SlashNext Phishing Incident Response Deprecated

SlashNext Phishing Incident Response integration allows Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services.

Data Enrichment & Threat Intelligence · SlashNext Phishing Incident Response - Annual Subscription (Direct Subscription) (Deprecated)

Details

IDSlashNext Phishing Incident Response
ProviderVaronis
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README


SlashNext Phishing Incident Response integration enables Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER™ threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services.

This integration was integrated and tested with version v1.1 of SlashNext Phishing Incident Response APIs.

SlashNext Phishing Incident Response Playbook

SlashNext have developed two sample playbooks to demonstrate two of the major use cases.

  • SlashNext - Host Reputation Default v1
  • SlashNext - URL Scan Default v1

Use Cases

  • Abuse inbox management
  • Playbooks that mine and analyze network logs

Detailed Description

SlashNext Phishing Incident Response integration uses an API key to authenticate with SlashNext Cloud. If you don’t have a valid API key, contact the SlashNext team support@slashnext.com

Fetch Incidents

Any phishing incidents/events that contain supsicious URLs, domains, or IP addresses through the use of an Abuse Inbox or by manual reporting.

Configure SlashNext Phishing Incident Response on Cortex XSOAR

  1. Navigate to Settings > Integrations  > Servers & Services.
  2. Search for SlashNext Phishing Incident Response using the search box on the top of the page.
  3. Click Add instance to create and configure a new integration instance.
    • Name: A textual name for the integration instance.
    • SlashNext API Base URL: Use the default value unless specifically provided by SlashNext.
    • SlashNext API Key: If you don’t have a valid API key, please reach us at support@slashnext.com
  4. Click Test to validate the new instance.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. ip
  2. domain
  3. url
  4. slashnext-host-reputation
  5. slashnext-host-report
  6. slashnext-host-urls
  7. slashnext-url-reputation
  8. slashnext-url-scan
  9. slashnext-url-scan-sync
  10. slashnext-scan-report
  11. slashnext-download-screenshot
  12. slashnext-download-html
  13. slashnext-download-text
  14. slashnext-api-quota

1. ip

Lookup an IP address indicator in SlashNext Threat Intelligence database.

Base Command

ip

Input
Argument Name Description Required
ip IPv4 address which to be looked up in SlashNext Threat Intelligence database. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
IP.Address string IP address
IP.Malicious.Vendor string For malicious IP addresses, the vendor that made the decision
IP.Malicious.Description string For malicious IP addresses, the reason that the vendor made the decision
SlashNext.IP.Value string Value of the Indicator of Compromise (IoC)
SlashNext.IP.Type string Type of the Indicator of Compromise (IoC)
SlashNext.IP.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.IP.ThreatStatus string Threat status of the IoC
SlashNext.IP.ThreatName string Name of the threat posed by the IoC
SlashNext.IP.ThreatType string Type of the threat posed by the IoC
SlashNext.IP.FirstSeen date Time when the IoC was first observed
SlashNext.IP.LastSeen date Time when the IoC was last observed

 

Command Example

!ip ip=8.8.8.8

Context Example
{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 1,
        "Type": "ip",
        "Vendor": "SlashNext Phishing Incident Response"
    },
    "IP": {
        "Address": "8.8.8.8"
    },
    "SlashNext.IP": {
        "FirstSeen": "09-26-2019 07:46:25 UTC",
        "LastSeen": "09-26-2019 07:46:36 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "IP",
        "Value": "8.8.8.8",
        "Verdict": "Benign"
    }
}
Human Readable Output

SlashNext Phishing Incident Response - IP Lookup

ip = 8.8.8.8
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
8.8.8.8 IP Benign N/A N/A N/A 09-26-2019 07:46:25 UTC 09-26-2019 07:46:36 UTC

2. domain

Lookup a FQDN indicator in SlashNext Threat Intelligence database.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input
Argument Name Description Required
domain FQDN which to be looked up in SlashNext Threat Intelligence database. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
Domain.Name string Domain name
Domain.Malicious.Vendor string For malicious domain names, the vendor that made the decision
Domain.Malicious.Description string For malicious domain names, the reason that the vendor made the decision
SlashNext.Domain.Value string Value of the Indicator of Compromise (IoC)
SlashNext.Domain.Type string Type of the Indicator of Compromise (IoC)
SlashNext.Domain.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.Domain.ThreatStatus string Threat status of the IoC
SlashNext.Domain.ThreatName string Name of the threat posed by the IoC
SlashNext.Domain.ThreatType string Type of the threat posed by the IoC
SlashNext.Domain.FirstSeen date Time when the IoC was first observed
SlashNext.Domain.LastSeen date Time when the IoC was last observed

 

Command Example

!domain domain=www.google.com

Context Example
{
    "DBotScore": {
        "Indicator": "www.google.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "SlashNext Phishing Incident Response"
    },
    "Domain": {
        "Name": "www.google.com"
    },
    "SlashNext.Domain": {
        "FirstSeen": "12-10-2018 13:04:17 UTC",
        "LastSeen": "10-10-2019 11:26:43 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Domain",
        "Value": "www.google.com",
        "Verdict": "Benign"
    }
}
Human Readable Output

SlashNext Phishing Incident Response - Domain Lookup

domain = www.google.com
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
www.google.com Domain Benign N/A N/A N/A 12-10-2018 13:04:17 UTC 10-10-2019 11:26:43 UTC

3. url

Queries the SlashNext Cloud database and retrieves the reputation of a url.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input
Argument Name Description Required
url The url to look up in the SlashNext Threat Intelligence database. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!url url=www.google.com

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "Final": {
            "Type": "Final URL",
            "Value": "https://www.google.com/?gws_rd=ssl",
            "Verdict": "Benign"
        },
        "FirstSeen": "08-26-2019 17:29:38 UTC",
        "LastSeen": "08-26-2019 19:41:19 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - URL Lookup

url = http://www.google.com/
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/ Scanned URL Benign N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign

4. slashnext-host-reputation

Search in SlashNext Cloud database and retrieve reputation of a host.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

slashnext-host-reputation

Input
Argument Name Description Required
host host can either be a domain name or an IPv4 address. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
IP.Address string IP address
IP.Malicious.Vendor string For malicious IP addresses, the vendor that made the decision
IP.Malicious.Description string For malicious IP addresses, the reason that the vendor made the decision
SlashNext.IP.Value string Value of the Indicator of Compromise (IoC)
SlashNext.IP.Type string Type of the Indicator of Compromise (IoC)
SlashNext.IP.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.IP.ThreatStatus string Threat status of the IoC
SlashNext.IP.ThreatName string Name of the threat posed by the IoC
SlashNext.IP.ThreatType string Type of the threat posed by the IoC
SlashNext.IP.FirstSeen date Time when the IoC was first observed
SlashNext.IP.LastSeen date Time when the IoC was last observed
Domain.Name string Domain name
Domain.Malicious.Vendor string For malicious domain names, the vendor that made the decision
Domain.Malicious.Description string For malicious domain names, the reason that the vendor made the decision
SlashNext.Domain.Value string Value of the Indicator of Compromise (IoC)
SlashNext.Domain.Type string Type of the Indicator of Compromise (IoC)
SlashNext.Domain.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.Domain.ThreatStatus string Threat status of the IoC
SlashNext.Domain.ThreatName string Name of the threat posed by the IoC
SlashNext.Domain.ThreatType string Type of the threat posed by the IoC
SlashNext.Domain.FirstSeen date Time when the IoC was first observed
SlashNext.Domain.LastSeen date Time when the IoC was last observed

 

Command Example

!slashnext-host-reputation host=www.google.com

Context Example
{
    "DBotScore": {
        "Indicator": "www.google.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "SlashNext Phishing Incident Response"
    },
    "Domain": {
        "Name": "www.google.com"
    },
    "SlashNext.Domain": {
        "FirstSeen": "12-10-2018 13:04:17 UTC",
        "LastSeen": "10-10-2019 11:26:43 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Domain",
        "Value": "www.google.com",
        "Verdict": "Benign"
    }
}
Human Readable Output

SlashNext Phishing Incident Response - Host Reputation

host = www.google.com
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
www.google.com Domain Benign N/A N/A N/A 12-10-2018 13:04:17 UTC 10-10-2019 11:26:43 UTC

5. slashnext-host-report

Search in SlashNext Cloud database and retrieve a detailed report for a host and associated URL.

Base Command

slashnext-host-report

Input
Argument Name Description Required
host host can either be a domain name or IPv4 address. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
IP.Address string IP address
IP.Malicious.Vendor string For malicious IP addresses, the vendor that made the decision
IP.Malicious.Description string For malicious IP addresses, the reason that the vendor made the decision
SlashNext.IP.Value string Value of the Indicator of Compromise (IoC)
SlashNext.IP.Type string Type of the Indicator of Compromise (IoC)
SlashNext.IP.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.IP.ThreatStatus string Threat status of the IoC
SlashNext.IP.ThreatName string Name of the threat posed by the IoC
SlashNext.IP.ThreatType string Type of the threat posed by the IoC
SlashNext.IP.FirstSeen date Time when the IoC was first observed
SlashNext.IP.LastSeen date Time when the IoC was last observed
Domain.Name string Domain name
Domain.Malicious.Vendor string For malicious domain names, the vendor that made the decision
Domain.Malicious.Description string For malicious domain names, the reason that the vendor made the decision
SlashNext.Domain.Value string Value of the Indicator of Compromise (IoC)
SlashNext.Domain.Type string Type of the Indicator of Compromise (IoC)
SlashNext.Domain.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.Domain.ThreatStatus string Threat status of the IoC
SlashNext.Domain.ThreatName string Name of the threat posed by the IoC
SlashNext.Domain.ThreatType string Type of the threat posed by the IoC
SlashNext.Domain.FirstSeen date Time when the IoC was first observed
SlashNext.Domain.LastSeen date Time when the IoC was last observed

 

Command Example

!slashnext-host-report host=www.google.com

Context Example
{
    "DBotScore": {
        "Indicator": "www.google.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "SlashNext Phishing Incident Response"
    },
    "Domain": {
        "Name": "www.google.com"
    },
    "SlashNext.Domain": {
        "FirstSeen": "12-10-2018 13:04:17 UTC",
        "LastSeen": "10-10-2019 11:26:43 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Domain",
        "Value": "www.google.com",
        "Verdict": "Benign"
    }
}{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/wasif",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "FirstSeen": "10-03-2019 08:24:04 UTC",
        "LastSeen": "10-03-2019 08:24:14 UTC",
        "ScanID": "61fe7c96-88e3-440e-a56f-75834b734b06",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/wasif",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/wasif"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - Host Report

host = www.google.com
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
www.google.com Domain Benign N/A N/A N/A 12-10-2018 13:04:17 UTC 10-10-2019 11:26:43 UTC

SlashNext Phishing Incident Response - Latest Scanned URL

host = www.google.com
Value Type Verdict ScanID ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/wasif Scanned URL Benign 61fe7c96-88e3-440e-a56f-75834b734b06 N/A N/A N/A 10-03-2019 08:24:04 UTC 10-03-2019 08:24:14 UTC

Forensics: Webpage Screenshot for the Scanned URL = http://www.google.com/wasif
Forensics: Webpage HTML for the Scanned URL = http://www.google.com/wasif
Forensics: Webpage Rendered Text for the Scanned URL = http://www.google.com/wasif

6. slashnext-host-urls

Search in SlashNext Cloud database and retrieve list of all URLs associated with the specified host.

Base Command

slashnext-host-urls

Input
Argument Name Description Required
host host can either be a domain name or IPv4 address. Required
limit maximum number of URL records to fetch. This is an optional parameter with a default value of 10. Optional

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.ScanID string Scan ID to be used to get the IoC forensics data for further investigation
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.ScanID string Scan ID to be used to get the landing IoC forensics data for further investigation
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!slashnext-host-urls host=www.google.com

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/wasif",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/abrar",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/saadat",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/url?q=replacedlink/&source=gmail&...",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/maps/place/2307",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/maps/place/2307",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/maps/place/2307+Watterson+Trail",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/maps/place/2307+Watterson+Trail",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/maps/place/2307+Watterson+Trail",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/maps/place/2307+Watterson+Trail",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "http://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": [
        {
            "FirstSeen": "10-03-2019 08:24:04 UTC",
            "LastSeen": "10-03-2019 08:24:14 UTC",
            "ScanID": "61fe7c96-88e3-440e-a56f-75834b734b06",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/wasif",
            "Verdict": "Benign"
        },
        {
            "FirstSeen": "10-03-2019 08:22:36 UTC",
            "LastSeen": "10-03-2019 08:22:46 UTC",
            "ScanID": "820275cd-c6de-46e9-b3a3-7cb072179bb4",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/abrar",
            "Verdict": "Benign"
        },
        {
            "FirstSeen": "10-03-2019 08:17:49 UTC",
            "LastSeen": "10-03-2019 08:18:00 UTC",
            "ScanID": "905cf63e-7761-4681-b314-4b8820f04c41",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/saadat",
            "Verdict": "Benign"
        },
        {
            "FirstSeen": "08-27-2019 10:32:19 UTC",
            "LastSeen": "08-27-2019 12:34:52 UTC",
            "ScanID": "4f1540b9-3517-4e6c-bca8-923acc3eed43",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "https://www.google.com/",
            "Verdict": "Benign"
        },
        {
            "FirstSeen": "08-30-2019 06:06:10 UTC",
            "LastSeen": "08-30-2019 06:06:21 UTC",
            "ScanID": "7277ea43-df3d-4692-8615-8c15485249c5",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "https://www.google.com/url?q=replacedlink/&source=gmail&...",
            "Verdict": "Benign"
        },
        {
            "Final": {
                "Type": "Final URL",
                "Value": "https://www.google.com/?gws_rd=ssl",
                "Verdict": "Benign"
            },
            "FirstSeen": "08-26-2019 17:29:38 UTC",
            "LastSeen": "08-26-2019 19:41:19 UTC",
            "ScanID": "48ae7b06-5915-4633-bc51-2cfaa0036742",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/",
            "Verdict": "Benign"
        },
        {
            "Final": {
                "Type": "Final URL",
                "Value": "https://www.google.com/maps/place/2307",
                "Verdict": "Benign"
            },
            "FirstSeen": "10-01-2019 12:50:34 UTC",
            "LastSeen": "10-01-2019 12:50:47 UTC",
            "ScanID": "N/A",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/maps/place/2307",
            "Verdict": "Benign"
        },
        {
            "Final": {
                "Type": "Final URL",
                "Value": "https://www.google.com/maps/place/2307+Watterson+Trail",
                "Verdict": "Benign"
            },
            "FirstSeen": "10-01-2019 12:50:12 UTC",
            "LastSeen": "10-01-2019 12:50:26 UTC",
            "ScanID": "N/A",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/maps/place/2307+Watterson+Trail",
            "Verdict": "Benign"
        },
        {
            "Final": {
                "Type": "Final URL",
                "Value": "https://www.google.com/maps/place/2307+Watterson+Trail",
                "Verdict": "Benign"
            },
            "FirstSeen": "10-01-2019 12:50:11 UTC",
            "LastSeen": "10-01-2019 12:50:24 UTC",
            "ScanID": "N/A",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/maps/place/2307+Watterson+Trail",
            "Verdict": "Benign"
        },
        {
            "Final": {
                "Type": "Final URL",
                "Value": "https://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225",
                "Verdict": "Benign"
            },
            "FirstSeen": "10-01-2019 12:49:44 UTC",
            "LastSeen": "10-01-2019 12:49:58 UTC",
            "ScanID": "N/A",
            "ThreatName": "N/A",
            "ThreatStatus": "N/A",
            "ThreatType": "N/A",
            "Type": "Scanned URL",
            "Value": "http://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225",
            "Verdict": "Benign"
        }
    ],
    "URL": [
        {
            "Data": "http://www.google.com/wasif"
        },
        {
            "Data": "http://www.google.com/abrar"
        },
        {
            "Data": "http://www.google.com/saadat"
        },
        {
            "Data": "https://www.google.com/"
        },
        {
            "Data": "https://www.google.com/url?q=replacedlink/&source=gmail&..."
        },
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        },
        {
            "Data": "http://www.google.com/maps/place/2307"
        },
        {
            "Data": "https://www.google.com/maps/place/2307"
        },
        {
            "Data": "http://www.google.com/maps/place/2307+Watterson+Trail"
        },
        {
            "Data": "https://www.google.com/maps/place/2307+Watterson+Trail"
        },
        {
            "Data": "http://www.google.com/maps/place/2307+Watterson+Trail"
        },
        {
            "Data": "https://www.google.com/maps/place/2307+Watterson+Trail"
        },
        {
            "Data": "http://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225"
        },
        {
            "Data": "https://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - Host URLs

host = www.google.com
Value Type Verdict ScanID ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/wasif Scanned URL Benign 61fe7c96-88e3-440e-a56f-75834b734b06 N/A N/A N/A 10-03-2019 08:24:04 UTC 10-03-2019 08:24:14 UTC
http://www.google.com/abrar Scanned URL Benign 820275cd-c6de-46e9-b3a3-7cb072179bb4 N/A N/A N/A 10-03-2019 08:22:36 UTC 10-03-2019 08:22:46 UTC
http://www.google.com/saadat Scanned URL Benign 905cf63e-7761-4681-b314-4b8820f04c41 N/A N/A N/A 10-03-2019 08:17:49 UTC 10-03-2019 08:18:00 UTC
https://www.google.com/ Scanned URL Benign 4f1540b9-3517-4e6c-bca8-923acc3eed43 N/A N/A N/A 08-27-2019 10:32:19 UTC 08-27-2019 12:34:52 UTC
https://www.google.com/url?q=replacedlink/&source=gmail&... Scanned URL Benign 7277ea43-df3d-4692-8615-8c15485249c5 N/A N/A N/A 08-30-2019 06:06:10 UTC 08-30-2019 06:06:21 UTC
http://www.google.com/ Scanned URL Benign 48ae7b06-5915-4633-bc51-2cfaa0036742 N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign
http://www.google.com/maps/place/2307 Scanned URL Benign N/A N/A N/A N/A 10-01-2019 12:50:34 UTC 10-01-2019 12:50:47 UTC
--------> https://www.google.com/maps/place/2307 Final URL Benign
http://www.google.com/maps/place/2307+Watterson+Trail Scanned URL Benign N/A N/A N/A N/A 10-01-2019 12:50:12 UTC 10-01-2019 12:50:26 UTC
--------> https://www.google.com/maps/place/2307+Watterson+Trail Final URL Benign
http://www.google.com/maps/place/2307+Watterson+Trail Scanned URL Benign N/A N/A N/A N/A 10-01-2019 12:50:11 UTC 10-01-2019 12:50:24 UTC
--------> https://www.google.com/maps/place/2307+Watterson+Trail Final URL Benign
http://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225 Scanned URL Benign N/A N/A N/A N/A 10-01-2019 12:49:44 UTC 10-01-2019 12:49:58 UTC
--------> https://www.google.com/maps/place/2307+Watterson+Trail,+Jeffersontown,+KY+40299/@38.2107207,-85.5607165,17z/data=!3m1!4b1!4m5!3m4!1s0x8869a1b57420f6d9:0xccc95b8f32dcfd4b!8m2!3d38.2107165!4d-85.5585225 Final URL Benign

7. slashnext-url-reputation

Queries the SlashNext Cloud database and retrieves the reputation of a url.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

slashnext-url-reputation

Input
Argument Name Description Required
url The url to look up in the SlashNext Threat Intelligence database. Required

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!slashnext-url-reputation url=www.google.com

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "Final": {
            "Type": "Final URL",
            "Value": "https://www.google.com/?gws_rd=ssl",
            "Verdict": "Benign"
        },
        "FirstSeen": "08-26-2019 17:29:38 UTC",
        "LastSeen": "08-26-2019 19:41:19 UTC",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - URL Reputation

url = http://www.google.com/
Value Type Verdict ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/ Scanned URL Benign N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign

8. slashnext-url-scan

Perform a real-time URL scan with SlashNext cloud-based SEER Engine. If the specified URL already exists in the cloud database, scan results will get returned immediately. If not, this command will submit a URL scan request and return with ‘check back later’ message along with a unique Scan ID. User can check results of this scan with ‘slashnext-scan-report’ command after 60 seconds or later using the retuned Scan ID

Base Command

slashnext-url-scan

Input
Argument Name Description Required
url The URL that needs to be scanned. Required
extended_info If extented_info is set ‘true’ the system along with URL reputation also downloads forensics data like screenshot, HTML and rendered text. If this parameter is not filled, the system will consider this as 'false'. Optional

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.ScanID string Scan ID to be used to get the IoC forensics data for further investigation
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.ScanID string Scan ID to be used to get the landing IoC forensics data for further investigation
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!slashnext-url-scan url=www.google.com extednded_info=true

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "Final": {
            "Type": "Final URL",
            "Value": "https://www.google.com/?gws_rd=ssl",
            "Verdict": "Benign"
        },
        "FirstSeen": "08-26-2019 17:29:38 UTC",
        "LastSeen": "08-26-2019 19:41:19 UTC",
        "ScanID": "48ae7b06-5915-4633-bc51-2cfaa0036742",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - URL Scan

url = http://www.google.com/
Value Type Verdict ScanID ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/ Scanned URL Benign 48ae7b06-5915-4633-bc51-2cfaa0036742 N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign

9. slashnext-url-scan-sync

Perform a real-time URL scan with SlashNext cloud-based SEER Engine in a blocking mode. If the specified URL already exists in the cloud database, scan result will get returned immediately. If not, this command will submit a URL scan request and wait for the scan to finish. The scan may take up to 60 seconds to finish.

Base Command

slashnext-url-scan-sync

Input
Argument Name Description Required
url The URL that needs to be scanned. Required
timeout A timeout value in seconds. If the system is unable to complete a scan within the specified timeout, a timeout error will be returned. User may try again with a different timeout. If no timeout value is specified, a default value of 60 seconds will be used. Optional
extended_info If extented_info is set ‘true’ the system along with URL reputation also downloads forensics data like screenshot, HTML and rendered text. If this parameter is not filled, the system will consider this as 'false'. Optional

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.ScanID string Scan ID to be used to get the IoC forensics data for further investigation
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.ScanID string Scan ID to be used to get the landing IoC forensics data for further investigation
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!slashnext-url-scan-sync url=www.google.com extednded_info=true

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "Final": {
            "Type": "Final URL",
            "Value": "https://www.google.com/?gws_rd=ssl",
            "Verdict": "Benign"
        },
        "FirstSeen": "08-26-2019 17:29:38 UTC",
        "LastSeen": "08-26-2019 19:41:19 UTC",
        "ScanID": "48ae7b06-5915-4633-bc51-2cfaa0036742",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - URL Scan Sync

url = http://www.google.com/
Value Type Verdict ScanID ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/ Scanned URL Benign 48ae7b06-5915-4633-bc51-2cfaa0036742 N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign

10. slashnext-scan-report

Retrieve URL scan results against a previous Scan request. If the scan is finished, result will be retuned immediately; otherwise a ‘check back later’ message will be returned.

Base Command

slashnext-scan-report

Input
Argument Name Description Required
scanid Scan ID returned by an earlier call to ‘slashnext-url-scan’ or ‘slashnext-url-scan-sync’ commands. Required
extended_info If extented_info is set ‘true’ the system along with URL reputation also downloads forensics data like screenshot, HTML and rendered text. If this parameter is not filled, the system will consider this as 'false'. Optional

 

Context Output
Path Type Description
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string Indicator type
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score number The actual score
URL.Data string URL reported
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision
SlashNext.URL.Value string Value of the Indicator of Compromise (IoC)
SlashNext.URL.Type string Type of the Indicator of Compromise (IoC)
SlashNext.URL.ScanID string Scan ID to be used to get the IoC forensics data for further investigation
SlashNext.URL.Verdict string SlashNext Phishing Incident Response verdict on the IoC
SlashNext.URL.ThreatStatus string Threat status of the IoC
SlashNext.URL.ThreatName string Name of the threat posed by the IoC
SlashNext.URL.ThreatType string Type of the threat posed by the IoC
SlashNext.URL.FirstSeen date Time when the IoC was first observed
SlashNext.URL.LastSeen date Time when the IoC was last observed
SlashNext.URL.Final.Value string Final IoC value in case original IoC is a redirector to same domain
SlashNext.URL.Final.Type string Type of the final IoC
SlashNext.URL.Final.Verdict string SlashNext Phishing Incident Response verdict on the final IoC
SlashNext.URL.Landing.Value string Landing IoC value in case original IoC is a redirector to different domain
SlashNext.URL.Landing.Type string Type of the landing IoC
SlashNext.URL.Landing.ScanID string Scan ID to be used to get the landing IoC forensics data for further investigation
SlashNext.URL.Landing.Verdict string SlashNext Phishing Incident Response verdict on the landing IoC
SlashNext.URL.Landing.ThreatStatus string Threat status of the landing IoC
SlashNext.URL.Landing.ThreatName string Name of the threat posed by the landing IoC
SlashNext.URL.Landing.ThreatType string Type of the threat posed by the landing IoC
SlashNext.URL.Landing.FirstSeen date Time when the landing IoC was first observed
SlashNext.URL.Landing.LastSeen date Time when the landing IoC was last observed

 

Command Example

!slashnext-scan-report scanid=48ae7b06-5915-4633-bc51-2cfaa0036742 extednded_info=true

Context Example
{
    "DBotScore": [
        {
            "Indicator": "http://www.google.com/",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        },
        {
            "Indicator": "https://www.google.com/?gws_rd=ssl",
            "Score": 1,
            "Type": "url",
            "Vendor": "SlashNext Phishing Incident Response"
        }
    ],
    "SlashNext.URL": {
        "Final": {
            "Type": "Final URL",
            "Value": "https://www.google.com/?gws_rd=ssl",
            "Verdict": "Benign"
        },
        "FirstSeen": "08-26-2019 17:29:38 UTC",
        "LastSeen": "08-26-2019 19:41:19 UTC",
        "ScanID": "48ae7b06-5915-4633-bc51-2cfaa0036742",
        "ThreatName": "N/A",
        "ThreatStatus": "N/A",
        "ThreatType": "N/A",
        "Type": "Scanned URL",
        "Value": "http://www.google.com/",
        "Verdict": "Benign"
    },
    "URL": [
        {
            "Data": "http://www.google.com/"
        },
        {
            "Data": "https://www.google.com/?gws_rd=ssl"
        }
    ]
}
Human Readable Output

SlashNext Phishing Incident Response - Scan Report

url = http://www.google.com/
Value Type Verdict ScanID ThreatStatus ThreatName ThreatType FirstSeen LastSeen
http://www.google.com/ Scanned URL Benign 48ae7b06-5915-4633-bc51-2cfaa0036742 N/A N/A N/A 08-26-2019 17:29:38 UTC 08-26-2019 19:41:19 UTC
--------> https://www.google.com/?gws_rd=ssl Final URL Benign

11. slashnext-download-screenshot

Download webpage screenshot against a previous URL Scan request.

Base Command

slashnext-download-screenshot

Input
Argument Name Description Required
scanid Scan ID returned by an earlier call to ‘slashnext-url-scan’ or ‘slashnext-url-scan-sync’ command. Required
resolution Resolution of the webpage screenshot. Currently only 'high' and 'medium' resolutions are supported. Optional

 

Context Output

There are no context output for this command.

 

Command Example

!slashnext-download-screenshot scanid=48ae7b06-5915-4633-bc51-2cfaa0036742

Human Readable Output

Forensics: Webpage Screenshot for URL Scan ID = 48ae7b06-5915-4633-bc51-2cfaa0036742

12. slashnext-download-html

Download webpage HTML against a previous URL Scan request.

Base Command

slashnext-download-html

Input
Argument Name Description Required
scanid Scan ID returned by an earlier call to ‘slashnext-url-scan’ or ‘slashnext-url-scan-sync’ command. Required

 

Context Output

There are no context output for this command.

 

Command Example

!slashnext-download-html scanid=48ae7b06-5915-4633-bc51-2cfaa0036742

Human Readable Output

Forensics: Webpage HTML for URL Scan ID = 48ae7b06-5915-4633-bc51-2cfaa0036742

13. slashnext-download-text

Download webpage text against a previous URL Scan request.

Base Command

slashnext-download-text

Input
Argument Name Description Required
scanid Scan ID returned by an earlier call to ‘slashnext-url-scan’ or ‘slashnext-url-scan-sync’ command. Required

 

Context Output

There are no context output for this command.

 

Command Example

!slashnext-download-text scanid=48ae7b06-5915-4633-bc51-2cfaa0036742

Human Readable Output

Forensics: Webpage Rendered Text for URL Scan ID = 48ae7b06-5915-4633-bc51-2cfaa0036742

14. slashnext-api-quota

Queries the SlashNext cloud database and retrieves the details of API quota.

Base Command

slashnext-api-quota

Input

No input parameter is required.

 

Context Output
{
    "SlashNext.Quota": {
        "LicensedQuota": "Unlimited",
        "RemainingQuota": "Unlimited",
        "ExpirationDate": "2020-12-01",
        "IsExpired": false
    }
}

 

Command Example

!slashnext-api-quota

Human Readable Output

SlashNext Phishing Incident Response - API Quota

Note: Your annual API quota will be reset to zero, once either the limit is reached or upon quota expiration date indicated above.
LicensedQuota RemainingQuota ExpirationDate
Unlimited Unlimited 2020-12-01

Additional Information

Known Limitations

Troubleshooting

Configuration parameters

  • apiurl — SlashNext API Base URL (required)
  • apikey — SlashNext API Key (required)
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (14)

  • domain

    Looks up a Fully Qualified Domain Name (FQDN) indicator in the SlashNext Threat Intelligence database.

  • ip

    Looks up an IP address indicator in the SlashNext Threat Intelligence database.

  • slashnext-api-quota

    Queries the SlashNext cloud database and retrieves the details of API quota.

  • slashnext-download-html

    Downloads a web page HTML against a previous URL scan request.

  • slashnext-download-screenshot

    Downloads a screenshot of a web page against a previous URL scan request.

  • slashnext-download-text

    Downloads the text of a web page against a previous URL scan request.

  • slashnext-host-report

    Queries the SlashNext Cloud database and retrieves a detailed report for a host and associated URL.

  • slashnext-host-reputation

    Queries the SlashNext Cloud database and retrieves the reputation of a host.

  • slashnext-host-urls

    Queries the SlashNext Cloud database and retrieves a list of all URLs associated with the specified host.

  • slashnext-scan-report

    Retrieves the results of a URL scan against a previous scan request. If the scan is finished, results will be returned immediately; otherwise the message "check back later" will be returned.

  • slashnext-url-reputation

    Queries the SlashNext Cloud database and retrieves the reputation of a url.

  • slashnext-url-scan

    Performs a real-time URL scan with SlashNext cloud-based SEER Engine. If the specified URL already exists in the cloud database, scan results will be returned immediately. If not, this command will submit a URL scan request and return with the message "check back later" and include a unique Scan ID. You can check the results of this scan using the "slashnext-scan-report" command anytime after 60 seconds using the returned Scan ID.

  • slashnext-url-scan-sync

    Performs a real-time URL scan with SlashNext cloud-based SEER Engine in a blocking mode. If the specified URL already exists in the cloud database, scan result will be returned immediately. If not, this command will submit a URL scan request and wait for the scan to finish. The scan may take up to 60 seconds to finish.

  • url

    Queries the SlashNext Cloud database and retrieves the reputation of a url.

Source

SlashNextPhishingIncidentResponse.py SlashNextPhishingIncidentResponse_test.py SlashNextPhishingIncidentResponse.yml SlashNextPhishingIncidentResponse_description.md
Download History Raw 
commonfields:
  id: SlashNext Phishing Incident Response
  version: -1
name: SlashNext Phishing Incident Response
display: SlashNext Phishing Incident Response (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: Varonis
deprecated: true
description: "SlashNext Phishing Incident Response integration allows Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services."
configuration:
- display: SlashNext API Base URL
  name: apiurl
  defaultvalue: https://oti.slashnext.cloud/api
  type: 0
  required: true
- display: SlashNext API Key
  name: apikey
  defaultvalue: ""
  type: 4
  required: true
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  dockerimage: demisto/python3:3.12.8.3296088
  type: python
  subtype: python3
  script: '-'
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IPv4 address to look up in the SlashNext Threat Intelligence database.
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Address
      description: The IP address.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.IP.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.IP.Type
      description: Type of the IoC.
      type: string
    - contextPath: SlashNext.IP.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.IP.LastSeen
      description: Time when the IoC was last observed.
      type: date
    description: Looks up an IP address indicator in the SlashNext Threat Intelligence database.
  - name: domain
    arguments:
    - name: domain
      required: true
      description: The FQDN to look up in the SlashNext Threat Intelligence database.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domain names, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domain names, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.Domain.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.Domain.Type
      description: Type of the IoC.
      type: string
    - contextPath: SlashNext.Domain.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.Domain.LastSeen
      description: Time when the IoC was last observed.
      type: date
    description: Looks up a Fully Qualified Domain Name (FQDN) indicator in the SlashNext Threat Intelligence database.
  - name: url
    arguments:
    - name: url
      required: true
      description: The url to look up in the SlashNext Threat Intelligence database.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to the same domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Queries the SlashNext Cloud database and retrieves the reputation of a url.
  - name: slashnext-host-reputation
    arguments:
    - name: host
      required: true
      description: The host to look up in the SlashNext Threat Intelligence database. Can be either a domain name or an IPv4 address.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.IP.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.IP.Type
      description: Type of the IoC.
      type: string
    - contextPath: SlashNext.IP.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.IP.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domain names, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domain names, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.Domain.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.Domain.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.Domain.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.Domain.LastSeen
      description: Time when the IoC was last observed.
      type: date
    description: Queries the SlashNext Cloud database and retrieves the reputation of a host.
  - name: slashnext-host-report
    arguments:
    - name: host
      required: true
      description: The host to look up in the SlashNext Threat Intelligence database. Can be either a domain name or an IPv4 address.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.IP.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.IP.Type
      description: Type of the IoC.
      type: string
    - contextPath: SlashNext.IP.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.IP.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.IP.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domain names, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domain names, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.Domain.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.Domain.Type
      description: Type of the IoC.
      type: string
    - contextPath: SlashNext.Domain.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.Domain.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.Domain.LastSeen
      description: Time when the IoC was last observed.
      type: date
    description: Queries the SlashNext Cloud database and retrieves a detailed report for a host and associated URL.
  - name: slashnext-host-urls
    arguments:
    - name: host
      required: true
      description: The host to look up in the SlashNext Threat Intelligence database, for which to return a list of associated URLs. Can be either a domain name or an IPv4 address.
    - name: limit
      description: The maximum number of URL records to fetch. Default is "10".
      defaultValue: "10"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.ScanID
      description: Scan ID to be used to get the IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to the same domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ScanID
      description: Scan ID to be used to get the landing IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Queries the SlashNext Cloud database and retrieves a list of all URLs associated with the specified host.
  - name: slashnext-url-reputation
    arguments:
    - name: url
      required: true
      description: The url to look up in the SlashNext Threat Intelligence database.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to the same domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Queries the SlashNext Cloud database and retrieves the reputation of a url.
  - name: slashnext-url-scan
    arguments:
    - name: url
      required: true
      description: The URL to scan.
    - name: extended_info
      description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false".
      defaultValue: "false"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.ScanID
      description: Scan ID to be used to get the IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to the same domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ScanID
      description: Scan ID to be used to get the landing IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Performs a real-time URL scan with SlashNext cloud-based SEER Engine. If the specified URL already exists in the cloud database, scan results will be returned immediately. If not, this command will submit a URL scan request and return with the message "check back later" and include a unique Scan ID. You can check the results of this scan using the "slashnext-scan-report" command anytime after 60 seconds using the returned Scan ID.
  - name: slashnext-url-scan-sync
    arguments:
    - name: url
      required: true
      description: The URL to scan.
    - name: timeout
      description: A timeout value in seconds. If the system is unable to complete a scan within the specified timeout, a timeout error will be returned. You can run the command again with a different timeout. If no timeout value is specified, a default timeout value is 60 seconds.
      defaultValue: "60"
    - name: extended_info
      description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false".
      defaultValue: "false"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.ScanID
      description: Scan ID to be used to get the IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to the same domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ScanID
      description: Scan ID to be used to get the landing IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Performs a real-time URL scan with SlashNext cloud-based SEER Engine in a blocking mode. If the specified URL already exists in the cloud database, scan result will be returned immediately. If not, this command will submit a URL scan request and wait for the scan to finish. The scan may take up to 60 seconds to finish.
  - name: slashnext-scan-report
    arguments:
    - name: scanid
      required: true
      description: Scan ID of the scan for which to get the report. Can be retrieved from the "slashnext-url-scan" command or "slashnext-url-scan-sync" command.
    - name: extended_info
      description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false".
      defaultValue: "false"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Data
      description: URL reported.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: SlashNext.URL.Value
      description: Value of the IoC.
      type: string
    - contextPath: SlashNext.URL.Type
      description: Type of IoC.
      type: string
    - contextPath: SlashNext.URL.ScanID
      description: Scan ID to be used to get the IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Verdict
      description: SlashNext Phishing Incident Response verdict on the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatStatus
      description: Threat status of the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatName
      description: Name of the threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.ThreatType
      description: Type of threat posed by the IoC.
      type: string
    - contextPath: SlashNext.URL.FirstSeen
      description: Time when the IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.LastSeen
      description: Time when the IoC was last observed.
      type: date
    - contextPath: SlashNext.URL.Final.Value
      description: Final IoC value (in case original IoC is a redirector to same the domain).
      type: string
    - contextPath: SlashNext.URL.Final.Type
      description: Type of the final IoC.
      type: string
    - contextPath: SlashNext.URL.Final.Verdict
      description: SlashNext Phishing Incident Response verdict on the final IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.Value
      description: Landing IoC value (in case original IoC is a redirector to a different domain).
      type: string
    - contextPath: SlashNext.URL.Landing.Type
      description: Type of landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ScanID
      description: Scan ID to be used to get the landing IoC forensics data for further investigation.
      type: string
    - contextPath: SlashNext.URL.Landing.Verdict
      description: SlashNext Phishing Incident Response verdict on the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatStatus
      description: Threat status of the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatName
      description: Name of the threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.ThreatType
      description: Type of threat posed by the landing IoC.
      type: string
    - contextPath: SlashNext.URL.Landing.FirstSeen
      description: Time when the landing IoC was first observed.
      type: date
    - contextPath: SlashNext.URL.Landing.LastSeen
      description: Time when the landing IoC was last observed.
      type: date
    description: Retrieves the results of a URL scan against a previous scan request. If the scan is finished, results will be returned immediately; otherwise the message "check back later" will be returned.
  - name: slashnext-download-screenshot
    arguments:
    - name: scanid
      required: true
      description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command.
    - name: resolution
      description: Resolution of the web page screenshot. Can be "high" or "medium". Default is "high".
      defaultValue: "high"
    description: Downloads a screenshot of a web page against a previous URL scan request.
  - name: slashnext-download-html
    arguments:
    - name: scanid
      required: true
      description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command.
    description: Downloads a web page HTML against a previous URL scan request.
  - name: slashnext-download-text
    arguments:
    - name: scanid
      required: true
      description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command.
    description: Downloads the text of a web page against a previous URL scan request.
  - name: slashnext-api-quota
    arguments: []
    outputs:
    - contextPath: SlashNext.Quota.LicensedQuota
      description: Licensed Quota.
      type: string
    - contextPath: SlashNext.Quota.RemainingQuota
      description: Remaining Quota.
      type: string
    - contextPath: SlashNext.Quota.ExpirationDate
      description: Quota Expiration Date.
      type: date
    - contextPath: SlashNext.Quota.IsExpired
      description: Quota Expiration Status.
      type: boolean
    description: Queries the SlashNext cloud database and retrieves the details of API quota.
fromversion: 5.0.0
tests:
- No tests (auto formatted)