn.subnet_reputation_score
      description: A numerical risk score (typically 0-100, with higher values indicating higher risk).
      type: Number
  - deprecated: false
    description: This command fetch indicators of potential future attacks using a feed UUID.
    name: silentpush-get-future-attack-indicators
    arguments:
    - name: feed_uuid
      isArray: false
      description: Unique ID for the feed.
      required: true
      secret: false
      default: false
    - name: page_no
      isArray: false
      description: The page number to fetch results from.
      required: false
      secret: false
      default: false
    - name: page_size
      isArray: false
      description: The number of indicators to fetch per page.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.FutureAttackIndicators.feed_uuid
      description: Unique identifier for the feed.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.page_no
      description: Current page number for pagination.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.page_size
      description: Number of items to be retrieved per page.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.total_ioc
      description: Total number of Indicators of Compromise (IOCs) associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.total
      description: Total occurrences of the indicator across all sources.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.total_source_score
      description: Cumulative score assigned to the indicator by all sources.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.name
      description: Name associated with the indicator, such as a domain name.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.total_custom
      description: Total number of custom indicators for the specific entry.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_name
      description: Name of the source providing the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.first_seen_on
      description: Date and time when the indicator was first observed.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.last_seen_on
      description: Date and time when the indicator was last observed.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.type
      description: Type of the indicator (e.g., domain, IP address, URL).
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.uuid
      description: Unique identifier assigned to the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ioc_template
      description: Template type describing the indicator (e.g., domain template).
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ioc_uuid
      description: Unique identifier for the IOC related to the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_vendor_name
      description: Name of the vendor providing the indicator source (e.g., Silent Push).
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_uuid
      description: Unique identifier for the source of the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.total_ioc
      description: Total count of Indicators of Compromise associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.collected_tags
      description: Tags associated with the indicator.
      type: Unknown
    - contextPath: SilentPush.FutureAttackIndicators.indicators.listing_score
      description: Score assigned by the source indicating the severity or importance of the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.sp_risk_score
      description: Risk score calculated by the source for the indicator, reflecting its potential threat level.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_is_tor_exit_node
      description: Indicates whether the IP address is a known TOR exit node.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_is_dsl_dynamic
      description: Indicates whether the IP address is a DSL dynamic IP.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_reputation_score
      description: Reputation score assigned to the IP address based on its history and activities.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.known_sinkhole_ip
      description: Indicates if the IP address is associated with a known sinkhole.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.known_benign
      description: Indicates whether the indicator is known to be benign or harmless.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_rank_score
      description: Score indicating the reputation rank of the ASN.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_reputation_score
      description: Reputation score assigned to the ASN based on its activities.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_is_dsl_dynamic_score
      description: Score indicating the likelihood of the IP being a DSL dynamic IP.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.subnet_reputation_score
      description: Reputation score assigned to a subnet based on its history and activities.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_takedown_reputation_score
      description: Reputation score of the ASN considering takedown activities or abuse reports.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn
      description: Autonomous System Number (ASN) associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.density
      description: Indicator density score based on traffic or other relevant factors.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_rank
      description: Rank of the ASN indicating its reputation or trustworthiness.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.malscore
      description: Maliciousness score assigned to the indicator based on threat analysis.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_reputation
      description: Reputation score associated with the ASN.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.subnet_reputation
      description: Reputation score associated with the subnet.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_allocation_age
      description: Age of the ASN allocation in days.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.subnet_allocation_age
      description: Age of the subnet allocation in days.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_takedown_reputation
      description: Reputation score of the ASN considering takedown reports or abuse.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ipv4
      description: IPv4 address associated with the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asname
      description: Autonomous System Name (ASName) associated with the ASN.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_ptr
      description: PTR (reverse DNS) record associated with the IP address.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.subnet
      description: Subnet associated with the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.country_code
      description: Country code associated with the indicator (e.g., US, CA).
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.continent_code
      description: Continent code associated with the indicator (e.g., NA, EU).
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.it_exists
      description: Indicates if the indicator currently exists in the dataset.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_new
      description: Indicates if the indicator is newly detected.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_alexa_top10k
      description: Indicates if the domain is part of the Alexa Top 10K list.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_dynamic_domain
      description: Indicates if the domain is classified as dynamic.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_url_shortener
      description: Indicates if the URL is associated with a URL shortener service.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_parked
      description: Indicates if the domain is a parked domain.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_expired
      description: Indicates if the domain registration has expired.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_sinkholed
      description: Indicates if the domain is associated with a sinkhole operation.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ns_entropy_score
      description: Entropy score of the nameserver, indicating randomness or irregularity.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.age_score
      description: Score indicating the age of the domain, with higher scores for older domains.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.is_new_score
      description: Score indicating the likelihood of the domain being newly registered.
      type: Boolean
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ns_avg_ttl_score
      description: Score representing the average TTL of the nameservers.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ns_reputation_max
      description: Maximum reputation score of the nameservers.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ns_reputation_score
      description: Overall reputation score of the nameservers.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.avg_probability_score
      description: Average probability score indicating the likelihood of malicious activity.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.alexa_top10k_score
      description: Score indicating the rank within the Alexa Top 10K list.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.url_shortener_score
      description: Score indicating the likelihood of the URL being a URL shortener.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.dynamic_domain_score
      description: Score indicating the likelihood of the domain being dynamic.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ns_entropy
      description: Entropy value of the nameserver, indicating randomness or irregularity.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.age
      description: Age of the domain in days.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.whois_age
      description: Age of the domain based on the WHOIS creation date.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.alexa_rank
      description: Alexa rank of the domain, indicating its popularity.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.asn_diversity
      description: Diversity score of the ASN, indicating the variety of ASNs associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_diversity_all
      description: Count of all unique IP addresses associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.ip_diversity_groups
      description: Count of unique IP address groups associated with the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.avg_probability
      description: Average probability indicating the likelihood of malicious activity.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.whois_created_date
      description: Creation date of the domain from WHOIS records.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.domain
      description: Domain name associated with the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.subdomain
      description: Subdomain associated with the indicator, if applicable.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.host
      description: Host associated with the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.nameservers_tags
      description: Tags related to the nameservers associated with the indicator.
      type: String
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_false_positive_ratio
      description: Ratio of false positives reported by the source.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_true_positive_ratio
      description: Ratio of true positives reported by the source.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_last_updated_score
      description: Score indicating the last update time of the source.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_frequency_score
      description: Score representing the frequency of updates from the source.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_accuracy_score
      description: Score indicating the accuracy of the source reporting.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_geographic_spread_score
      description: Score indicating the geographic spread of the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_custom_score
      description: Custom score provided by the source for the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_score
      description: Overall score assigned by the source to the indicator.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_frequency
      description: Frequency of the indicator appearance in the source data.
      type: Number
    - contextPath: SilentPush.FutureAttackIndicators.indicators.source_geographic_spread_explain
      description: Explanation of the geographic spread of the indicator as provided by the source.
      type: Unknown
  - deprecated: false
    description: This command retrieves the reputation information for an IPv4.
    name: silentpush-get-ipv4-reputation
    arguments:
    - name: ipv4
      isArray: false
      description: IPv4 address for which information needs to be retrieved.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Show the information used to calculate the reputation score.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: The maximum number of reputation history to retrieve.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.IPv4Reputation.date
      description: Date when the reputation information was retrieved.
      type: Number
    - contextPath: SilentPush.IPv4Reputation.ip
      description: IPv4 address for which the reputation is calculated.
      type: String
    - contextPath: SilentPush.IPv4Reputation.reputation_score
      description: Reputation score for the given IP address.
      type: Number
    - contextPath: SilentPush.IPv4Reputation.ip_reputation_explain.ip_density
      description: The number of domain names or services associated with this IP. A higher value may indicate shared hosting or potential abuse.
      type: Number
    - contextPath: SilentPush.IPv4Reputation.ip_reputation_explain.names_num_listed
      description: The number of domain names linked to this IP that are flagged or listed in security threat databases.
      type: Number
  - deprecated: false
    description: This command retrieve status of running job or results from completed job.
    name: silentpush-get-job-status
    arguments:
    - name: job_id
      isArray: false
      description: ID of the job returned by Silent Push actions.
      required: true
      secret: false
      default: false
    - name: max_wait
      isArray: false
      description: Number of seconds to wait for results (0-25 seconds).
      required: false
      secret: false
      default: false
    - name: status_only
      isArray: false
      description: Return job status, even if job is complete.
      required: false
      secret: false
      default: false
    - name: force_metadata_on
      isArray: false
      description: Always return query metadata, even if original request did not include metadata.
      required: false
      secret: false
      default: false
    - name: force_metadata_off
      isArray: false
      description: Never return query metadata, even if original request did include metadata.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.JobStatus.get
      description: URL to retrieve the job status.
      type: String
    - contextPath: SilentPush.JobStatus.job_id
      description: Unique identifier for the job.
      type: String
    - contextPath: SilentPush.JobStatus.status
      description: Current status of the job.
      type: String
  - deprecated: false
    description: This command retrieves historical reputation data for a specified nameserver,including reputation scores and optional detailed calculation information.
    name: silentpush-get-nameserver-reputation
    arguments:
    - name: nameserver
      isArray: false
      description: Nameserver name for which information needs to be retrieved.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Show the information used to calculate the reputation score.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: The maximum number of reputation history to retrieve.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.NameserverReputation.nameserver
      description: The nameserver associated with the reputation history entry.
      type: Number
    - contextPath: SilentPush.NameserverReputation.reputation_data.date
      description: Date of the reputation history entry (in YYYYMMDD format).
      type: Number
    - contextPath: SilentPush.NameserverReputation.reputation_data.ns_server
      description: Name of the nameserver associated with the reputation history entry.
      type: String
    - contextPath: SilentPush.NameserverReputation.reputation_data.ns_server_reputation
      description: Reputation score of the nameserver on the specified date.
      type: Number
    - contextPath: SilentPush.NameserverReputation.reputation_data.ns_server_reputation_explain.ns_server_domain_density
      description: Number of domains associated with the nameserver.
      type: Number
    - contextPath: SilentPush.NameserverReputation.reputation_data.ns_server_reputation_explain.ns_server_domains_listed
      description: Number of domains listed in reputation databases.
      type: Number
  - deprecated: false
    description: This command retrieves the reputation history for a specific subnet.
    name: silentpush-get-subnet-reputation
    arguments:
    - name: subnet
      isArray: false
      description: IPv4 subnet for which reputation information needs to be retrieved.
      required: true
      secret: false
      default: false
    - name: explain
      isArray: false
      description: Show the detailed information used to calculate the reputation score.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Maximum number of reputation history entries to retrieve.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.SubnetReputation.subnet
      description: The subnet associated with the reputation history.
      type: String
    - contextPath: SilentPush.SubnetReputation.reputation_history.date
      description: The date of the subnet reputation record.
      type: Number
    - contextPath: SilentPush.SubnetReputation.reputation_history.subnet
      description: The subnet associated with the reputation record.
      type: String
    - contextPath: SilentPush.SubnetReputation.reputation_history.subnet_reputation
      description: The reputation score of the subnet.
      type: Number
    - contextPath: SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_in_subnet
      description: Total number of IPs in the subnet.
      type: Number
    - contextPath: SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_num_active
      description: Number of active IPs in the subnet.
      type: Number
    - contextPath: SilentPush.SubnetReputation.reputation_history.subnet_reputation_explain.ips_num_listed
      description: Number of listed IPs in the subnet.
      type: Number
  - deprecated: false
    description: This command get domain information along with Silent Push risk score and live whois information for multiple domains.
    name: silentpush-list-domain-information
    arguments:
    - name: domains
      isArray: false
      description: Comma-separated list of domains to query.
      required: true
      secret: false
      default: false
    - name: fetch_risk_score
      isArray: false
      description: Whether to fetch risk scores for the domains.
      required: false
      secret: false
      default: false
    - name: fetch_whois_info
      isArray: false
      description: Whether to fetch WHOIS information for the domains.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Domain.domain
      description: The domain name queried.
      type: String
    - contextPath: SilentPush.Domain.last_seen
      description: The last seen date of the domain in YYYYMMDD format.
      type: Number
    - contextPath: SilentPush.Domain.query
      description: The domain name used for the query.
      type: String
    - contextPath: SilentPush.Domain.whois_age
      description: The age of the domain in days based on WHOIS creation date.
      type: Number
    - contextPath: SilentPush.Domain.first_seen
      description: The first seen date of the domain in YYYYMMDD format.
      type: Number
    - contextPath: SilentPush.Domain.is_new
      description: Indicates whether the domain is newly observed.
      type: Boolean
    - contextPath: SilentPush.Domain.zone
      description: The top-level domain (TLD) or zone of the queried domain.
      type: String
    - contextPath: SilentPush.Domain.registrar
      description: The registrar responsible for the domain registration.
      type: String
    - contextPath: SilentPush.Domain.age_score
      description: A risk score based on the domain's age.
      type: Number
    - contextPath: SilentPush.Domain.whois_created_date
      description: The WHOIS creation date of the domain in YYYY-MM-DD HH:MM:SS format.
      type: String
    - contextPath: SilentPush.Domain.is_new_score
      description: A risk score indicating how new the domain is.
      type: Number
    - contextPath: SilentPush.Domain.age
      description: The age of the domain in days.
      type: Number
  - deprecated: false
    description: This command get infratags for multiple domains with optional clustering.
    name: silentpush-list-domain-infratags
    arguments:
    - name: domains
      isArray: false
      description: Comma-separated list of domains.
      required: true
      secret: false
      default: false
    - name: cluster
      isArray: false
      description: Whether to cluster the results.
      required: false
      secret: false
      default: false
    - name: mode
      isArray: false
      description: Mode for lookup (live/padns). Defaults to "live".
      required: false
      secret: false
      default: false
      defaultValue: live
    - name: match
      isArray: false
      description: Handling of self-hosted infrastructure. Defaults to "self".
      required: false
      secret: false
      default: false
      defaultValue: self
    - name: as_of
      isArray: false
      description: 'Build infratags from padns data where the as_of timestamp equivalent is between the first_seen and the last_seen timestamp - automatically sets mode to padns. Example :- date: yyyy-mm-dd (2021-07-09) - fixed date, epoch: number (1625834953) - fixed time in epoch format, sec: negative number (-172800) - relative time <sec> seconds ago.'
      required: false
      secret: false
      default: false
      defaultValue: self
    outputs:
    - contextPath: SilentPush.InfraTags.infratags.domain
      description: The domain associated with the infratag.
      type: String
    - contextPath: SilentPush.InfraTags.infratags.mode
      description: The mode associated with the domain infratag.
      type: String
    - contextPath: SilentPush.InfraTags.infratags.tag
      description: The tag associated with the domain infratag.
      type: String
    - contextPath: SilentPush.InfraTags.tag_clusters.25.domains
      description: List of domains in the tag cluster with score 25.
      type: Unknown
    - contextPath: SilentPush.InfraTags.tag_clusters.25.match
      description: The match string associated with the domains in the tag cluster with score 25.
      type: String
    - contextPath: SilentPush.InfraTags.tag_clusters.50.domains
      description: List of domains in the tag cluster with score 50.
      type: Unknown
    - contextPath: SilentPush.InfraTags.tag_clusters.50.match
      description: The match string associated with the domains in the tag cluster with score 50.
      type: String
    - contextPath: SilentPush.InfraTags.tag_clusters.75.domains
      description: List of domains in the tag cluster with score 75.
      type: Unknown
    - contextPath: SilentPush.InfraTags.tag_clusters.75.match
      description: The match string associated with the domains in the tag cluster with score 75.
      type: String
    - contextPath: SilentPush.InfraTags.tag_clusters.100.domains
      description: List of domains in the tag cluster with score 100.
      type: Unknown
    - contextPath: SilentPush.InfraTags.tag_clusters.100.match
      description: The match string associated with the domains in the tag cluster with score 100.
      type: String
  - deprecated: false
    description: This command get IP information for multiple IPv4s and IPv6s.
    name: silentpush-list-ip-information
    arguments:
    - name: ips
      isArray: false
      description: Comma-separated list of IP addresses.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.IPInformation.ip_is_dsl_dynamic
      description: Indicates if the IP is a DSL dynamic IP.
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_has_expired_certificate
      description: Indicates if the IP has an expired certificate.
      type: Boolean
    - contextPath: SilentPush.IPInformation.subnet_allocation_age
      description: Age of the subnet allocation.
      type: String
    - contextPath: SilentPush.IPInformation.asn_rank_score
      description: Rank score of the ASN.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_allocation_age
      description: Age of the ASN allocation in days.
      type: Number
    - contextPath: SilentPush.IPInformation.sp_risk_score
      description: Risk score of the service provider (SP).
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.ips_active
      description: Number of active IPs in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.ips_in_asn
      description: Total number of IPs in the ASN.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.ips_num_listed
      description: Number of IPs listed in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.items_num_listed
      description: Number of items listed in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_avg
      description: Average lifetime of items in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_max
      description: Maximum lifetime of items in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_explain.lifetime_total
      description: Total lifetime of items in the ASN takedown reputation.
      type: Number
    - contextPath: SilentPush.IPInformation.ip_reputation_score
      description: Reputation score of the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.listing_score_feeds_explain
      description: Explanation of the listing score feeds.
      type: String
    - contextPath: SilentPush.IPInformation.ip
      description: The IP address being evaluated.
      type: String
    - contextPath: SilentPush.IPInformation.density
      description: Density score of the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.benign_info.actor
      description: Actor associated with the benign info.
      type: String
    - contextPath: SilentPush.IPInformation.benign_info.known_benign
      description: Indicates if the IP is known benign.
      type: Boolean
    - contextPath: SilentPush.IPInformation.benign_info.tags
      description: Tags associated with the benign info.
      type: String
    - contextPath: SilentPush.IPInformation.ip_reputation_explain
      description: Explanation of the IP reputation.
      type: String
    - contextPath: SilentPush.IPInformation.asn_allocation_date
      description: The ASN allocation date.
      type: Number
    - contextPath: SilentPush.IPInformation.subnet_allocation_date
      description: The subnet allocation date.
      type: String
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation
      description: Reputation score of ASN takedown.
      type: Number
    - contextPath: SilentPush.IPInformation.ip_location.continent_code
      description: Continent code of the IP location.
      type: String
    - contextPath: SilentPush.IPInformation.ip_location.continent_name
      description: Continent name of the IP location.
      type: String
    - contextPath: SilentPush.IPInformation.ip_location.country_code
      description: Country code of the IP location.
      type: String
    - contextPath: SilentPush.IPInformation.ip_location.country_is_in_european_union
      description: Indicates if the country is in the European Union.
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_location.country_name
      description: Country name of the IP location.
      type: String
    - contextPath: SilentPush.IPInformation.date
      description: Date associated with the IP data.
      type: Number
    - contextPath: SilentPush.IPInformation.subnet_reputation_score
      description: Reputation score of the subnet.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_rank
      description: Rank of the ASN.
      type: Number
    - contextPath: SilentPush.IPInformation.listing_score_explain
      description: Explanation of the listing score.
      type: String
    - contextPath: SilentPush.IPInformation.asn_reputation_score
      description: Reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.IPInformation.ip_is_ipfs_node
      description: Indicates if the IP is an IPFS node.
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_reputation
      description: Reputation score of the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.subnet_reputation_explain
      description: Explanation of the subnet reputation.
      type: String
    - contextPath: SilentPush.IPInformation.ip_is_dsl_dynamic_score
      description: Score indicating if the IP is a DSL dynamic IP.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_reputation_explain
      description: Explanation of the ASN reputation.
      type: String
    - contextPath: SilentPush.IPInformation.ip_has_open_directory
      description: Indicates if the IP has an open directory.
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_ptr
      description: Pointer (PTR) record for the IP.
      type: String
    - contextPath: SilentPush.IPInformation.listing_score
      description: Listing score of the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.malscore
      description: Malware score associated with the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.sinkhole_info.known_sinkhole_ip
      description: Indicates if the IP is a known sinkhole IP.
      type: Boolean
    - contextPath: SilentPush.IPInformation.sinkhole_info.tags
      description: Tags associated with the sinkhole information.
      type: String
    - contextPath: SilentPush.IPInformation.subnet_reputation
      description: Reputation score of the subnet.
      type: Number
    - contextPath: SilentPush.IPInformation.asn_reputation
      description: Reputation score of the ASN.
      type: Number
    - contextPath: SilentPush.IPInformation.asn
      description: Autonomous System Number (ASN) of the IP.
      type: Number
    - contextPath: SilentPush.IPInformation.sp_risk_score_explain.sp_risk_score_decider
      description: Decider for the service provider risk score.
      type: String
    - contextPath: SilentPush.IPInformation.asname
      description: Name of the ASN.
      type: String
    - contextPath: SilentPush.IPInformation.subnet
      description: The subnet the IP belongs to.
      type: String
    - contextPath: SilentPush.IPInformation.ip_is_tor_exit_node
      description: Indicates if the IP is a TOR exit node.
      type: Boolean
    - contextPath: SilentPush.IPInformation.asn_takedown_reputation_score
      description: Reputation score of ASN takedown.
      type: Number
    - contextPath: SilentPush.IPInformation.ip_flags.is_proxy
      description: Indicates if the IP is a proxy (True/False).
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_flags.is_sinkhole
      description: Indicates if the IP is a sinkhole (True/False).
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_flags.is_vpn
      description: Indicates if the IP is a VPN (True/False).
      type: Boolean
    - contextPath: SilentPush.IPInformation.ip_flags.proxy_tags
      description: List of proxy-related tags or null if not a proxy.
      type: Unknown
    - contextPath: SilentPush.IPInformation.ip_flags.vpn_tags
      description: List of VPN-related tags or null if not a VPN.
      type: Unknown
  - deprecated: false
    description: This command scan a URL to retrieve hosting metadata.
    name: silentpush-live-url-scan
    arguments:
    - name: url
      isArray: false
      description: URL to scan.
      required: true
      secret: false
      default: false
    - name: platform
      isArray: false
      description: Platform to scan the URL on.
      required: false
      secret: false
      default: false
    - name: os
      isArray: false
      description: Operating system to scan the URL on.
      required: false
      secret: false
      default: false
    - name: browser
      isArray: false
      description: Browser to scan the URL on.
      required: false
      secret: false
      default: false
    - name: region
      isArray: false
      description: Region to scan the URL in.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.URLScan.HHV
      description: Unique identifier for HHV.
      type: String
    - contextPath: SilentPush.URLScan.adtech.ads_txt
      description: Indicates if ads_txt is present.
      type: Boolean
    - contextPath: SilentPush.URLScan.adtech.app_ads_txt
      description: Indicates if app_ads_txt is present.
      type: Boolean
    - contextPath: SilentPush.URLScan.adtech.sellers_json
      description: Indicates if sellers_json is present.
      type: Boolean
    - contextPath: SilentPush.URLScan.datahash
      description: Hash value of the data.
      type: String
    - contextPath: SilentPush.URLScan.domain
      description: The domain name.
      type: String
    - contextPath: SilentPush.URLScan.favicon2_avg
      description: Hash value for favicon2 average.
      type: String
    - contextPath: SilentPush.URLScan.favicon2_md5
      description: MD5 hash for favicon2.
      type: String
    - contextPath: SilentPush.URLScan.favicon2_murmur3
      description: Murmur3 hash for favicon2.
      type: Number
    - contextPath: SilentPush.URLScan.favicon2_path
      description: Path to favicon2 image.
      type: String
    - contextPath: SilentPush.URLScan.favicon_avg
      description: Hash value for favicon average.
      type: String
    - contextPath: SilentPush.URLScan.favicon_md5
      description: MD5 hash for favicon.
      type: String
    - contextPath: SilentPush.URLScan.favicon_murmur3
      description: Murmur3 hash for favicon.
      type: String
    - contextPath: SilentPush.URLScan.favicon_path
      description: Path to favicon image.
      type: String
    - contextPath: SilentPush.URLScan.favicon_urls
      description: List of favicon URLs.
      type: Unknown
    - contextPath: SilentPush.URLScan.header.cache-control
      description: Cache control header value.
      type: String
    - contextPath: SilentPush.URLScan.header.content-encoding
      description: Content encoding header value.
      type: String
    - contextPath: SilentPush.URLScan.header.content-type
      description: Content type header value.
      type: String
    - contextPath: SilentPush.URLScan.header.server
      description: Server header value.
      type: String
    - contextPath: SilentPush.URLScan.header.x-powered-by
      description: X-Powered-By header value.
      type: String
    - contextPath: SilentPush.URLScan.hostname
      description: The hostname of the server.
      type: String
    - contextPath: SilentPush.URLScan.html_body_length
      description: Length of the HTML body.
      type: Number
    - contextPath: SilentPush.URLScan.html_body_murmur3
      description: Murmur3 hash for the HTML body.
      type: Number
    - contextPath: SilentPush.URLScan.html_body_sha256
      description: SHA256 hash for the HTML body.
      type: String
    - contextPath: SilentPush.URLScan.html_body_similarity
      description: Similarity score of the HTML body.
      type: Number
    - contextPath: SilentPush.URLScan.html_body_ssdeep
      description: ssdeep hash for the HTML body.
      type: String
    - contextPath: SilentPush.URLScan.htmltitle
      description: The HTML title of the page.
      type: String
    - contextPath: SilentPush.URLScan.ip
      description: IP address associated with the domain.
      type: String
    - contextPath: SilentPush.URLScan.jarm
      description: JARM (TLS fingerprint) value.
      type: String
    - contextPath: SilentPush.URLScan.mobile_enabled
      description: Indicates if the mobile version is enabled.
      type: Boolean
    - contextPath: SilentPush.URLScan.opendirectory
      description: Indicates if open directory is enabled.
      type: Boolean
    - contextPath: SilentPush.URLScan.origin_domain
      description: Origin domain of the server.
      type: String
    - contextPath: SilentPush.URLScan.origin_hostname
      description: Origin hostname of the server.
      type: String
    - contextPath: SilentPush.URLScan.origin_ip
      description: Origin IP address of the server.
      type: String
    - contextPath: SilentPush.URLScan.origin_jarm
      description: JARM (TLS fingerprint) value for the origin.
      type: String
    - contextPath: SilentPush.URLScan.origin_path
      description: Origin path for the URL.
      type: String
    - contextPath: SilentPush.URLScan.origin_port
      description: Port used for the origin server.
      type: Number
    - contextPath: SilentPush.URLScan.origin_ssl.CHV
      description: SSL Certificate Chain Value (CHV).
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.SHA1
      description: SHA1 hash of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.SHA256
      description: SHA256 hash of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.authority_key_id
      description: Authority Key Identifier for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.expired
      description: Indicates if the SSL certificate is expired.
      type: Boolean
    - contextPath: SilentPush.URLScan.origin_ssl.issuer.common_name
      description: Issuer common name for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.issuer.country
      description: Issuer country for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.issuer.organization
      description: Issuer organization for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.not_after
      description: Expiration date of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.not_before
      description: Start date of the SSL certificate validity.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.sans
      description: List of Subject Alternative Names (SANs) for the SSL certificate.
      type: Unknown
    - contextPath: SilentPush.URLScan.origin_ssl.sans_count
      description: Count of SANs for the SSL certificate.
      type: Number
    - contextPath: SilentPush.URLScan.origin_ssl.serial_number
      description: Serial number of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.sigalg
      description: Signature algorithm used for the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.subject.common_name
      description: Subject common name for the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.subject_key_id
      description: Subject Key Identifier for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.origin_ssl.valid
      description: Indicates if the SSL certificate is valid.
      type: Boolean
    - contextPath: SilentPush.URLScan.origin_ssl.wildcard
      description: Indicates if the SSL certificate is a wildcard.
      type: Boolean
    - contextPath: SilentPush.URLScan.origin_subdomain
      description: Subdomain of the origin.
      type: String
    - contextPath: SilentPush.URLScan.origin_tld
      description: Top-level domain of the origin.
      type: String
    - contextPath: SilentPush.URLScan.origin_url
      description: Complete URL of the origin.
      type: String
    - contextPath: SilentPush.URLScan.path
      description: Path for the URL.
      type: String
    - contextPath: SilentPush.URLScan.port
      description: Port for the URL.
      type: Number
    - contextPath: SilentPush.URLScan.proxy_enabled
      description: Indicates if the proxy is enabled.
      type: Boolean
    - contextPath: SilentPush.URLScan.redirect
      description: Indicates if a redirect occurs.
      type: Boolean
    - contextPath: SilentPush.URLScan.redirect_count
      description: Count of redirects.
      type: Number
    - contextPath: SilentPush.URLScan.redirect_list
      description: List of redirect URLs.
      type: Unknown
    - contextPath: SilentPush.URLScan.resolves_to
      description: List of IPs the domain resolves to.
      type: Unknown
    - contextPath: SilentPush.URLScan.response
      description: HTTP response code.
      type: Number
    - contextPath: SilentPush.URLScan.scheme
      description: URL scheme (e.g., https).
      type: String
    - contextPath: SilentPush.URLScan.screenshot
      description: URL for the domain screenshot.
      type: String
    - contextPath: SilentPush.URLScan.ssl.CHV
      description: SSL Certificate Chain Value (CHV).
      type: String
    - contextPath: SilentPush.URLScan.ssl.SHA1
      description: SHA1 hash of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.SHA256
      description: SHA256 hash of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.authority_key_id
      description: Authority Key Identifier for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.expired
      description: Indicates if the SSL certificate is expired.
      type: Boolean
    - contextPath: SilentPush.URLScan.ssl.issuer.common_name
      description: Issuer common name for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.issuer.country
      description: Issuer country for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.issuer.organization
      description: Issuer organization for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.not_after
      description: Expiration date of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.not_before
      description: Start date of the SSL certificate validity.
      type: String
    - contextPath: SilentPush.URLScan.ssl.sans
      description: List of Subject Alternative Names (SANs) for the SSL certificate.
      type: Unknown
    - contextPath: SilentPush.URLScan.ssl.sans_count
      description: Count of SANs for the SSL certificate.
      type: Number
    - contextPath: SilentPush.URLScan.ssl.serial_number
      description: Serial number of the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.sigalg
      description: Signature algorithm used for the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.subject.common_name
      description: Subject common name for the SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.subject_key_id
      description: Subject Key Identifier for SSL certificate.
      type: String
    - contextPath: SilentPush.URLScan.ssl.valid
      description: Indicates if the SSL certificate is valid.
      type: Boolean
    - contextPath: SilentPush.URLScan.ssl.wildcard
      description: Indicates if the SSL certificate is a wildcard.
      type: Boolean
    - contextPath: SilentPush.URLScan.body_analysis.SHV
      description: Unique identifier for body analysis.
      type: String
    - contextPath: SilentPush.URLScan.body_analysis.body_sha256
      description: SHA-256 hash of the body content.
      type: String
    - contextPath: SilentPush.URLScan.body_analysis.google-GA4
      description: List of Google GA4 tracking IDs.
      type: Unknown
    - contextPath: SilentPush.URLScan.body_analysis.google-UA
      description: List of Google Universal Analytics tracking IDs.
      type: Unknown
    - contextPath: SilentPush.URLScan.body_analysis.google-adstag
      description: List of Google Adstag tracking IDs.
      type: Unknown
    - contextPath: SilentPush.URLScan.body_analysis.js_sha256
      description: List of SHA-256 hashes of JavaScript files.
      type: Unknown
    - contextPath: SilentPush.URLScan.body_analysis.js_ssdeep
      description: List of ssdeep fuzzy hashes of JavaScript files.
      type: Unknown
  - deprecated: false
    description: This command retrieve reverse Passive DNS data for specific DNS record types.
    name: silentpush-reverse-padns-lookup
    arguments:
    - name: qtype
      isArray: false
      description: Type of DNS record.
      required: true
      secret: false
      default: false
    - name: qname
      isArray: false
      description: The DNS record name to lookup.
      required: true
      secret: false
      default: false
    - name: netmask
      isArray: false
      description: The netmask for the lookup.
      required: false
      secret: false
      default: false
    - name: subdomains
      isArray: false
      description: Whether to include subdomains in the lookup.
      required: false
      secret: false
      default: false
    - name: regex
      isArray: false
      description: Regular expression to filter the DNS records.
      required: false
      secret: false
      default: false
    - name: first_seen_after
      isArray: false
      description: Filter for records first seen after a specific date/time.
      required: false
      secret: false
      default: false
    - name: first_seen_before
      isArray: false
      description: Filter for records first seen before a specific date/time.
      required: false
      secret: false
      default: false
    - name: last_seen_after
      isArray: false
      description: Filter for records last seen after a specific date/time.
      required: false
      secret: false
      default: false
    - name: last_seen_before
      isArray: false
      description: Filter for records last seen before a specific date/time.
      required: false
      secret: false
      default: false
    - name: as_of
      isArray: false
      description: Specify a date/time for the PADNS lookup.
      required: false
      secret: false
      default: false
    - name: sort
      isArray: false
      description: Sort the results by specified criteria.
      required: false
      secret: false
      default: false
    - name: output_format
      isArray: false
      description: Format for the output (e.g., JSON, XML).
      required: false
      secret: false
      default: false
    - name: prefer
      isArray: false
      description: Preference for certain record types during the lookup.
      required: false
      secret: false
      default: false
    - name: with_metadata
      isArray: false
      description: Include metadata in the results.
      required: false
      secret: false
      default: false
    - name: max_wait
      isArray: false
      description: Maximum wait time in seconds for the lookup results.
      required: false
      secret: false
      default: false
    - name: skip
      isArray: false
      description: Number of results to skip in pagination.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Limit the number of results returned.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.ReversePADNSLookup.qname
      description: The DNS record name looked up.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.qtype
      description: The type of the DNS record.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.answer
      description: The answer for the DNS query.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.count
      description: The number of occurrences of the DNS record.
      type: Number
    - contextPath: SilentPush.ReversePADNSLookup.records.first_seen
      description: Timestamp of when the record was first seen.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.last_seen
      description: Timestamp of the most recent occurrence of the record.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.nshash
      description: The hash of the NS record.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.query
      description: The DNS query associated with the record.
      type: String
    - contextPath: SilentPush.ReversePADNSLookup.records.ttl
      description: Time-to-live (TTL) of the DNS record.
      type: Number
    - contextPath: SilentPush.ReversePADNSLookup.records.type
      description: The type of DNS record (e.g., NS).
      type: String
  - deprecated: false
    description: 'This command runs the threat check on the specified '
    name: silentpush-run-threat-check
    arguments:
    - name: data
      isArray: false
      description: The name of the data source to query.
      required: true
      secret: false
      default: false
    - name: query
      isArray: false
      description: The value to check for threats (e.g., IP or domain).
      required: true
      secret: false
      default: false
    - name: type
      isArray: false
      description: The type of the value being queried (e.g., ip, domain).
      required: true
      secret: false
      default: false
    - name: user_identifier
      isArray: false
      description: A unique identifier for the user making the request.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.RunThreatCheck.is_listed
      description: Indicates whether the queried value is listed as a threat.
      type: Boolean
    - contextPath: SilentPush.RunThreatCheck.listed_txt
      description: Textual description of the listing status.
      type: String
    - contextPath: SilentPush.RunThreatCheck.query
      description: The original value that was checked.
      type: String
  - deprecated: false
    description: This commandGenerate screenshot of a URL.
    name: silentpush-screenshot-url
    arguments:
    - name: url
      isArray: false
      description: URL for the screenshot.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Screenshot.file_id
      description: Unique identifier for the generated screenshot file.
      type: String
    - contextPath: SilentPush.Screenshot.file_name
      description: Name of the screenshot file.
      type: String
    - contextPath: SilentPush.Screenshot.screenshot_url
      description: URL to access the generated screenshot.
      type: String
    - contextPath: SilentPush.Screenshot.status
      description: Status of the screenshot generation process.
      type: String
    - contextPath: SilentPush.Screenshot.status_code
      description: HTTP status code of the response.
      type: Number
    - contextPath: SilentPush.Screenshot.url
      description: The URL that was used to generate the screenshot.
      type: String
  - deprecated: false
    description: This command search for domains with optional filters.
    name: silentpush-search-domains
    arguments:
    - name: domain
      isArray: false
      description: Name or wildcard pattern of domain names to search for.
      required: false
      secret: false
      default: false
    - name: domain_regex
      isArray: false
      description: A valid RE2 regex pattern to match domains. Overrides the domain argument.
      required: false
      secret: false
      default: false
    - name: name_server
      isArray: false
      description: Name server name or wildcard pattern of the name server used by domains.
      required: false
      secret: false
      default: false
    - name: asnum
      isArray: false
      description: Autonomous System (AS) number to filter domains.
      required: false
      secret: false
      default: false
    - name: asname
      isArray: false
      description: Search for all AS numbers where the AS Name begins with the specified value.
      required: false
      secret: false
      default: false
    - name: min_ip_diversity
      isArray: false
      description: Minimum IP diversity limit to filter domains.
      required: false
      secret: false
      default: false
    - name: registrar
      isArray: false
      description: Name or partial name of the registrar used to register domains.
      required: false
      secret: false
      default: false
    - name: min_asn_diversity
      isArray: false
      description: Minimum ASN diversity limit to filter domains.
      required: false
      secret: false
      default: false
    - name: certificate_issuer
      isArray: false
      description: Filter domains that had SSL certificates issued by the specified certificate issuer. Wildcards supported.
      required: false
      secret: false
      default: false
    - name: whois_date_after
      isArray: false
      description: Filter domains with a WHOIS creation date after this date (YYYY-MM-DD).
      required: false
      secret: false
      default: false
    - name: skip
      isArray: false
      description: Number of results to skip in the search query.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Number of results to return. Defaults to the SilentPush API's behavior.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.Domain.asn_diversity
      description: The diversity of Autonomous System Numbers (ASNs) associated with the domain.
      type: Number
    - contextPath: SilentPush.Domain.host
      description: The domain name (host) associated with the record.
      type: String
    - contextPath: SilentPush.Domain.ip_diversity_all
      description: The total number of unique IPs associated with the domain.
      type: Number
    - contextPath: SilentPush.Domain.ip_diversity_groups
      description: The number of unique IP groups associated with the domain.
      type: Number
  - deprecated: false
    description: This command search Silent Push scan data repositories using SPQL queries.
    name: silentpush-search-scan-data
    arguments:
    - name: query
      isArray: false
      description: SPQL query string.
      required: true
      secret: false
      default: false
    - name: fields
      isArray: false
      description: Fields to return in the response.
      required: false
      secret: false
      default: false
    - name: sort
      isArray: false
      description: Sorting criteria for results.
      required: false
      secret: false
      default: false
    - name: skip
      isArray: false
      description: Number of records to skip in the response.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: Maximum number of results to return.
      required: false
      secret: false
      default: false
    - name: with_metadata
      isArray: false
      description: Whether to include metadata in the response.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: SilentPush.ScanData.HHV
      description: Unique identifier for the scan data entry.
      type: String
    - contextPath: SilentPush.ScanData.adtech
      description: Adtech information for the scan data entry.
      type: Unknown
    - contextPath: SilentPush.ScanData.adtech.ads_txt
      description: Indicates if ads.txt is used.
      type: Boolean
    - contextPath: SilentPush.ScanData.adtech.app_ads_txt
      description: Indicates if app_ads.txt is used.
      type: Boolean
    - contextPath: SilentPush.ScanData.adtech.sellers_json
      description: Indicates if sellers.json is used.
      type: Boolean
    - contextPath: SilentPush.ScanData.body_analysis
      description: Body analysis for the scan data entry.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.body_sha256
      description: SHA256 hash of the body.
      type: String
    - contextPath: SilentPush.ScanData.body_analysis.language
      description: Languages detected in the body.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.ICP_license
      description: ICP License information.
      type: String
    - contextPath: SilentPush.ScanData.body_analysis.SHV
      description: Server Hash Verification value.
      type: String
    - contextPath: SilentPush.ScanData.body_analysis.adsense
      description: List of AdSense data.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.footer_sha256
      description: SHA-256 hash of the footer content.
      type: String
    - contextPath: SilentPush.ScanData.body_analysis.google-GA4
      description: List of Google GA4 identifiers.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.google-UA
      description: List of Google Universal Analytics identifiers.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.google-adstag
      description: List of Google adstag identifiers.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.header_sha256
      description: SHA-256 hash of the header content.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.js_sha256
      description: List of JavaScript files with SHA-256 hash values.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.js_ssdeep
      description: List of JavaScript files with SSDEEP hash values.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.onion
      description: List of Onion URLs detected.
      type: Unknown
    - contextPath: SilentPush.ScanData.body_analysis.telegram
      description: List of Telegram-related information.
      type: Unknown
    - contextPath: SilentPush.ScanData.datahash
      description: Hash of the data.
      type: String
    - contextPath: SilentPush.ScanData.datasource
      description: Source of the scan data.
      type: String
    - contextPath: SilentPush.ScanData.domain
      description: Domain associated with the scan data.
      type: String
    - contextPath: SilentPush.ScanData.geoip
      description: GeoIP information related to the scan.
      type: Unknown
    - contextPath: SilentPush.ScanData.geoip.city_name
      description: City where the scan data was retrieved.
      type: String
    - contextPath: SilentPush.ScanData.geoip.country_name
      description: Country name from GeoIP information.
      type: String
    - contextPath: SilentPush.ScanData.geoip.location
      description: Geo-location coordinates.
      type: Unknown
    - contextPath: SilentPush.ScanData.geoip.location.lat
      description: Latitude from GeoIP location.
      type: Number
    - contextPath: SilentPush.ScanData.geoip.location.lon
      description: Longitude from GeoIP location.
      type: Number
    - contextPath: SilentPush.ScanData.header
      description: HTTP header information for the scan.
      type: Unknown
    - contextPath: SilentPush.ScanData.header.content-length
      description: Content length from HTTP response header.
      type: String
    - contextPath: SilentPush.ScanData.header.location
      description: Location from HTTP response header.
      type: String
    - contextPath: SilentPush.ScanData.header.connection
      description: Connection type used, e.g., keep-alive.
      type: String
    - contextPath: SilentPush.ScanData.header.server
      description: Server software used to serve the content, e.g., openresty.
      type: String
    - contextPath: SilentPush.ScanData.hostname
      description: Hostname associated with the scan data.
      type: String
    - contextPath: SilentPush.ScanData.html_body_sha256
      description: SHA256 hash of the HTML body.
      type: String
    - contextPath: SilentPush.ScanData.htmltitle
      description: Title of the HTML page scanned.
      type: String
    - contextPath: SilentPush.ScanData.ip
      description: IP address associated with the scan.
      type: String
    - contextPath: SilentPush.ScanData.jarm
      description: JARM hash value.
      type: String
    - contextPath: SilentPush.ScanData.mobile_enabled
      description: Indicates if the page is mobile-enabled.
      type: Boolean
    - contextPath: SilentPush.ScanData.origin_domain
      description: Origin domain associated with the scan.
      type: String
    - contextPath: SilentPush.ScanData.origin_geoip
      description: GeoIP information of the origin domain.
      type: Unknown
    - contextPath: SilentPush.ScanData.origin_geoip.city_name
      description: City of the origin domain from GeoIP information.
      type: String
    - contextPath: SilentPush.ScanData.origin_hostname
      description: Origin hostname associated with the scan data.
      type: String
    - contextPath: SilentPush.ScanData.origin_ip
      description: Origin IP address of the scan.
      type: String
    - contextPath: SilentPush.ScanData.origin_jarm
      description: JARM hash value of the origin domain.
      type: String
    - contextPath: SilentPush.ScanData.origin_ssl
      description: SSL certificate information for the origin domain.
      type: Unknown
    - contextPath: SilentPush.ScanData.origin_ssl.SHA256
      description: SHA256 of the SSL certificate.
      type: String
    - contextPath: SilentPush.ScanData.origin_ssl.subject
      description: Subject of the SSL certificate.
      type: Unknown
    - contextPath: SilentPush.ScanData.origin_ssl.subject.common_name
      description: Common name in the SSL certificate.
      type: String
    - contextPath: SilentPush.ScanData.port
      description: Port used during the scan.
      type: Number
    - contextPath: SilentPush.ScanData.redirect
      description: Indicates if a redirect occurred during the scan.
      type: Boolean
    - contextPath: SilentPush.ScanData.redirect_count
      description: Count of redirects encountered.
      type: Number
    - contextPath: SilentPush.ScanData.redirect_list
      description: List of redirect URLs encountered during the scan.
      type: Unknown
    - contextPath: SilentPush.ScanData.response
      description: HTTP response code received during the scan.
      type: Number
    - contextPath: SilentPush.ScanData.scan_date
      description: Timestamp of the scan date.
      type: String
    - contextPath: SilentPush.ScanData.scheme
      description: URL scheme used in the scan.
      type: String
    - contextPath: SilentPush.ScanData.ssl
      description: SSL certificate details for the scan.
      type: Unknown
    - contextPath: SilentPush.ScanData.ssl.SHA256
      description: SHA256 of the SSL certificate.
      type: String
    - contextPath: SilentPush.ScanData.ssl.subject
      description: Subject of the SSL certificate.
      type: Unknown
    - contextPath: SilentPush.ScanData.ssl.subject.common_name
      description: Common name in the SSL certificate.
      type: String
    - contextPath: SilentPush.ScanData.subdomain
      description: Subdomain associated with the scan data.
      type: String
    - contextPath: SilentPush.ScanData.tld
      description: Top-level domain (TLD) of the scanned URL.
      type: String
    - contextPath: SilentPush.ScanData.url
      description: The URL scanned.
      type: String
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  isfetch: false
  runonce: false
  longRunning: false
  longRunningPort: false
fromversion: 6.10.0
sectionorder:
  - Connect
  - Collect
  - Optimize
tests:
- No tests