Spamcop

Details

ID	`Spamcop`
Provider	Cisco Systems
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

SpamCop is an email spam reporting service. The integration allows checking the reputation of an IP address.
This integration was integrated and tested with Spamcop.

Configure Spamcop in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Get IP details from Spamcop service

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP which details you want to find	Required

Context Output

Path	Type	Description
Spamcop.IP	String	IP details

Command Example

!ip ip=xxx.xxx.xxx.xxx

Context Example

{
    "DBotScore": {
        "Indicator": "xxx.xxx.xxx.xxx",
        "Score": 3,
        "Type": "ip",
        "Vendor": "Spamcop"
    },
    "IP": {
        "Address": "xxx.xxx.xxx.xxx",
        "Malicious": {
            "Description": null,
            "Vendor": "Spamcop"
        }
    },
    "Spamcop": {
        "IP": {
            "indicator": "xxx.xxx.xxx.xxx"
        }
    }
}

Human Readable Output

Results

indicator

xxx.xxx.xxx.xxx

indicator
xxx.xxx.xxx.xxx

Configuration parameters

integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

ip
Get IP details from Spamcop service.

Source

Spamcop.py Spamcop.yml Spamcop_description.md command_examples.txt

Download History Raw

commonfields:
  id: Spamcop
  version: -1
name: Spamcop
display: Spamcop
category: Data Enrichment & Threat Intelligence
provider: Cisco Systems
description: SpamCop is an email spam reporting service, integration allow checking the reputation of an IP address.
configuration:
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: python
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: The IP which details you want to find.
      default: true
      isArray: true
    outputs:
    - contextPath: Spamcop.IP
      description: IP details.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: IP.Address
      description: The IP address.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: string
    description: Get IP details from Spamcop service.
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)