Sixgill_Darkfeed_Enrichment

Sixgill Darkfeed Enrichment – powered by the broadest automated collection from the deep and dark web – is the most comprehensive IOC enrichment solution on the market. By enriching Palo Alto Networks Cortex XSOAR IOCs with Darkfeed, customers gain unparalleled context and essential explanations in order to accelerate their incident prevention and response and stay ahead of the threat curve. Automatically enrich Cortex XSOAR IOCs (machine to machine) via Darkfeed. Block threats and enrich endpoint protection in real-time from the Cortex XSOAR dashboard, gain contextual and actionable insights with essential explanations of Cortex XSOAR IOCs.

Data Enrichment & Threat Intelligence · Sixgill Darkfeed - Annual Subscription

Details

IDSixgill_Darkfeed_Enrichment
ProviderBitsight
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/sixgill:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Leverage the power of Sixgill to supercharge Cortex XSOAR with real-time Threat Intelligence indicators. Enrich IOCs such as domains, URLs, hashes, and IP addresses straight from XSOAR platform.
This integration was integrated and tested with sixgill-clients

Configure Sixgill_Darkfeed_Enrichment in Cortex

Parameter Description Required
client_id Sixgill API client ID True
client_secret Sixgill API client secret True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Returns information and a reputation for each IP in the input list.

Base Command

ip

Input

Argument Name Description Required
ip A comma-separated list of IPs to check. Required
skip The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The score of the indicator.
DBotScore.Type String Indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
SixgillDarkfeed.IP.created Date The timestamp when the indicator was created.
SixgillDarkfeed.IP.id String The unique ID of the indicator.
SixgillDarkfeed.IP.description String The description of the indicator.
SixgillDarkfeed.IP.lang String The language of the original post in the Sixgill portal.
SixgillDarkfeed.IP.modified Date The timestamp when the indicator was last modified.
SixgillDarkfeed.IP.pattern String The indicator IP address.
SixgillDarkfeed.IP.sixgill_actor String The actor of the original post on the dark web.
SixgillDarkfeed.IP.sixgill_confidence Number The indicator confidence score.
SixgillDarkfeed.IP.sixgill_feedid String The indicator subfeed ID.
SixgillDarkfeed.IP.sixgill_feedname String The indicator subfeed name.
SixgillDarkfeed.IP.sixgill_postid String The ID of the post in the Sixgill portal.
SixgillDarkfeed.IP.sixgill_posttitle String The title of the post in the Sixgill portal.
SixgillDarkfeed.IP.sixgill_severity Number The indicator severity score.
SixgillDarkfeed.IP.sixgill_source String The source of the post in the Sixgill portal.
SixgillDarkfeed.IP.spec_version String The STIX specification version.
SixgillDarkfeed.IP.type String The STIX object type.
SixgillDarkfeed.IP.valid_from Date The creation date of the post in the Sixgill portal.
SixgillDarkfeed.IP.labels Unknown The indicative labels of the indicator.
SixgillDarkfeed.IP.external_reference Unknown Link to the IOC on VirusTotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
IP.Address String The indicator IP address.

Command Example


#### Human Readable Output

### domain

***
Returns information and a reputation for each domain name in the input list.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

#### Base Command

`domain`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| domain | A comma-separated list of domain names to check. | Required |
| skip | The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The score of the indicator. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| SixgillDarkfeed.Domain.created | Date | The timestamp when the indicator was created. |
| SixgillDarkfeed.Domain.id | String | The unique ID of the indicator. |
| SixgillDarkfeed.Domain.description | String | The description of the indicator. |
| SixgillDarkfeed.Domain.lang | String | The language of the original post in the Sixgill portal. |
| SixgillDarkfeed.Domain.modified | Date | The timestamp when the indicator was last modified. |
| SixgillDarkfeed.Domain.pattern | String | The indicator domain name. |
| SixgillDarkfeed.Domain.sixgill_actor | String | The actor of the original post on the dark web. |
| SixgillDarkfeed.Domain.sixgill_confidence | Number | The indicator confidence score. |
| SixgillDarkfeed.Domain.sixgill_feedid | String | The indicator subfeed ID. |
| SixgillDarkfeed.Domain.sixgill_feedname | String | The indicator subfeed name. |
| SixgillDarkfeed.Domain.sixgill_postid | String | The ID of the post in the Sixgill portal. |
| SixgillDarkfeed.Domain.sixgill_posttitle | String | The title of the post in the Sixgill portal. |
| SixgillDarkfeed.Domain.sixgill_severity | Number | The indicator severity score. |
| SixgillDarkfeed.Domain.sixgill_source | String | The source of the post in the Sixgill portal. |
| SixgillDarkfeed.Domain.spec_version | String | The STIX specification version. |
| SixgillDarkfeed.Domain.type | String | The STIX object type. |
| SixgillDarkfeed.Domain.valid_from | Date | The creation date of the post in the Sixgill portal. |
| SixgillDarkfeed.Domain.labels | Unknown | The indicative labels of the indicator. |
| SixgillDarkfeed.Domain.external_reference | Unknown | Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques. |
| Domain.Name | String | The indicator domain name. |

#### Command Example

Human Readable Output

url

Returns information and a reputation for each URL in the input list.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url A comma-separated list of URLs to check. Required
skip The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The score of the indicator.
DBotScore.Type String Indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
SixgillDarkfeed.URL.created Date The timestamp when the indicator was created.
SixgillDarkfeed.URL.id String The unique ID of the indicator.
SixgillDarkfeed.URL.description String The description of the indicator.
SixgillDarkfeed.URL.lang String The language of the original post in the Sixgill portal.
SixgillDarkfeed.URL.modified Date The timestamp when the indicator was last modified.
SixgillDarkfeed.URL.pattern String The indicator URL.
SixgillDarkfeed.URL.sixgill_actor String The actor of the original post on the dark web.
SixgillDarkfeed.URL.sixgill_confidence Number The indicator confidence score.
SixgillDarkfeed.URL.sixgill_feedid String The indicator subfeed ID.
SixgillDarkfeed.URL.sixgill_feedname String The indicator subfeed name.
SixgillDarkfeed.URL.sixgill_postid String The ID of the post in the Sixgill portal.
SixgillDarkfeed.URL.sixgill_posttitle String The title of the post in the Sixgill portal.
SixgillDarkfeed.URL.sixgill_severity Number The indicator severity score.
SixgillDarkfeed.URL.sixgill_source String The source of the post in the Sixgill portal.
SixgillDarkfeed.URL.spec_version String The STIX specification version.
SixgillDarkfeed.URL.type String The STIX object type.
SixgillDarkfeed.URL.valid_from Date The creation date of the post in the Sixgill portal.
SixgillDarkfeed.URL.labels Unknown The indicative labels of the indicator.
URL.Data string The indicator URL.
SixgillDarkfeed.URL.external_reference Unknown Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.

Command Example


#### Human Readable Output

### file

***
Returns information and a reputation for each file hash in the input list.

#### Base Command

`file`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| file | A comma-separated list of file hashes to check. | Required |
| skip | The number of outputs per indicator to be skipped when returning the result set. Default is 0. Default is 0. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The score of the indicator. |
| DBotScore.Type | String | Indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| SixgillDarkfeed.File.created | Date | The timestamp when the indicator was created. |
| SixgillDarkfeed.File.id | String | The unique ID of the indicator. |
| SixgillDarkfeed.File.description | String | The description of the indicator. |
| SixgillDarkfeed.File.lang | String | The language of the original post in the Sixgill portal. |
| SixgillDarkfeed.File.modified | Date | The timestamp when the indicator was last modified. |
| SixgillDarkfeed.File.pattern | String | The indicator file hash \(hashes include MD5, SHA-1 and SHA-256 when possible\). |
| SixgillDarkfeed.File.sixgill_actor | String | The actor of the original post on the dark web. |
| SixgillDarkfeed.File.sixgill_confidence | Number | The indicator confidence score. |
| SixgillDarkfeed.File.sixgill_feedid | String | The indicator subfeed ID. |
| SixgillDarkfeed.File.sixgill_feedname | String | The indicator subfeed name. |
| SixgillDarkfeed.File.sixgill_postid | String | The ID of the post in the Sixgill portal. |
| SixgillDarkfeed.File.sixgill_posttitle | String | The title of the post in the Sixgill portal. |
| SixgillDarkfeed.File.sixgill_severity | Number | The indicator severity score. |
| SixgillDarkfeed.File.sixgill_source | String | The source of the post in the Sixgill portal. |
| SixgillDarkfeed.File.spec_version | String | The STIX specification version. |
| SixgillDarkfeed.File.type | String | The STIX object type. |
| SixgillDarkfeed.File.valid_from | Date | The creation date of the post in the Sixgill portal. |
| SixgillDarkfeed.File.labels | Unknown | The indicative labels of the indicator. |
| SixgillDarkfeed.File.external_reference | Unknown | Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques. |
| File.SHA256 | string | The SHA256 file hash. |
| File.SHA512 | string | The SHA512 file hash. |
| File.SHA1 | string | The SHA1 file hash. |
| File.MD5 | string | The MD5 file hash. |

#### Command Example

Human Readable Output

sixgill-get-actor

Returns information and a reputation for each actor in the input list.

Base Command

sixgill-get-actor

Input

Argument Name Description Required
actor A comma-separated list of actors to check. Required
skip The number of outputs per actor to be skipped when returning the result set. Default is 0. Default is 0. Optional

Context Output

Path Type Description
SixgillDarkfeed.Actor.created Date The timestamp when the actor shared their first IOC.
SixgillDarkfeed.Actor.id String The unique ID of the actor.
SixgillDarkfeed.Actor.description String The description of the actor.
SixgillDarkfeed.Actor.lang String The language of the original post in the Sixgill portal.
SixgillDarkfeed.Actor.modified Date The timestamp when the actor was last modified.
SixgillDarkfeed.Actor.pattern String A list of the IOCs shared by the actor.
SixgillDarkfeed.Actor.sixgill_actor String The actor of the original post on the dark web.
SixgillDarkfeed.Actor.sixgill_confidence Number The confidence score of the actor.
SixgillDarkfeed.Actor.sixgill_feedid String The Subfeed ID of the actor.
SixgillDarkfeed.Actor.sixgill_feedname String The Subfeed name of the actor.
SixgillDarkfeed.Actor.sixgill_postid String The ID of the post in the Sixgill portal.
SixgillDarkfeed.Actor.sixgill_posttitle String The title of the post in the Sixgill portal.
SixgillDarkfeed.Actor.sixgill_severity Number The severity score of the actor.
SixgillDarkfeed.Actor.sixgill_source String The source of the post in the Sixgill portal.
SixgillDarkfeed.Actor.spec_version String The STIX specification version.
SixgillDarkfeed.Actor.type String The STIX object type.
SixgillDarkfeed.Actor.valid_from Date The creation date of the post in the Sixgill portal.
SixgillDarkfeed.Actor.labels Unknown The indicative labels of the actor.
SixgillDarkfeed.Actor.external_reference Unknown Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.

Command Example


#### Human Readable Output

### sixgill-get-post-id

***
Returns information and a reputation for each post ID in the input list.

#### Base Command

`sixgill-get-post-id`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| post_id | A comma-separated list of post IDs to check. | Required |
| skip | The number of outputs per post ID to be skipped when returning the result set. Default is 0. Default is 0. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SixgillDarkfeed.Postid.created | Date | The timestamp when an IOC was first included in the post. |
| SixgillDarkfeed.Postid.id | String | The unique ID of the post. |
| SixgillDarkfeed.Postid.description | String | The description of the post ID. |
| SixgillDarkfeed.Postid.lang | String | The language of the original post in the Sixgill portal. |
| SixgillDarkfeed.Postid.modified | Date | The timestamp when the post ID information was last modified. |
| SixgillDarkfeed.Postid.pattern | String | A list of the IOCs included in the post. |
| SixgillDarkfeed.Postid.sixgill_actor | String | The actor of the original post on the dark web. |
| SixgillDarkfeed.Postid.sixgill_confidence | Number | The confidence score of the post ID. |
| SixgillDarkfeed.Postid.sixgill_feedid | String | The Subfeed ID of the post ID. |
| SixgillDarkfeed.Postid.sixgill_feedname | String | The Subfeed name of the post ID. |
| SixgillDarkfeed.Postid.sixgill_postid | String | The ID of the post in the Sixgill portal. |
| SixgillDarkfeed.Postid.sixgill_posttitle | String | The title of the post in the Sixgill portal. |
| SixgillDarkfeed.Postid.sixgill_severity | Number | The severity score of the post ID. |
| SixgillDarkfeed.Postid.sixgill_source | String | The source of the post in the Sixgill portal. |
| SixgillDarkfeed.Postid.spec_version | String | The STIX specification version. |
| SixgillDarkfeed.Postid.type | String | The STIX object type. |
| SixgillDarkfeed.Postid.valid_from | Date | The creation date of the post in the Sixgill portal. |
| SixgillDarkfeed.Postid.labels | Unknown | The indicative labels of the post ID. |
| SixgillDarkfeed.Postid.external_reference | Unknown | Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques. |

#### Command Example

Human Readable Output

Configuration parameters

  • client_id — Sixgill API client ID (required)
  • client_secret — Sixgill API client secret (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (6)

  • domain

    Returns information and a reputation for each domain name in the input list.

  • file

    Returns information and a reputation for each file hash in the input list.

  • ip

    Returns information and a reputation for each IP in the input list.

  • sixgill-get-actor

    Returns information and a reputation for each actor in the input list.

  • sixgill-get-post-id

    Returns information and a reputation for each post ID in the input list.

  • url

    Returns information and a reputation for each URL in the input list.

Source

Sixgill_Darkfeed_Enrichment.py Sixgill_Darkfeed_Enrichment_test.py Sixgill_Darkfeed_Enrichment.yml Sixgill_Darkfeed_Enrichment_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Bitsight
sectionorder:
- Connect
- Collect
commonfields:
  id: Sixgill_Darkfeed_Enrichment
  version: -1
configuration:
- display: Sixgill API client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- display: Sixgill API client secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Collect
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  section: Collect
  advanced: true
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  section: Collect
  advanced: true
  required: false
description: Sixgill Darkfeed Enrichment – powered by the broadest automated collection from the deep and dark web – is the most comprehensive IOC enrichment solution on the market. By enriching Palo Alto Networks Cortex XSOAR IOCs with Darkfeed, customers gain unparalleled context and essential explanations in order to accelerate their incident prevention and response and stay ahead of the threat curve. Automatically enrich Cortex XSOAR IOCs (machine to machine) via Darkfeed. Block threats and enrich endpoint protection in real-time from the Cortex XSOAR dashboard, gain contextual and actionable insights with essential explanations of Cortex XSOAR IOCs.
display: Sixgill DarkFeed Enrichment
name: Sixgill_Darkfeed_Enrichment
script:
  commands:
  - arguments:
    - default: true
      description: A comma-separated list of IPs to check.
      isArray: true
      name: ip
      required: true
    - defaultValue: '0'
      description: The number of outputs per indicator to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each IP in the input list.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: SixgillDarkfeed.IP.created
      description: The timestamp when the indicator was created.
      type: Date
    - contextPath: SixgillDarkfeed.IP.id
      description: The unique ID of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.IP.description
      description: The description of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.IP.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.IP.modified
      description: The timestamp when the indicator was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.IP.pattern
      description: The indicator IP address.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_confidence
      description: The indicator confidence score.
      type: Number
    - contextPath: SixgillDarkfeed.IP.sixgill_feedid
      description: The indicator subfeed ID.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_feedname
      description: The indicator subfeed name.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.IP.sixgill_severity
      description: The indicator severity score.
      type: Number
    - contextPath: SixgillDarkfeed.IP.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.IP.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.IP.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.IP.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.IP.labels
      description: The indicative labels of the indicator.
      type: Unknown
    - contextPath: SixgillDarkfeed.IP.external_reference
      description: Link to the IOC on VirusTotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
    - contextPath: IP.Address
      description: The indicator IP address.
      type: String
  - arguments:
    - default: true
      description: A comma-separated list of domain names to check.
      isArray: true
      name: domain
      required: true
    - defaultValue: '0'
      description: The number of outputs per indicator to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each domain name in the input list.
    name: domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: SixgillDarkfeed.Domain.created
      description: The timestamp when the indicator was created.
      type: Date
    - contextPath: SixgillDarkfeed.Domain.id
      description: The unique ID of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.Domain.description
      description: The description of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.Domain.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Domain.modified
      description: The timestamp when the indicator was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.Domain.pattern
      description: The indicator domain name.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_confidence
      description: The indicator confidence score.
      type: Number
    - contextPath: SixgillDarkfeed.Domain.sixgill_feedid
      description: The indicator subfeed ID.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_feedname
      description: The indicator subfeed name.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Domain.sixgill_severity
      description: The indicator severity score.
      type: Number
    - contextPath: SixgillDarkfeed.Domain.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Domain.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.Domain.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.Domain.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.Domain.labels
      description: The indicative labels of the indicator.
      type: Unknown
    - contextPath: SixgillDarkfeed.Domain.external_reference
      description: Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
    - contextPath: Domain.Name
      description: The indicator domain name.
      type: String
  - arguments:
    - default: true
      description: A comma-separated list of URLs to check.
      isArray: true
      name: url
      required: true
    - defaultValue: '0'
      description: The number of outputs per indicator to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each URL in the input list.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: SixgillDarkfeed.URL.created
      description: The timestamp when the indicator was created.
      type: Date
    - contextPath: SixgillDarkfeed.URL.id
      description: The unique ID of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.URL.description
      description: The description of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.URL.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.URL.modified
      description: The timestamp when the indicator was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.URL.pattern
      description: The indicator URL.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_confidence
      description: The indicator confidence score.
      type: Number
    - contextPath: SixgillDarkfeed.URL.sixgill_feedid
      description: The indicator subfeed ID.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_feedname
      description: The indicator subfeed name.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.URL.sixgill_severity
      description: The indicator severity score.
      type: Number
    - contextPath: SixgillDarkfeed.URL.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.URL.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.URL.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.URL.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.URL.labels
      description: The indicative labels of the indicator.
      type: Unknown
    - contextPath: URL.Data
      description: The indicator URL.
      type: string
    - contextPath: SixgillDarkfeed.URL.external_reference
      description: Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
  - arguments:
    - default: true
      description: A comma-separated list of file hashes to check.
      isArray: true
      name: file
      required: true
    - defaultValue: '0'
      description: The number of outputs per indicator to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each file hash in the input list.
    name: file
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: SixgillDarkfeed.File.created
      description: The timestamp when the indicator was created.
      type: Date
    - contextPath: SixgillDarkfeed.File.id
      description: The unique ID of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.File.description
      description: The description of the indicator.
      type: String
    - contextPath: SixgillDarkfeed.File.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.File.modified
      description: The timestamp when the indicator was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.File.pattern
      description: The indicator file hash (hashes include MD5, SHA-1 and SHA-256 when possible).
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_confidence
      description: The indicator confidence score.
      type: Number
    - contextPath: SixgillDarkfeed.File.sixgill_feedid
      description: The indicator subfeed ID.
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_feedname
      description: The indicator subfeed name.
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.File.sixgill_severity
      description: The indicator severity score.
      type: Number
    - contextPath: SixgillDarkfeed.File.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.File.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.File.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.File.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.File.labels
      description: The indicative labels of the indicator.
      type: Unknown
    - contextPath: SixgillDarkfeed.File.external_reference
      description: Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
    - contextPath: File.SHA256
      description: The SHA256 file hash.
      type: string
    - contextPath: File.SHA512
      description: The SHA512 file hash.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 file hash.
      type: string
    - contextPath: File.MD5
      description: The MD5 file hash.
      type: string
  - arguments:
    - default: true
      description: A comma-separated list of actors to check.
      isArray: true
      name: actor
      required: true
    - defaultValue: '0'
      description: The number of outputs per actor to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each actor in the input list.
    name: sixgill-get-actor
    outputs:
    - contextPath: SixgillDarkfeed.Actor.created
      description: The timestamp when the actor shared their first IOC.
      type: Date
    - contextPath: SixgillDarkfeed.Actor.id
      description: The unique ID of the actor.
      type: String
    - contextPath: SixgillDarkfeed.Actor.description
      description: The description of the actor.
      type: String
    - contextPath: SixgillDarkfeed.Actor.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Actor.modified
      description: The timestamp when the actor was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.Actor.pattern
      description: A list of the IOCs shared by the actor.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_confidence
      description: The confidence score of the actor.
      type: Number
    - contextPath: SixgillDarkfeed.Actor.sixgill_feedid
      description: The Subfeed ID of the actor.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_feedname
      description: The Subfeed name of the actor.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Actor.sixgill_severity
      description: The severity score of the actor.
      type: Number
    - contextPath: SixgillDarkfeed.Actor.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Actor.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.Actor.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.Actor.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.Actor.labels
      description: The indicative labels of the actor.
      type: Unknown
    - contextPath: SixgillDarkfeed.Actor.external_reference
      description: Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
  - arguments:
    - default: true
      description: A comma-separated list of post IDs to check.
      isArray: true
      name: post_id
      required: true
    - defaultValue: '0'
      description: The number of outputs per post ID to be skipped when returning the result set. Default is 0.
      name: skip
    description: Returns information and a reputation for each post ID in the input list.
    name: sixgill-get-post-id
    outputs:
    - contextPath: SixgillDarkfeed.Postid.created
      description: The timestamp when an IOC was first included in the post.
      type: Date
    - contextPath: SixgillDarkfeed.Postid.id
      description: The unique ID of the post.
      type: String
    - contextPath: SixgillDarkfeed.Postid.description
      description: The description of the post ID.
      type: String
    - contextPath: SixgillDarkfeed.Postid.lang
      description: The language of the original post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Postid.modified
      description: The timestamp when the post ID information was last modified.
      type: Date
    - contextPath: SixgillDarkfeed.Postid.pattern
      description: A list of the IOCs included in the post.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_actor
      description: The actor of the original post on the dark web.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_confidence
      description: The confidence score of the post ID.
      type: Number
    - contextPath: SixgillDarkfeed.Postid.sixgill_feedid
      description: The Subfeed ID of the post ID.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_feedname
      description: The Subfeed name of the post ID.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_postid
      description: The ID of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_posttitle
      description: The title of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Postid.sixgill_severity
      description: The severity score of the post ID.
      type: Number
    - contextPath: SixgillDarkfeed.Postid.sixgill_source
      description: The source of the post in the Sixgill portal.
      type: String
    - contextPath: SixgillDarkfeed.Postid.spec_version
      description: The STIX specification version.
      type: String
    - contextPath: SixgillDarkfeed.Postid.type
      description: The STIX object type.
      type: String
    - contextPath: SixgillDarkfeed.Postid.valid_from
      description: The creation date of the post in the Sixgill portal.
      type: Date
    - contextPath: SixgillDarkfeed.Postid.labels
      description: The indicative labels of the post ID.
      type: Unknown
    - contextPath: SixgillDarkfeed.Postid.external_reference
      description: Link to the IOC on Virustotal and an abstraction of the number of detections; MITRE ATT&CK tactics and techniques.
      type: Unknown
  dockerimage: demisto/sixgill:1.0.0.10120494
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- No tests (auto formatted)