TeamCymru

Team Cymru provides various service options dedicated to mapping IP numbers to BGP prefixes and ASNs. Each of the services is based on the same BGP feeds from 50+ BGP peers and is updated at 4-hour intervals.

Data Enrichment & Threat Intelligence · Team Cymru

Details

IDTeamCymru
ProviderAudax Private Equity
CategoryData Enrichment & Threat Intelligence
From Version6.5.0
Docker Imagedemisto/vendors-sdk:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Team Cymru provides various service options dedicated to mapping IP numbers to BGP prefixes and ASNs. Each of the services is based on the same BGP feeds from 50+ BGP peers and is updated at 4-hour intervals.
This integration was integrated and tested with version 1.0 of TeamCymru

Configure Team Cymru in Cortex

Parameter Required  
Use system proxy settings False  
Proxy URL Supports socks4/socks5/http connect proxies (e.g., socks5h://host:1080). False
Source Reliability Reliability of the source providing the intelligence data. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Checks the reputation of an IP address.

Base Command

ip

Input

Argument Name Description Required
ip An IPv4 address to query, e.g., 1.1.1.1. Required

Context Output

Path Type Description
IP.Address String IP address.
IP.ASN String The autonomous system name for the IP address, for example: “AS8948”.
IP.ASOwner String The autonomous system owner of the IP address.
IP.Geo.Country String The country in which the IP address is located.
IP.Registrar.Abuse.Network String The network of the contact for reporting abuse.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
TeamCymru.IP.Address String The IP address.
TeamCymru.IP.ASN String The IP ASN.
TeamCymru.IP.ASOwner String The IP AS owner.
TeamCymru.IP.Geo.Country String The IP country.
TeamCymru.IP.Registrar.Abuse.Network String The IP range relevant for abuse inquiries provided for the IP.

Command example

!ip ip=1.1.1.1

Context Example

{
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 0,
        "Type": "ip",
        "Vendor": "TeamCymru"
    },
    "IP": {
        "ASN": "13335",
        "ASOwner": "CLOUDFLARENET, US",
        "Address": "1.1.1.1",
        "Geo": {
            "Country": "AU"
        },
        "Registrar": {
            "Abuse": {
                "Network": "1.1.1.0/24"
            }
        }
    },
    "TeamCymru": {
        "IP": {
            "ASN": "13335",
            "ASOwner": "CLOUDFLARENET, US",
            "Address": "1.1.1.1",
            "Geo": {
                "Country": "AU"
            },
            "Registrar": {
                "Abuse": {
                    "Network": "1.1.1.0/24"
                }
            }
        }
    }
}

Human Readable Output

Team Cymru results for 1.1.1.1

IP ASN Organization Country Range
1.1.1.1 13335 CLOUDFLARENET, US AU 1.1.1.0/24

cymru-bulk-whois

Checks the reputation of a CSV list of IPv4 addresses within a file.
Note: Results for queries exceeding 10,000 IPs may take more than a minute given a moderately sized Internet link.

Base Command

cymru-bulk-whois

Input

Argument Name Description Required
entry_id The file’s War Room entry ID. Required
delimiter Delimiter by which the content of the file is separated.
Eg: “ , “ , “ : “, “ ; “. Default is ,.		 Optional

Context Output

Path Type Description
IP.Address String IP address.
IP.ASN String The autonomous system name for the IP address, for example: “AS8948”.
IP.ASOwner String The autonomous system owner of the IP address.
IP.Geo.Country String The country in which the IP address is located.
IP.Registrar.Abuse.Network String The network of the contact for reporting abuse.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
TeamCymru.IP.Address String The IP address.
TeamCymru.IP.ASN String The IP ASN.
TeamCymru.IP.ASOwner String The IP AS owner.
TeamCymru.IP.Geo.Country String The IP country.
TeamCymru.IP.Registrar.Abuse.Network String The IP range relevant for abuse inquiries provided for the IP.

Command example

!cymru-bulk-whois entry_id=${File.EntryID}

Troubleshooting

  • In case of a problem with the proxy configuration, validate that the given proxy is working with the Whois content pack.

Configuration parameters

  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • proxy_url — Proxy URL
  • integration_reliability — Source Reliability

Commands (2)

  • cymru-bulk-whois

    Checks the reputation of a CSV list of IPv4 addresses within a file. Note: Results for queries exceeding 10,000 IPs may take more than a minute given a moderately sized Internet link.

  • ip

    Checks the reputation of an IP address.

Source

TeamCymru.py TeamCymru_test.py TeamCymru.yml TeamCymru_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Audax Private Equity
sectionorder:
- Connect
- Collect
commonfields:
  id: TeamCymru
  version: -1
configuration:
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: Proxy URL
  additionalinfo: "Supports socks4/socks5/http connect proxies (e.g., socks5h://host:1080)."
  name: proxy_url
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integration_reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Collect
  required: false
description: Team Cymru provides various service options dedicated to mapping IP numbers to BGP prefixes and ASNs. Each of the services is based on the same BGP feeds from 50+ BGP peers and is updated at 4-hour intervals.
display: 'Team Cymru'
name: TeamCymru
script:
  commands:
  - arguments:
    - default: true
      description: An IPv4 address to query, e.g., 1.1.1.1.
      name: ip
      required: true
      isArray: true
    description: Checks the reputation of an IP address.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Registrar.Abuse.Network
      description: The network of the contact for reporting abuse.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: TeamCymru.IP.Address
      description: The IP address.
      type: String
    - contextPath: TeamCymru.IP.ASN
      description: The IP ASN.
      type: String
    - contextPath: TeamCymru.IP.ASOwner
      description: The IP AS owner.
      type: String
    - contextPath: TeamCymru.IP.Geo.Country
      description: The IP country.
      type: String
    - contextPath: TeamCymru.IP.Registrar.Abuse.Network
      description: The IP range relevant for abuse inquiries provided for the IP.
      type: String
  - arguments:
    - description: The file's War Room entry ID.
      name: entry_id
      required: true
    - defaultValue: ','
      description: |-
        Delimiter by which the content of the file is separated.
        Eg:  " , " , " : ", " ; ".
      name: delimiter
    description: |-
      Checks the reputation of a CSV list of IPv4 addresses within a file. 
      Note: Results for queries exceeding 10,000 IPs may take more than a minute given a moderately sized Internet link.
    name: cymru-bulk-whois
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Registrar.Abuse.Network
      description: The network of the contact for reporting abuse.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: TeamCymru.IP.Address
      description: The IP address.
      type: String
    - contextPath: TeamCymru.IP.ASN
      description: The IP ASN.
      type: String
    - contextPath: TeamCymru.IP.ASOwner
      description: The IP AS owner.
      type: String
    - contextPath: TeamCymru.IP.Geo.Country
      description: The IP country.
      type: String
    - contextPath: TeamCymru.IP.Registrar.Abuse.Network
      description: The IP range relevant for abuse inquiries provided for the IP.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
fromversion: 6.5.0
tests:
- TeamCymruTest