SpurContextAPI

Enrich indicators using the Spur Context API.

Data Enrichment & Threat Intelligence · Spur Context API

Details

IDSpurContextAPI
ProviderGoAhead Inc
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Enrich indicators using the Spur Context API.
This integration was integrated and tested with version 2 of SpurContextAPI.

Configure SpurContextAPI in Cortex

Parameter Description Required
Server URL (e.g. https://api.spur.us/)   False
API Token   True
Source Reliability Reliability of the source providing the intelligence data. False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

spur-context-api-enrich

Enrich indicators using the Spur Context API.

Base Command

spur-context-api-enrich

Input

Argument Name Description Required
ip IP address to enrich. Required

Context Output

Path Type Description
SpurContextAPI.Context.ip string IP that was enriched
SpurContextAPI.Context.as object Autonomous System details for an IP Address.
SpurContextAPI.Context.organization string The organization using this IP address.
SpurContextAPI.Context.infrastructure string The primary infrastructure type that this IP address supports. Common tags are MOBILE and DATACENTER.
SpurContextAPI.Context.location object Data-center or IP Hosting location based on MaxMind GeoLite.
SpurContextAPI.Context.services array The different types of proxy or VPN services that are running on this IP address
SpurContextAPI.Context.tunnels array Different VPN or proxy tunnels that are currently in-use on this IP address
SpurContextAPI.Context.risks array Risks that we have determined based on our collection of data.
SpurContextAPI.Context.client_concentration object The strongest location concentration for clients using this IP address.
SpurContextAPI.Context.client_countries number The number of countries that we have observed clients located in for this IP address
SpurContextAPI.Context.client_spread number The total geographic area in kilometers where we have observed users
SpurContextAPI.Context.client_proxies array The different types of callback proxies we have observed on clients using this IP address.
SpurContextAPI.Context.client_count number The average number of clients we observe on this IP address.
SpurContextAPI.Context.client_behaviors array An array of behavior tags for an IP Address.
SpurContextAPI.Context.client_types array The different type of client devices that we have observed on this IP address.

ip

IP reputation command using the Spur Context API.

Base Command

ip

Input

Argument Name Description Required
ip IP address to enrich. Required

Context Output

Path Type Description
DBotScore.Score string The actual score.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
IP.Address string IP address.
IP.ASN string The autonomous system name for the IP address, for example: “AS8948”.
IP.ASOwner String The autonomous system owner of the IP.
IP.ClientTypes array The organization name.
IP.Geo.Country string The country in which the IP address is located.
IP.Organization.Name string The organization name.
IP.Risks array Risks that we have determined based on our collection of data.
IP.Tunnels array The different types of proxy or VPN services that are running on this IP address.
SpurContextAPI.Context.ip string IP that was enriched.
SpurContextAPI.Context.as object Autonomous System details for an IP Address.
SpurContextAPI.Context.organization string The organization using this IP address.
SpurContextAPI.Context.infrastructure string The primary infracstructure type that this IP address supports. Common tags are MOBILE and DATACENTER.
SpurContextAPI.Context.location object Data-center or IP Hosting location based on MaxMind GeoLite.
SpurContextAPI.Context.services array The different types of proxy or VPN services that are running on this IP address.
SpurContextAPI.Context.tunnels array Different VPN or proxy tunnels that are currently in-use on this IP address.
SpurContextAPI.Context.risks array Risks that we have determined based on our collection of data.
SpurContextAPI.Context.client_concentration object The strongest location concentration for clients using this IP address.
SpurContextAPI.Context.client_countries number The number of countries that we have observed clients located in for this IP address.
SpurContextAPI.Context.client_spread number The total geographic area in kilometers where we have observed users.
SpurContextAPI.Context.client_proxies array The different types of callback proxies we have observed on clients using this IP address.
SpurContextAPI.Context.client_count number The average number of clients we observe on this IP address.
SpurContextAPI.Context.client_behaviors array An array of behavior tags for an IP Address.
SpurContextAPI.Context.client_types array The different type of client devices that we have observed on this IP address.

Configuration parameters

  • base_url — Server URL (e.g. https://api.spur.us/)
  • credentials — (required)
  • reliability — Source Reliability
  • proxy — Use system proxy settings

Commands (2)

  • ip

    IP reputation command using the Spur Context API.

  • spur-context-api-enrich

    Enrich indicators using the Spur Context API.

Source

SpurContextAPI.py SpurContextAPI_test.py SpurContextAPI.yml SpurContextAPI_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: GoAhead Inc
commonfields:
  id: SpurContextAPI
  version: -1
configuration:
- display: "Server URL (e.g. https://api.spur.us/)"
  name: base_url
  type: 0
  required: false
  defaultvalue: https://api.spur.us/
- displaypassword: API Token
  hiddenusername: true
  name: credentials
  required: true
  type: 9
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  required: false
  type: 8
description: 'Enrich indicators using the Spur Context API.'
display: SpurContextAPI
name: SpurContextAPI
script:
  commands:
  - name: spur-context-api-enrich
    description: 'Enrich indicators using the Spur Context API.'
    arguments:
    - name: ip
      required: true
      description: IP address to enrich.
    outputs:
    - contextPath: SpurContextAPI.Context.ip
      type: string
      description: IP that was enriched.
    - contextPath: SpurContextAPI.Context.as
      type: object
      description: Autonomous System details for an IP Address.
    - contextPath: SpurContextAPI.Context.organization
      type: string
      description: The organization using this IP address.
    - contextPath: SpurContextAPI.Context.infrastructure
      type: string
      description: The primary infracstructure type that this IP address supports. Common tags are MOBILE and DATACENTER.
    - contextPath: SpurContextAPI.Context.location
      type: object
      description: Data-center or IP Hosting location based on MaxMind GeoLite.
    - contextPath: SpurContextAPI.Context.services
      type: array
      description: The different types of proxy or VPN services that are running on this IP address.
    - contextPath: SpurContextAPI.Context.tunnels
      type: array
      description: Different VPN or proxy tunnels that are currently in-use on this IP address.
    - contextPath: SpurContextAPI.Context.risks
      type: array
      description: Risks that we have determined based on our collection of data.
    - contextPath: SpurContextAPI.Context.client_concentration
      type: object
      description: The strongest location concentration for clients using this IP address.
    - contextPath: SpurContextAPI.Context.client_countries
      type: number
      description: The number of countries that we have observed clients located in for this IP address.
    - contextPath: SpurContextAPI.Context.client_spread
      type: number
      description: The total geographic area in kilometers where we have observed users.
    - contextPath: SpurContextAPI.Context.client_proxies
      type: array
      description: The different types of callback proxies we have observed on clients using this IP address.
    - contextPath: SpurContextAPI.Context.client_count
      type: number
      description: The average number of clients we observe on this IP address.
    - contextPath: SpurContextAPI.Context.client_behaviors
      type: array
      description: An array of behavior tags for an IP Address.
    - contextPath: SpurContextAPI.Context.client_types
      type: array
      description: The different type of client devices that we have observed on this IP address.
  - name: ip
    description: 'IP reputation command using the Spur Context API.'
    arguments:
    - name: ip
      required: true
      description: IP address to enrich.
      isArray: true
      default: true
    outputs:
    - contextPath: DBotScore.Score
      description: The actual score.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: string
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP.
      type: String
    - contextPath: IP.ClientTypes
      description: The organization name.
      type: array
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: string
    - contextPath: IP.Organization.Name
      description: The organization name.
      type: string
    - contextPath: IP.Risks
      description: Risks that we have determined based on our collection of data.
      type: array
    - contextPath: IP.Tunnels
      description: The different types of proxy or VPN services that are running on this IP address.
      type: array
    - contextPath: SpurContextAPI.Context.ip
      type: string
      description: IP that was enriched.
    - contextPath: SpurContextAPI.Context.as
      type: object
      description: Autonomous System details for an IP Address.
    - contextPath: SpurContextAPI.Context.organization
      type: string
      description: The organization using this IP address.
    - contextPath: SpurContextAPI.Context.infrastructure
      type: string
      description: The primary infracstructure type that this IP address supports. Common tags are MOBILE and DATACENTER.
    - contextPath: SpurContextAPI.Context.location
      type: object
      description: Data-center or IP Hosting location based on MaxMind GeoLite.
    - contextPath: SpurContextAPI.Context.services
      type: array
      description: The different types of proxy or VPN services that are running on this IP address.
    - contextPath: SpurContextAPI.Context.tunnels
      type: array
      description: Different VPN or proxy tunnels that are currently in-use on this IP address.
    - contextPath: SpurContextAPI.Context.risks
      type: array
      description: Risks that we have determined based on our collection of data.
    - contextPath: SpurContextAPI.Context.client_concentration
      type: object
      description: The strongest location concentration for clients using this IP address.
    - contextPath: SpurContextAPI.Context.client_countries
      type: number
      description: The number of countries that we have observed clients located in for this IP address.
    - contextPath: SpurContextAPI.Context.client_spread
      type: number
      description: The total geographic area in kilometers where we have observed users.
    - contextPath: SpurContextAPI.Context.client_proxies
      type: array
      description: The different types of callback proxies we have observed on clients using this IP address.
    - contextPath: SpurContextAPI.Context.client_count
      type: number
      description: The average number of clients we observe on this IP address.
    - contextPath: SpurContextAPI.Context.client_behaviors
      type: array
      description: An array of behavior tags for an IP Address.
    - contextPath: SpurContextAPI.Context.client_types
      type: array
      description: The different type of client devices that we have observed on this IP address.
  runonce: false
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)