ThreatConnect v3

ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.

Data Enrichment & Threat Intelligence · ThreatConnect

Details

ID	`ThreatConnect v3`
Provider	Dataminr
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

ThreatConnect’s integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
This integration was integrated and tested with version 3 of ThreatConnect v3 REST API

ThreatConnect v3 HMAC credentials

On the top navigation bar, hover the cursor over the Settings icon and select Org Settings from the dropdown menu.
Click the Create API User button on the Membership tab of the Organization Settings screen, and the API User Administration window will be displayed.
Enter the following information:
- First Name: Enter the API user’s first name.
- Last Name: Enter the API user’s last name.
- Organization Role: Use the dropdown menu to select an Organization role for the user.
- Include in Observations and False Positives: Check this box to allow data provided by the API user to be included in observation and false-positive counts.
- Disabled: Click the checkbox to disable an API user’s account in the event that the Administrator wants to retain log integrity when the API user no longer requires ThreatConnect access.
Record the Secret Key, as it will not be accessible after the window is closed.
Click SAVE to create the API user account.

For more information - click here (Section - Creating an API User).

Configure ThreatConnect v3 on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for ThreatConnect v3.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Base Url	The base URL for the API	True
Access ID	The API credentials	True
Secret key	The API secret key	True
Default Organization	The default owner for the integration	False
First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)		True
Maximum number of incidents to fetch	The maximum amount of incidents to fetch per run. Default is 200.	False
Trust any certificate (not secure)	Whether to trust any certificate	False
Use system proxy settings	Whether to use proxy	False
Tags filter for the fetch	Free text box to add comma-separated tags to filter the fetched incidents by.	False
Group Type filter for the fetch	The group type to filter the fetched incidents by.	False
Status filter for the fetch	The status to filter the fetched incidents by (if not field will fetch all statuses).	False
Incident Metadata	The metadata to collect.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Rating Threshold for Malicious Indicators	Rating Threshold for Malicious Indicators. This is necessary to calculate reputation.	False
Confidence Threshold for Malicious Indicators	Confidence Threshold for Malicious Indicators. This is necessary to calculate reputation.	False
Indicator Reputation Freshness in days	Indicator Reputation Freshness. This is necessary to calculate reputation.	False
TQL Filter	A free text TQL filter to apply to the fetch. This filter is added as an AND to the other filters. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Searches for an indicator of type IP address.

Base Command

ip

Input

Argument Name	Description	Required
ip	A comma-separated list of IPv4 or IPv6 addresses.	Required
owners	A comma-separated list of a client’s organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.	Optional
ratingThreshold	A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be “0” - “Unknown”, “1” - “Suspicious”, “2” - “Low”, “3” - Moderate, “4” - High, or “5” - “Critical”.	Optional
confidenceThreshold	A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be “0%” - “Unknown,” “1% “ - “Discredited”, “2-29%” - “Improbable,” “30-49%” - “Doubtful,” “50-69%” - “Possible”, “70-89%” - “Probable,” or “90-100%” - “Confirmed”.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

url

Searches for an indicator of type URL.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name	Description	Required
url	A comma-separated list of URLs for which to search. For example, “www.demisto.com”.	Required
owners	A comma-separated list of a client’s organizations, sources, or communities to which a client’s API user has been granted permission. For example, “owner1”, “owner2”, or “owner3”.	Optional
ratingThreshold	A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be “0” - “Unknown”, “1” - “Suspicious”, “2” - “Low”, “3” - Moderate, “4” - High, or “5” - “Critical”.	Optional
confidenceThreshold	A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be “0%” - “Unknown,” “1% “ - “Discredited”, “2-29%” - “Improbable,” “30-49%” - “Doubtful,” “50-69%” - “Possible”, “70-89%” - “Probable,” or “90-100%” - “Confirmed”.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	string	Reliability of the source providing the intelligence data.
URL.Data	string	The data of the URL indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

file

Searches for an indicator of type file.

Base Command

file

Input

Argument Name	Description	Required
file	A comma-separated list of the hashes of the files. Can be “MD5”, “SHA-1”, or “SHA-256”.	Required
owners	A comma-separated list of a client’s organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.	Optional
ratingThreshold	A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be “0” - “Unknown”, “1” - “Suspicious”, “2” - “Low”, “3” - Moderate, “4” - High, or “5” - “Critical”.	Optional
confidenceThreshold	A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be “0%” - “Unknown,” “1% “ - “Discredited”, “2-29%” - “Improbable,” “30-49%” - “Doubtful,” “50-69%” - “Possible”, “70-89%” - “Probable,” or “90-100%” - “Confirmed”.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.File.MD5	string	The MD5 hash of the indicator.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	string	Reliability of the source providing the intelligence data.
File.MD5	string	The MD5 hash of the indicator.
File.SHA1	string	The SHA1 hash of the indicator.
File.SHA256	string	The SHA256 hash of the indicator.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-owners

Retrieves all owners for the current account.

Base Command

tc-owners

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
TC.Owner.Name	string	The name of the owner.
TC.Owner.ID	string	The ID of the owner.
TC.Owner.Type	string	The type of the owner.

tc-indicators

Retrieves a list of all indicators.

Base Command

tc-indicators

Input

Argument Name	Description	Required
owner	A comma-separated list of results filtered by the owner of the indicator.	Optional
page	The page to take the results from.	Optional
limit	The maximum number of results that can be returned. The default is 500.	Optional
fields_to_return	Comma separated list of additional fields to return as part of the result indicator metadata. Possible values are: associatedGroups, associatedIndicators, observations, tags, and attributes.	Optional
filter	A free text TQL filter to apply to the indicators query. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	string	Reliability of the source providing the intelligence data.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The name of the domain.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-get-tags

Returns a list of all ThreatConnect tags.

Base Command

tc-get-tags

Input

Argument Name	Description	Required
page	The page to take the results from.	Optional
limit	The maximum number of results that can be returned. The default is 500.	Optional
name	The name of the tag to get.	Optional

Context Output

Path	Type	Description
TC.Tags	Unknown	A list of tags.

tc-tag-indicator

Adds a tag to an existing indicator.

Base Command

tc-tag-indicator

Input

Argument Name	Description	Required
tag	The name of the tag.	Required
indicator	The indicator to tag. For example, for an IP indicator, “8.8.8.8”.	Required

Context Output

There is no context output for this command.

tc-get-indicator

Retrieves information about an indicator.

Base Command

tc-get-indicator

Input

Argument Name	Description	Required
id	The ID of the indicator by which to search.	Required

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
TC.Indicator.IndicatorAttributes.dateAdded	date	The date the indicator attribute was added.
TC.Indicator.IndicatorAttributes.displayed	boolean	Whether to display the indicator attributes on ThreatConnect.
TC.Indicator.IndicatorAttributes.id	number	The ID of the attribute.
TC.Indicator.IndicatorAttributes.lastModified	date	The date the indicator attribute was last modified.
TC.Indicator.IndicatorAttributes.type	string	The name of the attribute.
TC.Indicator.IndicatorAttributes.value	string	The contents of the attribute.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the indicator of the URL.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The domain name of the indicator.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-get-indicators-by-tag

Fetches all indicators that have a tag.

Base Command

tc-get-indicators-by-tag

Input

Argument Name	Description	Required
tag	The name of the tag by which to filter the results.	Required
owner	A comma-separated list of indicators filtered by the owner.	Optional
page	The page to take the results from.	Optional
limit	The maximum number of results that can be returned. The default is 500.	Optional
operator	The comparison operator to use when filtering by tag. Possible values are: LIKE, EQ, NE, CONTAINS, STARTSWITH, ENDSWITH, IN. Default is LIKE (pattern matching).	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the tagged indicator.
TC.Indicator.Type	string	The type of the tagged indicator.
TC.Indicator.ID	string	The ID of the tagged indicator.
TC.Indicator.Description	string	The description of the tagged indicator.
TC.Indicator.Owner	string	The owner of the tagged indicator.
TC.Indicator.CreateDate	date	The date the tagged indicator was created.
TC.Indicator.LastModified	date	The date the tagged indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the tagged indicator.
TC.Indicator.Confidence	number	The confidence rating of the tagged indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	string	The IP address of the tagged indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the tagged indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The domain name of the tagged indicator.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-add-indicator

Adds a new indicator to ThreatConnect.

Base Command

tc-add-indicator

Input

Argument Name	Description	Required
indicator	The indicator to add.	Required
indicatorType	The type of the indicator. Possible values are: Address, Agent, User, Registry Key, Mutex, Hashtag, Email Subject, Subject, Email, CIDR, Host, URL, ASN, File, EmailAddress.	Required
hashType	The type of hash for the file indicator. Possible values are: md5, sha1, sha256.	Optional
rating	The threat rating of the indicator. Can be “0” - “Unknown”, “1” - “Suspicious”, “2” - “Low”, “3” - Moderate, “4” - High, or “5” - “Critical”.	Optional
confidence	The confidence rating of the indicator. Can be “0%” - “Unknown,” “1% “ - “Discredited”, “2-29%” - “Improbable,” “30-49%” - “Doubtful,” “50-69%” - “Possible”, “70-89%” - “Probable,” or “90-100%” - “Confirmed”.	Optional
tags	A comma-separated list of the tags to apply to the campaign.	Optional
description	The description of the indicator.	Optional
owner	The name of the owner to which the Indicator belongs.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the added indicator was created.
TC.Indicator.LastModified	date	The date the added indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The name of the added indicator of the domain.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-create-incident

Creates a new incident group.

Base Command

tc-create-incident

Input

Argument Name	Description	Required
incidentName	The name of the incident group.	Required
eventDate	The creation time of an incident in the “2017-03-21T00:00:00Z” format.	Optional
tag	A comma-separated list of the tags applied to the incident.	Optional
securityLabel	The security label applied to the incident. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional
description	The description of the incident.	Optional

Context Output

Path	Type	Description
TC.Incident.Name	string	The name of the new incident group.
TC.Incident.Owner	string	The owner of the new incident.
TC.Incident.EventDate	date	The date on which the event that indicates an incident occurred.
TC.Incident.Tag	string	The name of the tag of the new incident.
TC.Incident.SecurityLabel	string	The security label of the new incident.
TC.Incident.ID	Unknown	The ID of the new incident.

tc-incident-associate-indicator

Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.

Base Command

tc-incident-associate-indicator

Input

Argument Name	Description	Required
incidentId	The ID of the incident to which the indicator is associated.	Required
indicator	The ID of the indicator.	Required

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the associated indicator was created.
TC.Indicator.LastModified	date	The date the associated indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
IP.Address	string	IP address of the associated indicator of the file.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the associated indicator of the file.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The name of the indicator of the domain.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

domain

Searches for an indicator of type domain.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name	Description	Required
domain	A comma-separated list of names of the domain.	Required
owners	A comma-separated list of a client’s organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.	Optional
ratingThreshold	A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be “0” - “Unknown”, “1” - “Suspicious”, “2” - “Low”, “3” - Moderate, “4” - High, or “5” - “Critical”.	Optional
confidenceThreshold	A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be “0%” - “Unknown,” “1% “ - “Discredited”, “2-29%” - “Improbable,” “30-49%” - “Doubtful,” “50-69%” - “Possible”, “70-89%” - “Probable,” or “90-100%” - “Confirmed”.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the domain.
TC.Indicator.ID	string	The ID of the domain.
TC.Indicator.Description	string	The description of the domain.
TC.Indicator.Owner	string	The owner of the domain.
TC.Indicator.CreateDate	date	The date the indicator of the domain was created.
TC.Indicator.LastModified	date	The date the indicator of the domain was last modified.
TC.Indicator.Rating	number	The threat rating of the domain.
TC.Indicator.Confidence	number	The confidence rating of the domain.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Domain.Name	string	The name of the domain.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-get-incident-associate-indicators

Returns indicators that are related to a specific incident.

Base Command

tc-get-incident-associate-indicators

Input

Argument Name	Description	Required
incidentId	The ID of the incident.	Required

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the returned indicator.
TC.Indicator.Type	string	The type of the returned indicator.
TC.Indicator.ID	string	The ID of the returned indicator.
TC.Indicator.Description	string	The description of the returned indicator.
TC.Indicator.Owner	string	The owner of the returned indicator.
TC.Indicator.CreateDate	date	The date the returned indicator was created.
TC.Indicator.LastModified	date	The date the returned indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the returned indicator.
TC.Indicator.Confidence	number	The confidence rating of the returned indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	string	The IP address of the returned indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the returned indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The name of the domain.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.

tc-update-indicator

Updates the indicator in ThreatConnect.

Base Command

tc-update-indicator

Input

Argument Name	Description	Required
indicator	The name of the updated indicator.	Required
rating	The threat rating of the updated indicator.	Optional
confidence	The confidence rating of the updated indicator.	Optional
size	The size of the file of the updated indicator.	Optional
dnsActive	Whether the DNS indicator is active (only for hosts). Possible values are: True, False.	Optional
whoisActive	Whether the indicator is active (only for hosts). Possible values are: True, False.	Optional
securityLabel	The security label applied to the incident. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional
tags	A comma-separated list of tags.	Optional

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The domain name of the indicator.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-delete-indicator-tag

Removes a tag from a specified indicator.

Base Command

tc-delete-indicator-tag

Input

Argument Name	Description	Required
indicator	The ID of the indicator from which to remove a tag.	Required
tag	The name of the tag to remove from the indicator.	Required

Context Output

Path	Type	Description
TC.Indicator.Name	string	The name of the indicator.
TC.Indicator.Type	string	The type of the indicator.
TC.Indicator.ID	string	The ID of the indicator.
TC.Indicator.Description	string	The description of the indicator.
TC.Indicator.Owner	string	The owner of the indicator.
TC.Indicator.CreateDate	date	The date the indicator was created.
TC.Indicator.LastModified	date	The date the indicator was last modified.
TC.Indicator.Rating	number	The threat rating of the indicator.
TC.Indicator.Confidence	number	The confidence rating of the indicator.
TC.Indicator.WhoisActive	string	The active indicator (for domains only).
TC.Indicator.File.MD5	string	The MD5 hash of the indicator of the file.
TC.Indicator.File.SHA1	string	The SHA1 hash of the indicator of the file.
TC.Indicator.File.SHA256	string	The SHA256 hash of the indicator of the file.
IP.Address	string	The IP address of the indicator.
IP.Malicious.Vendor	string	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	string	For malicious IP addresses, the full description.
URL.Data	string	The data of the URL of the indicator.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the full description.
Domain.Name	string	The domain name of the indicator.
Domain.Malicious.Vendor	string	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	string	For malicious domains, the full description.
File.MD5	string	The MD5 hash of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
File.Malicious.Description	string	For malicious files, the full description.
TC.Indicator.WebLink	string	The web link of the indicator.

tc-delete-indicator

Deletes an indicator from ThreatConnect.

Base Command

tc-delete-indicator

Input

Argument Name	Description	Required
indicator	The ID of the indicator to delete.	Required

Context Output

There is no context output for this command.

tc-create-campaign

Creates a group based on the Campaign type.

Base Command

tc-create-campaign

Input

Argument Name	Description	Required
name	The name of the campaign group.	Required
firstSeen	The date the campaign was first seen.	Optional
description	The description of the campaign.	Optional
tag	Comma-separated list of the tags to apply to the campaign.	Optional
securityLabel	The security label applied to the incident. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional

Context Output

Path	Type	Description
TC.Campaign.Name	string	The name of the campaign.
TC.Campaign.Owner	string	The owner of the campaign.
TC.Campaign.FirstSeen	date	The date the campaign was first seen.
TC.Campaign.Tag	string	The tag of the campaign.
TC.Campaign.SecurityLevel	string	The security label of the campaign.
TC.Campaign.ID	string	The ID of the campaign.

tc-create-event

Creates a group based on the Event type.

Base Command

tc-create-event

Input

Argument Name	Description	Required
name	The name of the event group.	Required
eventDate	The date the event occurred. If the date is not specified, the current date is used.	Optional
status	The status of the event. Possible values are: Needs Review, False Positive, No Further Action, Escalated.	Optional
tag	A comma-separated list of the tags of the event.	Optional
owner_name	The name of the owner to which the group belongs. By default, events will be created in the organization in which the API user account resides.	Optional

Context Output

Path	Type	Description
TC.Event.Name	string	The name of the event.
TC.Event.Date	date	The date of the event.
TC.Event.Status	string	The status of the event.
TC.Event.Owner	string	The owner of the event.
TC.Event.Tag	string	The tag of the event.
TC.Event.ID	string	The ID of the event.
TC.Event.Type	string	The type of the event.

tc-create-threat

Creates a group based on the “Threats” type.

Base Command

tc-create-threat

Input

Argument Name	Description	Required
name	The name of the threat group.	Required
eventDate	The creation time of a threat in the “2017-03-21T00:00:00Z” format.	Optional
tags	A comma-separated list of the tags applied to the threat.	Optional
securityLabel	The security label applied to the threat. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional
description	The description of the threat.	Optional

Context Output

Path	Type	Description
TC.Threat.Name	string	The name of the threat.
TC.Threat.ID	string	The ID of the threat.

tc-delete-group

Deletes a group.

Base Command

tc-delete-group

Input

Argument Name	Description	Required
groupID	A comma-separated list of the IDs of the groups to delete.	Required

Context Output

There is no context output for this command.

tc-get-events

Returns a list of events.

Base Command

tc-get-events

Input

Argument Name	Description	Required
fromDate	The date to retrieve groups from in the yyyy-mm-dd format, e.g., 1111-11-11.	Optional
tag	The tag to retrieve groups by.	Optional
page	The page to take the results from.	Optional
limit	The maximum number of results that can be returned. The default is 500.	Optional
id	A comma-separated list of IDs to filter the groups by.	Optional
filter	A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional

Context Output

Path	Type	Description
TC.Event.DateAdded	Date	The date the event was added.
TC.Event.EventDate	Date	The date the event occurred.
TC.Event.ID	Number	The ID of the event.
TC.Event.OwnerName	String	The name of the owner of the event.
TC.Event.Status	String	The status of the event.
TC.Event.AssociatedGroups	String	The associated groups for the event.
TC.Event.AssociatedIndicators	String	The associated indicators for the event.
TC.Event.Tags	String	The tags of the event.

tc-list-groups

Returns all groups.

Base Command

tc-list-groups

Input

Argument Name	Description	Required
group_type	The type of the group. Possible values are: Adversary, Attack Pattern, Campaign, Course of Action, Document, E-mail, Event, Incident, Intrusion Set, Malware, Report, Signature, Tactic, Task, Threat, Tool, Vulnerability.	Optional
fromDate	The date to retrieve groups from in the yyyy-mm-dd format, e.g., 1111-11-11.	Optional
tag	The tag to retrieve groups by.	Optional
page	The page to take the results from.	Optional
limit	The maximum number of results that can be returned. The default is 500.	Optional
id	A comma-separated list of IDs to filter the groups by.	Optional
filter	A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional
include_tags	Add group tags metadata to the results.	Optional
include_security_labels	Add group security labels metadata to the results.	Optional
include_attributes	Add group attributes metadata to the results.	Optional
include_associated_groups	Add group associated groups metadata to the results.	Optional
include_associated_indicators	Add group associated indicators metadata to the results.	Optional
include_all_metaData	Add all group metadata to the results.	Optional

Context Output

Path	Type	Description
TC.Group.DateAdded	Date	The date the group was added.
TC.Group.EventDate	Date	The date the event occurred.
TC.Group.Name	String	The name of the group.
TC.Group.OwnerName	String	The name of the owner of the group.
TC.Group.Status	String	The status of the group.
TC.Group.ID	Number	The ID of the group.

tc-add-group-tag

Adds tags to a specified group.

Base Command

tc-add-group-tag

Input

Argument Name	Description	Required
group_id	The ID of the group to which to add the tag. To get the ID, run the tc-list-groups command.	Required
tag_name	The name of the tag to add to the group.	Required

Context Output

There is no context output for this command.

tc-get-indicator-types

Returns all indicator types available.

Base Command

tc-get-indicator-types

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
TC.IndicatorType.ApiBranch	String	The branch of the API.
TC.IndicatorType.ApiEntity	String	The entity of the API.
TC.IndicatorType.CasePreference	String	The case preference of the indicator. For example, “sensitive”, “upper”, or “lower”.
TC.IndicatorType.Custom	Boolean	Whether the indicator is a custom indicator.
TC.IndicatorType.Parsable	Boolean	Whether the indicator can be parsed.
TC.IndicatorType.Value1Type	String	The value type of the indicator.
TC.IndicatorType.Value1Label	String	The value label of the indicator.

tc-create-document-group

Creates a document group.

Base Command

tc-create-document-group

Input

Argument Name	Description	Required
file_name	The name of the file to display in the UI.	Required
name	The name of the group.	Required
malware	Whether the file is malware. If “true”, ThreatConnect creates a password-protected ZIP file on your local machine that contains the sample and uploads the ZIP file. Possible values are: true, false.	Optional
password	The password of the ZIP file.	Optional
security_label	The security label applied to the document. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional
description	A description of the group.	Optional
entry_id	The ID of the entry, as displayed in the War Room.	Required

Context Output

Path	Type	Description
TC.Group.Name	String	The name of the group.
TC.Group.Owner	String	The owner of the group.
TC.Group.EventDate	Date	The date the group was created.
TC.Group.Description	String	The description of the group.
TC.Group.SecurityLabel	String	The security label of the group.
TC.Group.ID	Number	The ID of the group to which the attribute was added.

tc-download-document

Downloads the contents of a document.

Base Command

tc-download-document

Input

Argument Name	Description	Required
document_id	The ID of the document.	Required

Context Output

Path	Type	Description
File.Size	Number	The size of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.Name	String	The name of the file.
File.SSDeep	String	The ssdeep hash of the file (same as displayed in file entries).
File.EntryID	String	The entry ID of the file.
File.Info	String	The information of the file.
File.Type	String	The type of the file.
File.MD5	String	The MD5 hash of the file.
File.Extension	String	The extension of the file.

tc-get-associated-groups

Returns groups associated with a specified group.

Base Command

tc-get-associated-groups

Input

Argument Name	Description	Required
group_id	The ID of the group. To get the ID, run the tc-list-groups command.	Required

Context Output

Path	Type	Description
TC.Group.AssociatedGroup.DateAdded	Date	The date the group was added.
TC.Group.AssociatedGroup.GroupID	Number	The ID of the group.
TC.Group.AssociatedGroup.Name	String	The name of the group.
TC.Group.AssociatedGroup.OwnerName	String	The name of the owner of the group.
TC.Group.AssociatedGroup.Type	String	The type of the group.

tc-get-indicator-owners

Get the owner for an indicator.

Base Command

tc-get-indicator-owners

Input

Argument Name	Description	Required
indicator	Indicator ID.	Required

Context Output

There is no context output for this command.

tc-download-report

The group report to download in PDF format.

Base Command

tc-download-report

Input

Argument Name	Description	Required
group_id	The ID of the group.	Required

Context Output

Path	Type	Description
File.Size	Number	The size of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.Name	String	The name of the file.
File.SSDeep	String	The ssdeep hash of the file.
File.EntryID	String	The entry ID of the file.
File.Info	String	The information of the file.
File.Type	String	The type of the file.
File.MD5	String	The MD5 hash of the file.
File.Extension	String	The extension of the file.

tc-update-group

Updates a group.

Base Command

tc-update-group

Input

Argument Name	Description	Required
id	The ID of the group.	Required
custom_field	Custom fields for the group.	Optional
tags	A comma-separated list of The tags applied to the threat.	Optional
security_label	The security label applied to the threat. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE.	Optional
associated_group_id	An ID to associate a group by.	Optional
associated_indicator_id	An ID to associate an indicator by.	Optional
mode	The type of update to the group metadata(associated indicators, attributes,tags etc.). Possible values are: append, delete, replace.	Optional
attribute_value	The value of the attribute to associate.	Optional
attribute_type	The type of the attribute to associate.	Optional

Context Output

Path	Type	Description
TC.Group.Name	string	The name of the group.
TC.Group.Owner	string	The owner of the group.
TC.Group.Tag	string	The tag of the group.
TC.Group.SecurityLevel	string	The security label of the group.
TC.Group.ID	string	The ID of the group.

Redundant Arguments

The following arguments were removed in this version:

In the tc-tag-indicator command:

owner - this argument was redundant.

In the tc-get-indicator command:

indicator_type - this argument was redundant.
owners - this argument was redundant.
ratingThreshold - this argument was redundant.
confidenceThreshold - this argument was redundant.
group_associations - this argument was redundant.
indicator_associations - this argument was redundant.
indicator_observations - this argument was redundant.
indicator_tags - this argument was redundant.
indicator_attributes - this argument was redundant.

In the tc-add-indicator command:

owner - this argument was redundant.

In the tc-create-incident command:

owner - this argument was redundant.

In the tc-fetch-incidents command:

incidentName - this argument was redundant.

In the tc-incident-associate-indicator command:

indicatorType - this argument was redundant.
owner - this argument was redundant.

In the tc-get-incident-associate-indicators command:

owner - this argument was redundant.

In the tc-update-indicator command:

observations - this argument was redundant.
threatAssessConfidence - this argument was redundant.
threatAssessRating - this argument was redundant.
owner - this argument was redundant.

In the tc-create-campaign command:

owner - this argument was redundant.

In the tc-create-event command:

owner - this argument was redundant.

In the tc-delete-group command:

type - this argument was redundant.

In the tc-add-group-attribute command:

group_type - this argument was redundant.

In the tc-add-group-security-label command:

group_type - this argument was redundant.

In the tc-add-group-tag command:

group_type - this argument was redundant.

In the tc-group-associate-indicator command:

indicator_type - this argument was redundant.
group_type - this argument was redundant.

In the tc-get-group command:

group_type - this argument was redundant.

In the tc-get-group-attributes command:

group_type - this argument was redundant.

In the tc-get-group-security-labels command:

group_type - this argument was redundant.

In the tc-get-group-tags command:

group_type - this argument was redundant.

In the tc-get-group-indicators command:

group_type - this argument was redundant.

In the tc-get-associated-groups command:

group_type - this argument was redundant.

In the tc-associate-group-to-group command:

group_type - this argument was redundant.
associated_group_type - this argument was redundant.

In the tc-download-report command:

group_type - this argument was redundant.

Additional Considerations for this version

API version 3 documentation
Use the new REST v3 API instead of the old python module.

tc-create-victim-attribute

Creates a victim attribute.

Base Command

tc-create-victim-attribute

Input

Argument Name	Description	Required
victim_id	The ID of the victim.	Required
security_labels	A comma-separated list of the security labels to apply to the victim attribute. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE, TLP:AMBER+STRICT, TLP:CLEAR.	Optional
attribute_type	The attribute type. Possible values are: Additional Analysis and Context, Description, External ID, Impact Description, Impact Score, Physical Address, Response Team & Staff involved, Source, Takedown Requests, Targeted Industry Sector, Title.	Required
attribute_value	The attribute value.	Required
source	The attribute source.	Optional

Context Output

Path	Type	Description
TC.VictimAttribute.dateAdded	string	The date that the victim attribute was added.
TC.VictimAttribute.default	string	Whether the attribute is the default attribute of its type for the victim to which it is added.
TC.VictimAttribute.id	string	The ID of the victim attribute.
TC.VictimAttribute.lastModified	string	The date that the victim attribute was last modified.
TC.VictimAttribute.pinned	string	Whether the victim attribute is pinned.
TC.VictimAttribute.type	string	The type of the victim attribute.
TC.VictimAttribute.value	string	The value of the victim attribute.
TC.VictimAttribute.createdBy.firstName	string	The first name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.id	string	The ID of the victim the attribute associated to.
TC.VictimAttribute.createdBy.lastName	string	The last name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.owner	string	The owner of the user who created the victim attribute.
TC.VictimAttribute.createdBy.pseudonym	string	The pseudonym of the user who created the victim attribute.
TC.VictimAttribute.createdBy.userName	string	The user name of the user who created the victim attribute.

Command example

!tc-create-victim-attribute attribute_type="Takedown Requests" victim_id=668 attribute_value="test"

Context Example

{
    "TC": {
        "VictimAttribute": {
            "createdBy": {
                "firstName": "Demisto API",
                "id": 615,
                "lastName": "Demisto API",
                "owner": "Palo Alto Cortex XSOAR",
                "pseudonym": "APIUsersTest",
                "userName": "test"
            },
            "dateAdded": "2024-01-04T13:24:53Z",
            "default": false,
            "id": 133,
            "lastModified": "2024-01-04T13:24:53Z",
            "pinned": false,
            "type": "Takedown Requests",
            "value": "test"
        }
    }
}

Human Readable Output

Victim Attribute 133 created successfully for victim id: 668

tc-create-victim

Creates a victim.

Base Command

tc-create-victim

Input

Argument Name	Description	Required
name	The name of the victim.	Required
nationality	The nationality of the victim.	Optional
org	The organization of the victim.	Optional
sub_org	The sub-organization of the victim.	Optional
security_labels	A comma-separated list of the security labels to apply to the victim. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE, TLP:AMBER+STRICT, TLP:CLEAR.	Optional
tags	A comma-separated list of tags.	Optional
work_location	The work location of the victim.	Optional
asset_type	The asset type of the victim. Possible values are: EmailAddress, NetworkAccount, Phone, SocialNetwork, WebSite.	Optional
asset_value	The asset value of the victim.	Optional
asset_address_type	The asset address type. Relevant only when the asset_type is EmailAddress.	Optional
asset_network_type	The asset network type. Relevant only when the asset_type is NetworkAccount.	Optional
asset_social_network	The asset social network. Required only when the asset_type is SocialNetwork.	Optional
associated_groups_ids	A comma-separated list of group IDs to associate to the victim.	Optional
attribute_type	The attribute type to associate to the victim. Possible values are: Additional Analysis and Context, Description, External ID, Impact Description, Impact Score, Physical Address, Response Team & Staff involved, Source, Takedown Requests, Targeted Industry Sector, Title.	Optional
attribute_value	The attribute value to associate to the victim.	Optional

Context Output

Path	Type	Description
TC.Victim.Name	string	The name of the victim.
TC.Victim.ownerId	string	The owner ID of the victim.
TC.Victim.id	string	The ID of the victim.
TC.Victim.ownerName	string	The owner name of the victim.
TC.Victim.webLink	string	The web link of the victim.
TC.Victim.description	string	The description of the victim.
TC.Victim.org	string	The organization of the victim.
TC.Victim.suborg	string	The sub-organization of the victim.
TC.Victim.workLocation	string	The work location of the victim.
TC.Victim.nationality	string	The nationality of the victim.

Command example

!tc-create-victim name="test" org="test" asset_type="EmailAddress" asset_value="test@test.com" attribute_type="Description" attribute_value="test"

Context Example

{
    "TC": {
        "Victim": {
            "id": 671,
            "name": "test",
            "org": "test",
            "ownerId": 271,
            "ownerName": "Palo Alto Cortex XSOAR",
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=671"
        }
    }
}

Human Readable Output

Victim test created successfully with id: 671

tc-create-victim-asset

Creates a victim asset.

Base Command

tc-create-victim-asset

Input

Argument Name	Description	Required
victim_id	The ID of the victim.	Required
asset_type	The asset type. Possible values are: EmailAddress, NetworkAccount, Phone, SocialNetwork, WebSite.	Required
asset_value	The asset value.	Required
asset_address_type	The asset address type. Relevant only when the asset_type is EmailAddress.	Optional
asset_network_type	The asset network type. Relevant only when the asset_type is NetworkAccount.	Optional
asset_social_network	The asset social network. Required only when the asset_type is SocialNetwork.	Optional

Context Output

Path	Type	Description
TC.VictimAsset.id	string	The ID of the victim asset.
TC.VictimAsset.type	string	The type of the victim asset.
TC.VictimAsset.victimId	string	The ID of the victim.
TC.VictimAsset.webLink	string	The web link of the victim asset.
TC.VictimAsset.phone	string	The phone number of the victim asset.
TC.VictimAsset.address	string	The address of the victim asset.
TC.VictimAsset.accountName	string	The account name of the victim asset.
TC.VictimAsset.addressType	string	The address type of the victim asset.
TC.VictimAsset.networkType	string	The network type of the victim asset.
TC.VictimAsset.socialNetwork	string	The social network of the victim asset.
TC.VictimAsset.website	string	The website of the victim asset.

Command example

!tc-create-victim-asset victim_id=668 asset_type=SocialNetwork asset_value=test asset_social_network=test

Context Example

{
    "TC": {
        "VictimAsset": {
            "accountName": "test",
            "id": 753,
            "socialNetwork": "test",
            "type": "SocialNetwork",
            "victimId": 668,
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=668"
        }
    }
}

Human Readable Output

Victim Asset 753 created successfully for victim id: 668

tc-list-victim-assets

Retrieves victim assets.

Base Command

tc-list-victim-assets

Input

Argument Name	Description	Required
victim_asset_id	The ID of a specific victim asset to retrieve. If not specified, all victim assets will be retrieved.	Optional
filter	A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional
page	The page to take the results from. The first is 0. Default is 0.	Optional
limit	The maximum number of results that can be returned. Default is 50.	Optional

Context Output

Path	Type	Description
TC.VictimAsset.id	string	The ID of the victim asset.
TC.VictimAsset.type	string	The type of the victim asset.
TC.VictimAsset.victimId	string	The ID of the victim.
TC.VictimAsset.webLink	string	The web link of the victim asset.
TC.VictimAsset.phone	string	The phone number of the victim asset.
TC.VictimAsset.address	string	The address of the victim asset.
TC.VictimAsset.accountName	string	The account name of the victim asset.
TC.VictimAsset.addressType	string	The address type of the victim asset.
TC.VictimAsset.networkType	string	The network type of the victim asset.
TC.VictimAsset.socialNetwork	string	The social network of the victim asset.
TC.VictimAsset.website	string	The website of the victim asset.

Command example

!tc-list-victim-assets limit=1

Context Example

{
    "TC": {
        "VictimAsset": {
            "id": 740,
            "phone": "111111",
            "type": "Phone",
            "victimId": 660,
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=660"
        }
    }
}

Human Readable Output

Victim assets

id type victimId asset

740 Phone 660 111111

tc-list-victim-attributes

Retrieves victim attributes.

Base Command

tc-list-victim-attributes

Input

Argument Name	Description	Required
victim_attribute_id	The ID of a specific victim attribute to retrieve. If not specified, all victim attributes will be retrieved.	Optional
victim_id	The ID of a specific victim to retrieve its attributes.	Optional
filter	A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional
page	The page to take the results from. The first is 0. Default is 0.	Optional
limit	The maximum number of results that can be returned. Default is 50.	Optional

Context Output

Path	Type	Description
TC.VictimAttribute.dateAdded	string	The date that the victim attribute was added.
TC.VictimAttribute.default	string	Whether the attribute is the default attribute of its type for the victim to which it is added.
TC.VictimAttribute.id	string	The ID of the victim attribute.
TC.VictimAttribute.lastModified	string	The date that the victim attribute was last modified.
TC.VictimAttribute.pinned	string	Whether the victim attribute is pinned.
TC.VictimAttribute.type	string	The type of the victim attribute.
TC.VictimAttribute.value	string	The value of the victim attribute.
TC.VictimAttribute.createdBy.firstName	string	The first name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.id	string	The ID of the victim the attribute associated to.
TC.VictimAttribute.createdBy.lastName	string	The last name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.owner	string	The owner of the user who created the victim attribute.
TC.VictimAttribute.createdBy.pseudonym	string	The pseudonym of the user who created the victim attribute.
TC.VictimAttribute.createdBy.userName	string	The user name of the user who created the victim attribute.

Command example

!tc-list-victim-attributes limit=1

Context Example

{
    "TC": {
        "VictimAttribute": {
            "createdBy": {
                "firstName": "Demisto API",
                "id": 615,
                "lastName": "Demisto API",
                "owner": "Palo Alto Cortex XSOAR",
                "pseudonym": "APIUsersTest",
                "userName": "08265138623174323158"
            },
            "dateAdded": "2024-01-04T13:24:57Z",
            "default": false,
            "id": 134,
            "lastModified": "2024-01-04T13:24:57Z",
            "pinned": false,
            "type": "Description",
            "value": "test"
        }
    }
}

Human Readable Output

Victim attributes

id type value dateAdded

134 Description test 2024-01-04T13:24:57Z

tc-list-victims

Retrieves victims.

Base Command

tc-list-victims

Input

Argument Name	Description	Required
victim_id	The ID of a specific victim to retrieve. If not specified, all victims will be retrieved.	Optional
filter	A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.	Optional
include_assets	Whether to add victim’s assets metadata to the result. Possible values are: true, false. Default is false.	Optional
include_associated_groups	Whether to add victim’s associated groups metadata to the result. Possible values are: true, false. Default is false.	Optional
include_attributes	Whether to add victim’s attributes metadata to the result. Possible values are: true, false. Default is false.	Optional
include_security_labels	Whether to add victim’s security labels metadata to the result. Possible values are: true, false. Default is false.	Optional
include_all_metaData	Whether to add all victim metadata to the results. Possible values are: true, false. Default is false.	Optional
page	The page to take the results from. The first is 0. Default is 0.	Optional
limit	The maximum number of results that can be returned. Default is 50.	Optional

Context Output

Path	Type	Description
TC.Victim.id	Number	The victim’s ID.
TC.Victim.securityLabels.data.id	Number	The security label ID.
TC.Victim.securityLabels.data.name	String	The security label name.
TC.Victim.securityLabels.data.description	String	The security label description.
TC.Victim.securityLabels.data.color	String	The security label color.
TC.Victim.securityLabels.data.owner	String	The security label owner.
TC.Victim.securityLabels.data.dateAdded	Date	The security label date added.
TC.Victim.ownerId	Number	The victim’s owner ID.
TC.Victim.ownerName	String	The victim’s owner name.
TC.Victim.webLink	String	The victim’s web link.
TC.Victim.tags.data.id	Number	The victim’s tag ID.
TC.Victim.tags.data.name	String	The victim’s tag name.
TC.Victim.tags.data.lastUsed	Date	The victim’s tag last use.
TC.Victim.name	String	The victim’s name.
TC.Victim.description	String	The victim’s description.
TC.Victim.org	String	The victim’s organization.
TC.Victim.workLocation	String	The victim’s work location.
TC.Victim.nationality	String	The victim’s nationality.
TC.Victim.suborg	String	The victim’s sub-organization.
TC.Victim.assets.data.id	Number	The victim asset ID.
TC.Victim.assets.data.type	String	The victim asset type.
TC.Victim.assets.data.victimId	Number	The victim asset victim ID.
TC.Victim.assets.data.phone	String	The victim asset phone number.
TC.Victim.assets.data.webLink	String	The victim asset web link.
TC.Victim.assets.data.website	String	The victim asset website.
TC.Victim.assets.data.accountName	String	The victim asset account name.
TC.Victim.assets.data.networkType	String	The victim asset network type.
TC.Victim.assets.data.address	String	The victim asset address.
TC.Victim.assets.data.addressType	String	The victim asset address type.
TC.Victim.assets.data.socialNetwork	String	The victim asset social network.
TC.Victim.associatedGroups.id	Unknown	The victim’s associated group ID.
TC.Victim.attributes.data.id	Number	The victim attribute ID.
TC.Victim.attributes.data.dateAdded	Date	The victim attribute date added.
TC.Victim.attributes.data.type	String	The victim attribute type.
TC.Victim.attributes.data.value	String	The victim attribute value.
TC.Victim.attributes.data.source	String	The victim attribute source.
TC.Victim.attributes.data.createdBy.id	Number	The victim attribute creator ID.
TC.Victim.attributes.data.createdBy.userName	String	The victim attribute creator user name.
TC.Victim.attributes.data.createdBy.firstName	String	The victim attribute creator first name.
TC.Victim.attributes.data.createdBy.lastName	String	The victim attribute creator last name.
TC.Victim.attributes.data.createdBy.pseudonym	String	The victim attribute creator pseudonym.
TC.Victim.attributes.data.createdBy.owner	String	The victim attribute creator owner.
TC.Victim.attributes.data.lastModified	Date	The victim attribute last modified time.
TC.Victim.attributes.data.pinned	String	Whether the victim attribute is pinned.
TC.Victim.attributes.data.default	String	Whether the victim attribute is default.

Command example

!tc-list-victims limit=1

Context Example

{
    "TC": {
        "Victim": {
            "id": 663,
            "name": "nat",
            "ownerId": 271,
            "ownerName": "Palo Alto Cortex XSOAR",
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=663"
        }
    }
}

Human Readable Output

Victims

id name ownerName description org

663 nat Palo Alto Cortex XSOAR

tc-update-victim

Updates a victim.

Base Command

tc-update-victim

Input

Argument Name	Description	Required
victim_id	The ID of the victim.	Required
name	The name of the victim.	Optional
nationality	The nationality of the victim.	Optional
org	The organization of the victim.	Optional
sub_org	The sub-organization of the victim.	Optional
security_labels	A comma-separated list of the security labels to apply to the victim. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE, TLP:AMBER+STRICT, TLP:CLEAR.	Optional
tags	A comma-separated list of tags.	Optional
work_location	The work location of the victim.	Optional
asset_type	The asset type of the victim. Possible values are: EmailAddress, NetworkAccount, Phone, SocialNetwork, WebSite.	Optional
asset_value	The asset value of the victim.	Optional
asset_address_type	The asset address type. Relevant only when the asset_type is EmailAddress.	Optional
asset_network_type	The asset network type. Relevant only when the asset_type is NetworkAccount.	Optional
asset_social_network	The asset social network. Relevant only when the asset_type is SocialNetwork.	Optional
associated_groups_ids	A comma-separated list of group IDs to associate to the victim.	Optional
attribute_type	The attribute type to associate to the victim. Possible values are: Additional Analysis and Context, Description, External ID, Impact Description, Impact Score, Physical Address, Response Team & Staff involved, Source, Takedown Requests, Targeted Industry Sector, Title.	Optional
attribute_value	The attribute value to associate to the victim.	Optional
mode	The mode of the update operation. Relevant for associated groups, attributes, security labels and tags. Possible values are: append, delete, replace. Default is append.	Optional

Context Output

Path	Type	Description
TC.Victim.Name	string	The name of the victim.
TC.Victim.ownerId	string	The owner ID of the victim.
TC.Victim.id	string	The ID of the victim.
TC.Victim.ownerName	string	The owner name of the victim.
TC.Victim.webLink	string	The web link of the victim.
TC.Victim.description	string	The description of the victim.
TC.Victim.org	string	The organization of the victim.
TC.Victim.suborg	string	The sub-organization of the victim.
TC.Victim.workLocation	string	The work location of the victim.
TC.Victim.nationality	string	The nationality of the victim.

Command example

!tc-update-victim victim_id=668 mode=append attribute_type="Source" attribute_value="test"

Context Example

{
    "TC": {
        "Victim": {
            "id": 668,
            "name": "nat",
            "ownerId": 271,
            "ownerName": "Palo Alto Cortex XSOAR",
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=668"
        }
    }
}

Human Readable Output

Victim 668 was successfully updated.

tc-update-victim-asset

Updates a victim asset.

Base Command

tc-update-victim-asset

Input

Argument Name	Description	Required
victim_asset_id	The ID of the victim asset.	Required
asset_value	The asset value.	Required
asset_address_type	The asset address type. Relevant only when the asset_type is EmailAddress.	Optional
asset_network_type	The asset network type. Relevant only when the asset_type is NetworkAccount.	Optional
asset_social_network	The asset social network. Required only when the asset_type is SocialNetwork.	Optional

Context Output

Path	Type	Description
TC.VictimAsset.id	string	The ID of the victim asset.
TC.VictimAsset.type	string	The type of the victim asset.
TC.VictimAsset.victimId	string	The ID of the victim.
TC.VictimAsset.webLink	string	The web link of the victim asset.
TC.VictimAsset.phone	string	The phone number of the victim asset.
TC.VictimAsset.address	string	The address of the victim asset.
TC.VictimAsset.accountName	string	The account name of the victim asset.
TC.VictimAsset.addressType	string	The address type of the victim asset.
TC.VictimAsset.networkType	string	The network type of the victim asset.
TC.VictimAsset.socialNetwork	string	The social network of the victim asset.
TC.VictimAsset.website	string	The website of the victim asset.

Command example

!tc-update-victim-asset victim_asset_id=750 asset_value="11111"

Context Example

{
    "TC": {
        "VictimAsset": {
            "id": 750,
            "phone": "11111",
            "type": "Phone",
            "victimId": 669,
            "webLink": "https://threatconnect.com/auth/victim/victim.xhtml?victim=669"
        }
    }
}

Human Readable Output

Victim Asset 750 updated successfully for victim id: 669

tc-update-victim-attribute

Updates a victim attribute.

Base Command

tc-update-victim-attribute

Input

Argument Name	Description	Required
victim_attribute_id	The ID of the victim attribute.	Required
security_labels	A comma-separated list of the security labels to apply to the victim attribute. Possible values are: TLP:RED, TLP:GREEN, TLP:AMBER, TLP:WHITE, TLP:AMBER+STRICT, TLP:CLEAR.	Optional
attribute_value	The attribute value.	Required
source	The attribute source.	Optional

Context Output

Path	Type	Description
TC.VictimAttribute.dateAdded	string	The date that the victim attribute was added.
TC.VictimAttribute.default	string	Whether the attribute is the default attribute of its type for the victim to which it is added.
TC.VictimAttribute.id	string	The ID of the victim attribute.
TC.VictimAttribute.lastModified	string	The date that the victim attribute was last modified.
TC.VictimAttribute.pinned	string	Whether the victim attribute is pinned.
TC.VictimAttribute.type	string	The type of the victim attribute.
TC.VictimAttribute.value	string	The value of the victim attribute.
TC.VictimAttribute.createdBy.firstName	string	The first name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.id	string	The ID of the victim the attribute associated to.
TC.VictimAttribute.createdBy.lastName	string	The last name of the user who created the victim attribute.
TC.VictimAttribute.createdBy.owner	string	The owner of the user who created the victim attribute.
TC.VictimAttribute.createdBy.pseudonym	string	The pseudonym of the user who created the victim attribute.
TC.VictimAttribute.createdBy.userName	string	The user name of the user who created the victim attribute.

Command example

!tc-update-victim-attribute victim_attribute_id="132" attribute_value="test2"

Context Example

{
    "TC": {
        "VictimAttribute": {
            "createdBy": {
                "firstName": "Demisto API",
                "id": 615,
                "lastName": "Demisto API",
                "owner": "Palo Alto Cortex XSOAR",
                "pseudonym": "APIUsersTest",
                "userName": "test"
            },
            "dateAdded": "2024-01-04T09:14:16Z",
            "default": false,
            "id": 132,
            "lastModified": "2024-01-04T13:25:19Z",
            "pinned": false,
            "type": "Source",
            "value": "test2"
        }
    }
}

Human Readable Output

Victim attribute 132 was successfully updated.

tc-delete-victim-asset

Deletes a victim asset.

Base Command

tc-delete-victim-asset

Input

Argument Name	Description	Required
victim_asset_id	The ID of the victim asset.	Required

Context Output

There is no context output for this command.

Command example

!tc-delete-victim-asset victim_asset_id=738

Human Readable Output

Victim asset 738 was successfully deleted.

tc-delete-victim-attribute

Deletes a victim attribute.

Base Command

tc-delete-victim-attribute

Input

Argument Name	Description	Required
victim_attribute_id	The ID of the victim attribute.	Required

Context Output

There is no context output for this command.

Command example

!tc-delete-victim-attribute victim_attribute_id=110

Human Readable Output

Victim attribute 110 was successfully deleted.

tc-list-attribute-type

Retrieved all attribute types

Base Command

tc-list-attribute-type

Input

Argument Name	Description	Required
attribute_type_id	A specific attribute type to retrieve. If not specified, all attribute types will be retrieved.	Optional
page	The page to take the results from. The first is 0. Default is 0.	Optional
limit	The maximum number of results that can be returned. Default is 50.	Optional

Context Output

Path	Type	Description
TC.AttributeType.allowMarkdown	string	Whether the attribute type markdown allowed.
TC.AttributeType.description	string	The attribute type description.
TC.AttributeType.name	string	The attribute type name.
TC.AttributeType.errorMessage	string	The attribute type error message.
TC.AttributeType.id	string	The attribute type ID.
TC.AttributeType.maxSize	string	The attribute type maximum size.
TC.AttributeType.TC.AttributeType.validationRule.description	string	The attribute type validation rule description.
TC.AttributeType.TC.AttributeType.validationRule.id	string	The attribute type validation rule ID.
TC.AttributeType.TC.AttributeType.validationRule.name	string	The attribute type validation rule name.
TC.AttributeType.TC.AttributeType.validationRule.text	string	The attribute type validation rule text.
TC.AttributeType.TC.AttributeType.validationRule.type	string	The attribute type validation rule type.
TC.AttributeType.TC.AttributeType.validationRule.version	string	The attribute type validation rule version.

Command example

!tc-list-attribute-type limit=1

Context Example

{
    "TC": {
        "AttributeType": {
            "allowMarkdown": true,
            "description": "Describe the Course of Action Taken.",
            "errorMessage": "Please enter a valid Course of Action.",
            "id": 1,
            "maxSize": 500,
            "name": "Course of Action Taken"
        }
    }
}

Human Readable Output

Attribute types

id name description

1 Course of Action Taken Describe the Course of Action Taken.

tc-delete-victim

Deletes a victim.

Base Command

tc-delete-victim

Input

Argument Name	Description	Required
victim_id	The ID of the victim.	Required

Context Output

There is no context output for this command.

Command example

!tc-delete-victim victim_id=660

Human Readable Output

Victim 660 was successfully deleted.

Configuration parameters

baseUrl — Base Url (required)
accessId — Access ID
api_secret_key — Access ID (required)
defaultOrg — Default Organization
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
max_fetch — Maximum number of incidents to fetch
incidentType — Incident type
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
tags — Tags filter for the fetch
group_type — Group Type filter for the fetch
status — Status filter for the fetch
tql_filter — TQL Filter
fields — Incident Metadata
integrationReliability — Source Reliability (required)
rating — Rating Threshold for Malicious Indicators
confidence — Confidence Threshold for Malicious Indicators
freshness — Indicator Reputation Freshness in days

Commands (55)

domain
Searches for an indicator of type domain.
file
Searches for an indicator of type file.
ip
Searches for an indicator of type IP address.
tc-add-group-attribute Deprecated
Deprecated. Use the tc-update-group command.
tc-add-group-security-label Deprecated
Deprecated. Use the tc-update-group command.
tc-add-group-tag
Adds tags to a specified group.
tc-add-indicator
Adds a new indicator to ThreatConnect.
tc-associate-group-to-group Deprecated
Deprecated. Use the tc-update-group command.
tc-create-campaign
Creates a group based on the Campaign type.
tc-create-document-group
Creates a document group.
tc-create-event
Creates a group based on the Event type.
tc-create-incident
Creates a new incident group.
tc-create-threat
Creates a group based on the "Threats" type.
tc-create-victim
Creates a victim.
tc-create-victim-asset
Creates a victim asset.
tc-create-victim-attribute
Creates a victim attribute.
tc-delete-group
Deletes a group.
tc-delete-indicator
Deletes an indicator from ThreatConnect.
tc-delete-indicator-tag
Removes a tag from a specified indicator.
tc-delete-victim
Deletes a victim.
tc-delete-victim-asset
Deletes a victim asset.
tc-delete-victim-attribute
Deletes a victim attribute.
tc-download-document
Downloads the contents of a document.
tc-download-report
The group report to download in PDF format.
tc-fetch-incidents Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-associated-groups
Returns groups associated with a specified group.
tc-get-events
Returns a list of events.
tc-get-group Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-group-attributes Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-group-indicators Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-group-security-labels Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-group-tags Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-groups Deprecated
Deprecated. Use the tc-list-groups command.
tc-get-incident-associate-indicators
Returns indicators that are related to a specific incident.
tc-get-indicator
Retrieves information about an indicator.
tc-get-indicator-owners
Get the owner for an indicator.
tc-get-indicator-types
Returns all indicator types available.
tc-get-indicators-by-tag
Fetches all indicators that have a tag.
tc-get-tags
Returns a list of all ThreatConnect tags.
tc-group-associate-indicator Deprecated
Deprecated. Use the tc-update-group command.
tc-incident-associate-indicator
Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.
tc-indicators
Retrieves a list of all indicators.
tc-list-attribute-type
Retrieved all attribute types.
tc-list-groups
Returns all groups.
tc-list-victim-assets
Retrieves victim assets.
tc-list-victim-attributes
Retrieves victim attributes.
tc-list-victims
Retrieves victims.
tc-owners
Retrieves all owners for the current account.
tc-tag-indicator
Adds a tag to an existing indicator.
tc-update-group
Updates a group.
tc-update-indicator
Updates the indicator in ThreatConnect.
tc-update-victim
Updates a victim.
tc-update-victim-asset
Updates a victim asset.
tc-update-victim-attribute
Updates a victim attribute.
url
Searches for an indicator of type URL.

Source

ThreatConnectV3.py ThreatConnectV3_test.py ThreatConnectV3.yml ThreatConnectV3_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Dataminr
commonfields:
  id: ThreatConnect v3
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.threatconnect.com
  display: Base Url
  name: baseUrl
  required: true
  type: 0
  section: Connect
- display: Access ID
  name: accessId
  type: 0
  hidden: true
  required: false
  section: Connect
- additionalinfo: The API credentials
  display: Access ID
  displaypassword: Secret key
  name: api_secret_key
  type: 9
  required: true
  section: Connect
- display: Default Organization
  name: defaultOrg
  type: 0
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch
  type: 0
  required: true
  section: Collect
- name: max_fetch
  display: Maximum number of incidents to fetch
  type: 0
  defaultvalue: '200'
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  required: false
  section: Collect
- additionalinfo: Free text box to add comma-separated tags to filter the fetched incidents by.
  display: Tags filter for the fetch
  name: tags
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: The group type to filter the fetched incidents by.
  defaultvalue: Incident
  display: Group Type filter for the fetch
  name: group_type
  options:
  - Incident
  - Event
  type: 16
  required: false
  section: Collect
  advanced: true
- additionalinfo: The status to filter the fetched incidents by (if not, the field will fetch all statuses).
  display: Status filter for the fetch
  name: status
  options:
  - Deleted
  - Rejected
  - Closed
  - Incident Reported
  - Restoration Achieved
  - Containment Achieved
  - Stalled
  - Open
  - New
  - Escalated
  - No Further Action
  - False Positive
  - Needs Review
  type: 16
  required: false
  section: Collect
  advanced: true
- additionalinfo: A free text TQL filter to apply to the fetch. This filter is added as an AND to the other filters. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
  display: TQL Filter
  name: tql_filter
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: The metadata to collect.
  display: Incident Metadata
  name: fields
  options:
  - associatedGroups
  - associatedIndicators
  - tags
  - securityLabels
  - associatedVictimAssets
  - attributes
  type: 16
  required: false
  section: Collect
  advanced: true
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
  advanced: true
- additionalinfo: Rating Threshold for Malicious Indicators. This is necessary to calculate reputation.
  defaultvalue: '3'
  display: Rating Threshold for Malicious Indicators
  name: rating
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: Confidence Threshold for Malicious Indicators. This is necessary to calculate reputation.
  defaultvalue: '50'
  display: Confidence Threshold for Malicious Indicators
  name: confidence
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: Indicator Reputation Freshness, it is necessary to calculate reputation.
  defaultvalue: '7'
  display: Indicator Reputation Freshness in days
  name: freshness
  type: 0
  required: false
  section: Collect
  advanced: true
description: ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
display: ThreatConnect v3
name: ThreatConnect v3
script:
  commands:
  - arguments:
    - default: true
      description: A comma-separated list of IPv4 or IPv6 addresses.
      name: ip
      required: true
      isArray: true
    - description: A comma-separated list of a client's organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.
      name: owners
    - description: A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
      name: ratingThreshold
    - description: A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
      name: confidenceThreshold
    description: Searches for an indicator of type IP address.
    name: ip
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: A comma-separated list of URLs for which to search. For example, "www.demisto.com".
      name: url
      required: true
      isArray: true
    - description: A comma-separated list of a client's organizations, sources, or communities to which a client’s API user has been granted permission. For example, "owner1", "owner2", or "owner3".
      name: owners
    - description: A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
      name: ratingThreshold
    - description: A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
      name: confidenceThreshold
    description: Searches for an indicator of type URL.
    name: url
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: string
    - contextPath: URL.Data
      description: The data of the URL indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: A comma-separated list of the hashes of the files. Can be "MD5", "SHA-1", or "SHA-256".
      name: file
      required: true
      isArray: true
    - description: A comma-separated list of a client's organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.
      name: owners
    - description: A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
      name: ratingThreshold
    - description: A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
      name: confidenceThreshold
    description: Searches for an indicator of type file.
    name: file
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the indicator.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the indicator.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the indicator.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments: []
    description: Retrieves all owners for the current account.
    name: tc-owners
    outputs:
    - contextPath: TC.Owner.Name
      description: The name of the owner.
      type: string
    - contextPath: TC.Owner.ID
      description: The ID of the owner.
      type: string
    - contextPath: TC.Owner.Type
      description: The type of the owner.
      type: string
  - arguments:
    - description: A comma-separated list of results filtered by the owner of the indicator.
      name: owner
    - description: The page to take the results from.
      name: page
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
    - name: fields_to_return
      description: 'Comma separated list of additional fields to return as part of the result indicator metadata. Possible values are: associatedGroups, associatedIndicators, observations, tags, and attributes.'
      isArray: true
    - description: A free text TQL filter to apply to the indicators query. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
    description: Retrieves a list of all indicators.
    name: tc-indicators
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: string
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The name of the domain.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - description: The page to take the results from.
      name: page
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
    - description: The name of the tag to get.
      name: name
    description: Returns a list of all ThreatConnect tags.
    name: tc-get-tags
    outputs:
    - contextPath: TC.Tags
      description: A list of tags.
      type: Unknown
  - arguments:
    - description: The name of the tag.
      name: tag
      required: true
    - description: The indicator to tag. For example, for an IP indicator, "8.8.8.8".
      name: indicator
      required: true
    description: Adds a tag to an existing indicator.
    name: tc-tag-indicator
  - arguments:
    - default: true
      description: The ID of the indicator by which to search.
      name: indicator
      required: true
    - name: fields_to_return
      description: 'Comma separated list of additional fields to return as part of the result indicator metadata. Possible values are: associatedGroups, associatedIndicators, observations, tags, and attributes.'
      isArray: true
    description: Retrieves information about an indicator.
    name: tc-get-indicator
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.IndicatorAttributes.dateAdded
      description: The date the indicator attribute was added.
      type: date
    - contextPath: TC.Indicator.IndicatorAttributes.displayed
      description: Whether to display the indicator attributes on ThreatConnect.
      type: boolean
    - contextPath: TC.Indicator.IndicatorAttributes.id
      description: The ID of the attribute.
      type: number
    - contextPath: TC.Indicator.IndicatorAttributes.lastModified
      description: The date the indicator attribute was last modified.
      type: date
    - contextPath: TC.Indicator.IndicatorAttributes.type
      description: The name of the attribute.
      type: string
    - contextPath: TC.Indicator.IndicatorAttributes.value
      description: The contents of the attribute.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the indicator of the URL.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The domain name of the indicator.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: The name of the tag by which to filter the results.
      name: tag
      required: true
    - description: A comma-separated list of indicators filtered by the owner.
      name: owner
    - description: The page to take the results from.
      name: page
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
    - name: fields_to_return
      description: 'Comma separated list of additional fields to return as part of the result indicator metadata. Possible values are: associatedGroups, associatedIndicators, observations, tags, and attributes.'
      isArray: true
    - description: The comparison operator to use when filtering by tag. Default is LIKE (pattern matching). Use EQ for exact match.
      name: operator
      defaultValue: LIKE
      auto: PREDEFINED
      predefined:
      - LIKE
      - EQ
      - NE
      - CONTAINS
      - STARTSWITH
      - ENDSWITH
      - IN
    description: Fetches all indicators that have a tag.
    name: tc-get-indicators-by-tag
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the tagged indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the tagged indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the tagged indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the tagged indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the tagged indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the tagged indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the tagged indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the tagged indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the tagged indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: The IP address of the tagged indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the tagged indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The domain name of the tagged indicator.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - description: The indicator to add.
      name: indicator
      required: true
    - auto: PREDEFINED
      description: The type of the indicator.
      name: indicatorType
      predefined:
      - Address
      - Agent
      - User
      - Registry Key
      - Mutex
      - Hashtag
      - Email Subject
      - Subject
      - Email
      - CIDR
      - Host
      - URL
      - ASN
      - File
      - EmailAddress
      required: true
    - auto: PREDEFINED
      description: The type of hash for the file indicator.
      name: hashType
      predefined:
      - md5
      - sha1
      - sha256
    - description: The threat rating of the indicator. Can be "0" - "Unknown", "1" - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
      name: rating
    - description: The confidence rating of the indicator. Can be "0%" - "Unknown," "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
      name: confidence
    - description: A comma-separated list of the tags to apply to the campaign.
      name: tags
    - description: The description of the indicator.
      name: description
    - description: The name of the owner to which the Indicator belongs.
      name: owner
    description: Adds a new indicator to ThreatConnect.
    name: tc-add-indicator
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the added indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the added indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The name of the added indicator of the domain.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: The name of the incident group.
      name: incidentName
      required: true
    - description: The creation time of an incident in the "2017-03-21T00:00:00Z" format.
      name: eventDate
    - description: A comma-separated list of the tags applied to the incident.
      name: tag
    - auto: PREDEFINED
      description: The security label applied to the incident.
      name: securityLabel
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: The description of the incident.
      name: description
    description: Creates a new incident group.
    name: tc-create-incident
    outputs:
    - contextPath: TC.Incident.Name
      description: The name of the new incident group.
      type: string
    - contextPath: TC.Incident.Owner
      description: The owner of the new incident.
      type: string
    - contextPath: TC.Incident.EventDate
      description: The date on which the event that indicates an incident occurred.
      type: date
    - contextPath: TC.Incident.Tag
      description: The name of the tag of the new incident.
      type: string
    - contextPath: TC.Incident.SecurityLabel
      description: The security label of the new incident.
      type: string
    - contextPath: TC.Incident.ID
      description: The ID of the new incident.
      type: Unknown
  - arguments:
    - default: true
      description: The fetched incidents filtered by ID.
      name: incidentId
    - description: The fetched incidents filtered by owner.
      name: owner
    - description: The page to take the results from.
      name: page
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-fetch-incidents
    outputs:
    - contextPath: TC.Incident
      description: The name of the group of fetched incidents.
      type: string
    - contextPath: TC.Incident.ID
      description: The ID of the fetched incidents.
      type: string
    - contextPath: TC.Incident.Owner
      description: The owner of the fetched incidents.
      type: string
  - arguments:
    - description: The ID of the incident to which the indicator is associated.
      name: incidentId
      required: true
    - default: true
      description: The ID of the indicator.
      name: indicator
      required: true
    description: Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.
    name: tc-incident-associate-indicator
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the associated indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the associated indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: IP.Address
      description: IP address of the associated indicator of the file.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the associated indicator of the file.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The name of the indicator of the domain.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: A comma-separated list of names of the domain.
      name: domain
      required: true
      isArray: true
    - description: A comma-separated list of a client's organizations, sources, or communities to which a user has permissions. For example, users with admin permissions can search for indicators belonging to all owners.
      name: owners
    - description: A comma-separated list of results filtered by indicators whose threat rating is greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
      name: ratingThreshold
    - description: A comma-separated list of results filtered by indicators whose confidence rating is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
      name: confidenceThreshold
    description: Searches for an indicator of type domain.
    name: domain
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the domain.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the domain.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the domain.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the domain.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator of the domain was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator of the domain was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the domain.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the domain.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: The name of the domain.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - default: true
      description: The ID of the incident.
      name: incidentId
      required: true
    description: Returns indicators that are related to a specific incident.
    name: tc-get-incident-associate-indicators
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the returned indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the returned indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the returned indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the returned indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the returned indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the returned indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the returned indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the returned indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the returned indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: The IP address of the returned indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the returned indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The name of the domain.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
  - arguments:
    - description: The name of the updated indicator.
      name: indicator
      required: true
    - description: The threat rating of the updated indicator.
      name: rating
    - description: The confidence rating of the updated indicator.
      name: confidence
    - description: The size of the file of the updated indicator.
      name: size
    - auto: PREDEFINED
      description: Whether the DNS indicator is active (only for hosts).
      name: dnsActive
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Whether the indicator is active (only for hosts).
      name: whoisActive
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: The security label applied to the incident.
      name: securityLabel
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: A comma-separated list of tags.
      name: tags
    description: Updates the indicator in ThreatConnect.
    name: tc-update-indicator
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The domain name of the indicator.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - description: The ID of the indicator from which to remove a tag.
      name: indicator
      required: true
    - description: The name of the tag to remove from the indicator.
      name: tag
      required: true
    description: Removes a tag from a specified indicator.
    name: tc-delete-indicator-tag
    outputs:
    - contextPath: TC.Indicator.Name
      description: The name of the indicator.
      type: string
    - contextPath: TC.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Indicator.ID
      description: The ID of the indicator.
      type: string
    - contextPath: TC.Indicator.Description
      description: The description of the indicator.
      type: string
    - contextPath: TC.Indicator.Owner
      description: The owner of the indicator.
      type: string
    - contextPath: TC.Indicator.CreateDate
      description: The date the indicator was created.
      type: date
    - contextPath: TC.Indicator.LastModified
      description: The date the indicator was last modified.
      type: date
    - contextPath: TC.Indicator.Rating
      description: The threat rating of the indicator.
      type: number
    - contextPath: TC.Indicator.Confidence
      description: The confidence rating of the indicator.
      type: number
    - contextPath: TC.Indicator.WhoisActive
      description: The active indicator (for domains only).
      type: string
    - contextPath: TC.Indicator.File.MD5
      description: The MD5 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA1
      description: The SHA1 hash of the indicator of the file.
      type: string
    - contextPath: TC.Indicator.File.SHA256
      description: The SHA256 hash of the indicator of the file.
      type: string
    - contextPath: IP.Address
      description: The IP address of the indicator.
      type: string
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the full description.
      type: string
    - contextPath: URL.Data
      description: The data of the URL of the indicator.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the full description.
      type: string
    - contextPath: Domain.Name
      description: The domain name of the indicator.
      type: string
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the full description.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the full description.
      type: string
    - contextPath: TC.Indicator.WebLink
      description: The web link of the indicator.
      type: string
  - arguments:
    - description: The ID of the indicator to delete.
      name: indicator
      required: true
    description: Deletes an indicator from ThreatConnect.
    name: tc-delete-indicator
  - arguments:
    - description: The name of the campaign group.
      name: name
      required: true
    - description: The date the campaign was first seen.
      name: firstSeen
    - description: The description of the campaign.
      name: description
    - description: Comma-separated list of the tags to apply to the campaign.
      name: tag
    - auto: PREDEFINED
      description: The security label applied to the incident.
      name: securityLabel
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    description: Creates a group based on the Campaign type.
    name: tc-create-campaign
    outputs:
    - contextPath: TC.Campaign.Name
      description: The name of the campaign.
      type: string
    - contextPath: TC.Campaign.Owner
      description: The owner of the campaign.
      type: string
    - contextPath: TC.Campaign.FirstSeen
      description: The date the campaign was first seen.
      type: date
    - contextPath: TC.Campaign.Tag
      description: The tag of the campaign.
      type: string
    - contextPath: TC.Campaign.SecurityLevel
      description: The security label of the campaign.
      type: string
    - contextPath: TC.Campaign.ID
      description: The ID of the campaign.
      type: string
  - arguments:
    - description: The name of the event group.
      name: name
      required: true
    - description: The date the event occurred. If the date is not specified, the current date is used.
      name: eventDate
    - auto: PREDEFINED
      description: The status of the event.
      name: status
      predefined:
      - Needs Review
      - False Positive
      - No Further Action
      - Escalated
    - description: The name of the owner to which the group belongs. By default, events will be created in the organization in which the API user account resides.
      name: owner_name
    - description: A comma-separated list of the tags of the event.
      name: tag
    description: Creates a group based on the Event type.
    name: tc-create-event
    outputs:
    - contextPath: TC.Event.Name
      description: The name of the event.
      type: string
    - contextPath: TC.Event.Date
      description: The date of the event.
      type: date
    - contextPath: TC.Event.Status
      description: The status of the event.
      type: string
    - contextPath: TC.Event.Owner
      description: The owner of the event.
      type: string
    - contextPath: TC.Event.Tag
      description: The tag of the event.
      type: string
    - contextPath: TC.Event.ID
      description: The ID of the event.
      type: string
    - contextPath: TC.Event.Type
      description: The type of the event.
      type: string
  - arguments:
    - default: true
      description: The name of the threat group.
      name: name
      required: true
    - description: The creation time of a threat in the "2017-03-21T00:00:00Z" format.
      name: eventDate
    - description: A comma-separated list of the tags applied to the threat.
      name: tags
    - auto: PREDEFINED
      description: The security label applied to the threat.
      name: securityLabel
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: The description of the threat.
      name: description
    description: Creates a group based on the "Threats" type.
    name: tc-create-threat
    outputs:
    - contextPath: TC.Threat.Name
      description: The name of the threat.
      type: string
    - contextPath: TC.Threat.ID
      description: The ID of the threat.
      type: string
  - arguments:
    - description: A comma-separated list of the IDs of the groups to delete.
      name: groupID
      required: true
    description: Deletes a group.
    name: tc-delete-group
  - arguments:
    - description: The ID of the group to which to add attributes. To get the ID of the group, run the tc-list-groups command.
      name: group_id
      required: true
    - description: The type of attribute to add to the group. The type is located in the UI in a specific group or under Org Config.
      name: attribute_type
      required: true
    - description: The value of the attribute.
      name: attribute_value
      required: true
    deprecated: true
    description: Deprecated. Use the tc-update-group command.
    name: tc-add-group-attribute
    outputs:
    - contextPath: TC.Group.DateAdded
      description: The date the attribute was added.
      type: Date
    - contextPath: TC.Group.LastModified
      description: The date the added attribute was last modified.
      type: Date
    - contextPath: TC.Group.Type
      description: The type of the group to which the attribute was added.
      type: String
    - contextPath: TC.Group.Value
      description: The value of the attribute added to the group.
      type: String
    - contextPath: TC.Group.ID
      description: The group ID to which the attribute was added.
      type: Number
  - arguments:
    - description: The date to retrieve groups from in the yyyy-mm-dd format, e.g., 1111-11-11.
      name: fromDate
      type: string
    - description: The tag to retrieve groups by.
      name: tag
      type: string
    - description: The page to take the results from.
      name: page
      type: string
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
      type: string
    - description: A comma-separated list of IDs to filter the groups by.
      name: id
      type: string
    - description: A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
      type: string
    description: Returns a list of events.
    name: tc-get-events
    outputs:
    - contextPath: TC.Event.DateAdded
      description: The date the event was added.
      type: Date
    - contextPath: TC.Event.EventDate
      description: The date the event occurred.
      type: Date
    - contextPath: TC.Event.ID
      description: The ID of the event.
      type: Number
    - contextPath: TC.Event.OwnerName
      description: The name of the owner of the event.
      type: String
    - contextPath: TC.Event.Status
      description: The status of the event.
      type: String
    - contextPath: TC.Event.AssociatedGroups
      description: The associated groups for the event.
      type: String
    - contextPath: TC.Event.AssociatedIndicators
      description: The associated indicators for the event.
      type: String
    - contextPath: TC.Event.Tags
      description: The tags of the event.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The type of the group.
      name: group_type
      predefined:
      - Adversary
      - Attack Pattern
      - Campaign
      - Course of Action
      - Document
      - E-mail
      - Event
      - Incident
      - Intrusion Set
      - Malware
      - Report
      - Signature
      - Tactic
      - Task
      - Threat
      - Tool
      - Vulnerability
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-groups
    outputs:
    - contextPath: TC.Group.DateAdded
      description: The date the group was added.
      type: Date
    - contextPath: TC.Group.EventDate
      description: The date the event occurred.
      type: Date
    - contextPath: TC.Group.Name
      description: The name of the group.
      type: String
    - contextPath: TC.Group.OwnerName
      description: The name of the owner of the group.
      type: String
    - contextPath: TC.Group.Status
      description: The status of the group.
      type: String
    - contextPath: TC.Group.ID
      description: The ID of the group.
      type: Number
  - arguments:
    - auto: PREDEFINED
      description: The type of the group.
      name: group_type
      predefined:
      - Adversary
      - Attack Pattern
      - Campaign
      - Course of Action
      - Document
      - E-mail
      - Event
      - Incident
      - Intrusion Set
      - Malware
      - Report
      - Signature
      - Tactic
      - Task
      - Threat
      - Tool
      - Vulnerability
    - description: The date to retrieve groups from in the yyyy-mm-dd format, e.g., 1111-11-11.
      name: fromDate
      type: string
    - description: The tag to retrieve groups by.
      name: tag
      type: string
    - description: The page to take the results from.
      name: page
      type: string
    - description: The maximum number of results that can be returned. The default is 500.
      name: limit
      type: string
    - description: A comma-separated list of IDs to filter the groups by.
      name: id
      type: string
    - description: A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
      type: string
    - description: Add group tags metadata to the results.
      name: include_tags
    - description: Add group security labels metadata to the results.
      name: include_security_labels
    - description: Add group attributes metadata to the results.
      name: include_attributes
    - description: Add group associated groups metadata to the results.
      name: include_associated_groups
    - description: Add group associated indicators metadata to the results.
      name: include_associated_indicators
    - description: Add all group metadata to the results.
      name: include_all_metaData
    description: Returns all groups.
    name: tc-list-groups
    outputs:
    - contextPath: TC.Group.DateAdded
      description: The date the group was added.
      type: Date
    - contextPath: TC.Group.EventDate
      description: The date the event occurred.
      type: Date
    - contextPath: TC.Group.Name
      description: The name of the group.
      type: String
    - contextPath: TC.Group.OwnerName
      description: The name of the owner of the group.
      type: String
    - contextPath: TC.Group.Status
      description: The status of the group.
      type: String
    - contextPath: TC.Group.ID
      description: The ID of the group.
      type: Number
  - arguments:
    - description: The ID of the group to which to add the security label. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    - auto: PREDEFINED
      description: The security label applied to the document.
      name: security_label_name
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
      required: true
    deprecated: true
    description: Deprecated. Use the tc-update-group command.
    name: tc-add-group-security-label
  - arguments:
    - description: The ID of the group to which to add the tag. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    - description: The name of the tag to add to the group.
      name: tag_name
      required: true
    description: Adds tags to a specified group.
    name: tc-add-group-tag
  - arguments: []
    description: Returns all indicator types available.
    name: tc-get-indicator-types
    outputs:
    - contextPath: TC.IndicatorType.ApiBranch
      description: The branch of the API.
      type: String
    - contextPath: TC.IndicatorType.ApiEntity
      description: The entity of the API.
      type: String
    - contextPath: TC.IndicatorType.CasePreference
      description: 'The case preference of the indicator. For example, "sensitive", "upper", or "lower".'
      type: String
    - contextPath: TC.IndicatorType.Custom
      description: Whether the indicator is a custom indicator.
      type: Boolean
    - contextPath: TC.IndicatorType.Parsable
      description: Whether the indicator can be parsed.
      type: Boolean
    - contextPath: TC.IndicatorType.Value1Type
      description: The value type of the indicator.
      type: String
    - contextPath: TC.IndicatorType.Value1Label
      description: The value label of the indicator.
      type: String
  - arguments:
    - description: The name/ID of the indicator.
      name: indicator
      required: true
    - description: The ID of the group. To get the ID of the group, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-update-group command.
    name: tc-group-associate-indicator
    outputs:
    - contextPath: TC.Group.GroupID
      description: The ID of the group.
      type: Number
    - contextPath: TC.Group.Indicator
      description: The name of the indicator.
      type: String
  - arguments:
    - description: The name of the file to display in the UI.
      name: file_name
      required: true
    - description: The name of the group.
      name: name
      required: true
    - auto: PREDEFINED
      description: Whether the file is malware. If "true", ThreatConnect creates a password-protected ZIP file on your local machine that contains the sample and uploads the ZIP file.
      name: malware
      predefined:
      - 'True'
      - 'False'
    - description: The password of the ZIP file.
      name: password
    - auto: PREDEFINED
      description: The security label applied to the document.
      name: security_label
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: A description of the group.
      name: description
    - description: The ID of the entry, as displayed in the War Room.
      name: entry_id
      required: true
    description: Creates a document group.
    name: tc-create-document-group
    outputs:
    - contextPath: TC.Group.Name
      description: The name of the group.
      type: String
    - contextPath: TC.Group.Owner
      description: The owner of the group.
      type: String
    - contextPath: TC.Group.EventDate
      description: The date the group was created.
      type: Date
    - contextPath: TC.Group.Description
      description: The description of the group.
      type: String
    - contextPath: TC.Group.SecurityLabel
      description: The security label of the group.
      type: String
    - contextPath: TC.Group.ID
      description: The ID of the group to which the attribute was added.
      type: Number
  - arguments:
    - description: The ID of the group to retrieve. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-group
    outputs:
    - contextPath: TC.Group.DateAdded
      description: The date the group was added.
      type: Date
    - contextPath: TC.Group.EventDate
      description: The date the event occurred.
      type: Date
    - contextPath: TC.Group.Name
      description: The name of the group.
      type: String
    - contextPath: TC.Group.Owner.ID
      description: The ID of the group owner.
      type: Number
    - contextPath: TC.Group.Owner.Name
      description: The name of the group owner.
      type: String
    - contextPath: TC.Group.Owner.Type
      description: The type of the owner.
      type: String
    - contextPath: TC.Group.Status
      description: The status of the group.
      type: String
  - arguments:
    - description: The ID of the group for which to return the attribute. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-group-attributes
    outputs:
    - contextPath: TC.Group.Attribute.DateAdded
      description: The date the group was added.
      type: Date
    - contextPath: TC.Group.Attribute.Displayed
      description: Whether the attribute is displayed on the UI.
      type: Boolean
    - contextPath: TC.Group.Attribute.AttributeID
      description: The ID of the attribute.
      type: Number
    - contextPath: TC.Group.Attribute.LastModified
      description: The date the attribute was last modified.
      type: Date
    - contextPath: TC.Group.Attribute.Type
      description: The type of the attribute.
      type: String
    - contextPath: TC.Group.Attribute.Value
      description: The value of the attribute.
      type: String
  - arguments:
    - description: The ID of the group for which to return the security labels. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-group-security-labels
    outputs:
    - contextPath: TC.Group.SecurityLabel.Name
      description: The name of the security label.
      type: String
    - contextPath: TC.Group.SecurityLabel.Description
      description: The description of the security label.
      type: String
    - contextPath: TC.Group.SecurityLabel.DateAdded
      description: The date the security label was added.
      type: Date
  - arguments:
    - description: The ID of the group for which to return the tags. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-group-tags
    outputs:
    - contextPath: TC.Group.Tag.Name
      description: The name of the tag.
      type: String
  - arguments:
    - description: The ID of the document.
      name: document_id
      required: true
    description: Downloads the contents of a document.
    name: tc-download-document
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The ssdeep hash of the file (same as displayed in file entries).
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: The information of the file.
      type: String
    - contextPath: File.Type
      description: The type of the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - description: The ID of the group for which to return the indicators. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-list-groups command.
    name: tc-get-group-indicators
    outputs:
    - contextPath: TC.Group.Indicator.Summary
      description: The summary of the indicator.
      type: String
    - contextPath: TC.Group.Indicator.ThreatAssessConfidence
      description: The confidence rating of the indicator.
      type: string
    - contextPath: TC.Group.Indicator.IndicatorID
      description: The ID of the indicator.
      type: Number
    - contextPath: TC.Group.Indicator.DateAdded
      description: The date the indicator was added.
      type: Date
    - contextPath: TC.Group.Indicator.Type
      description: The type of the indicator.
      type: string
    - contextPath: TC.Group.Indicator.Rating
      description: The threat rating of the indicator.
      type: Number
    - contextPath: TC.Group.Indicator.ThreatAssertRating
      description: The rating of the threat assert.
      type: Number
    - contextPath: TC.Group.Indicator.OwnerName
      description: The name of the owner of the indicator.
      type: string
    - contextPath: TC.Group.Indicator.LastModified
      description: The date the indicator was last modified.
      type: Date
  - arguments:
    - description: The ID of the group. To get the ID, run the tc-list-groups command.
      name: group_id
      required: true
    description: Returns groups associated with a specified group.
    name: tc-get-associated-groups
    outputs:
    - contextPath: TC.Group.AssociatedGroup.DateAdded
      description: The date the group was added.
      type: Date
    - contextPath: TC.Group.AssociatedGroup.GroupID
      description: The ID of the group.
      type: Number
    - contextPath: TC.Group.AssociatedGroup.Name
      description: The name of the group.
      type: String
    - contextPath: TC.Group.AssociatedGroup.OwnerName
      description: The name of the owner of the group.
      type: String
    - contextPath: TC.Group.AssociatedGroup.Type
      description: The type of the group.
      type: String
  - arguments:
    - description: The ID of the group. To get the ID of the group, run the tc-list-groups command.
      name: group_id
      required: true
    - description: The ID of the group to associate.
      name: associated_group_id
      required: true
    deprecated: true
    description: Deprecated. Use the tc-update-group command.
    name: tc-associate-group-to-group
    outputs:
    - contextPath: TC.Group.AssociatedGroup.AssociatedGroupID
      description: The ID of the associated group.
      type: Number
    - contextPath: TC.Group.AssociatedGroup.GroupID
      description: The ID of the group to associate to.
      type: Number
  - arguments:
    - description: Indicator ID.
      name: indicator
      required: true
    description: Get the owner for an indicator.
    name: tc-get-indicator-owners
  - arguments:
    - description: The ID of the group.
      name: group_id
      required: true
    description: The group report to download in PDF format.
    name: tc-download-report
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The ssdeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: The information of the file.
      type: String
    - contextPath: File.Type
      description: The type of the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - default: true
      description: The ID of the group.
      name: id
      required: true
    - description: Custom fields for the group.
      name: custom_field
    - description: A comma-separated list of The tags applied to the threat.
      name: tags
    - auto: PREDEFINED
      description: The security label applied to the threat.
      name: security_label
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: An ID to associate a group by.
      name: associated_group_id
    - description: An ID of a victim to associate to the group.
      name: associated_victim_asset_id
    - description: An ID to associate an indicator by.
      name: associated_indicator_id
    - auto: PREDEFINED
      description: The type of update to the group metadata(associated indicators, attributes,tags etc.).
      name: mode
      predefined:
      - append
      - delete
      - replace
    - description: The value of the attribute to associate.
      name: attribute_value
    - description: The type of the attribute to associate.
      name: attribute_type
    description: Updates a group.
    name: tc-update-group
    outputs:
    - contextPath: TC.Group.Name
      description: The name of the group.
      type: string
    - contextPath: TC.Group.Owner
      description: The owner of the group.
      type: string
    - contextPath: TC.Group.Tag
      description: The tag of the group.
      type: string
    - contextPath: TC.Group.SecurityLevel
      description: The security label of the group.
      type: string
    - contextPath: TC.Group.ID
      description: The ID of the group.
      type: string
  - arguments:
    - default: true
      description: The name of the victim.
      name: name
      required: true
    - description: The nationality of the victim.
      name: nationality
    - description: The organization of the victim.
      name: org
    - description: The sub-organization of the victim.
      name: sub_org
    - auto: PREDEFINED
      description: A comma-separated list of the security labels to apply to the victim.
      name: security_labels
      isArray: true
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: A comma-separated list of tags.
      name: tags
      isArray: true
    - description: The work location of the victim.
      name: work_location
    - auto: PREDEFINED
      description: The asset type of the victim.
      name: asset_type
      predefined:
      - EmailAddress
      - NetworkAccount
      - Phone
      - SocialNetwork
      - WebSite
    - description: The asset value of the victim.
      name: asset_value
    - description: The asset address type. Relevant only when the asset_type is EmailAddress.
      name: asset_address_type
    - description: The asset network type. Relevant only when the asset_type is NetworkAccount.
      name: asset_network_type
    - description: The asset social network. Required only when the asset_type is SocialNetwork.
      name: asset_social_network
    - description: A comma-separated list of group IDs to associate to the victim.
      name: associated_groups_ids
      isArray: true
    - auto: PREDEFINED
      description: The attribute type to associate to the victim.
      name: attribute_type
      predefined:
      - Additional Analysis and Context
      - Description
      - External ID
      - Impact Description
      - Impact Score
      - Physical Address
      - Response Team & Staff involved
      - Source
      - Takedown Requests
      - Targeted Industry Sector
      - Title
    - description: The attribute value to associate to the victim.
      name: attribute_value
    description: Creates a victim.
    name: tc-create-victim
    outputs:
    - contextPath: TC.Victim.Name
      description: The name of the victim.
      type: string
    - contextPath: TC.Victim.ownerId
      description: The ID of the owner of the victim.
      type: string
    - contextPath: TC.Victim.id
      description: The ID of the victim.
      type: string
    - contextPath: TC.Victim.ownerName
      description: The owner name of the victim.
      type: string
    - contextPath: TC.Victim.webLink
      description: The web link of the victim.
      type: string
    - contextPath: TC.Victim.description
      description: The description of the victim.
      type: string
    - contextPath: TC.Victim.org
      description: The organization of the victim.
      type: string
    - contextPath: TC.Victim.suborg
      description: The sub-organization of the victim.
      type: string
    - contextPath: TC.Victim.workLocation
      description: The work location of the victim.
      type: string
    - contextPath: TC.Victim.nationality
      description: The nationality of the victim.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim.
      name: victim_id
      required: true
    - description: The name of the victim.
      name: name
    - description: The nationality of the victim.
      name: nationality
    - description: The organization of the victim.
      name: org
    - description: The sub-organization of the victim.
      name: sub_org
    - auto: PREDEFINED
      description: A comma-separated list of the security labels to apply to the victim.
      name: security_labels
      isArray: true
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: A comma-separated list of tags.
      name: tags
      isArray: true
    - description: The work location of the victim.
      name: work_location
    - auto: PREDEFINED
      description: The asset type of the victim.
      name: asset_type
      predefined:
      - EmailAddress
      - NetworkAccount
      - Phone
      - SocialNetwork
      - WebSite
    - description: The asset value of the victim.
      name: asset_value
    - description: The asset address type. Relevant only when the asset_type is EmailAddress.
      name: asset_address_type
    - description: The asset network type. Relevant only when the asset_type is NetworkAccount.
      name: asset_network_type
    - description: The asset social network. Relevant only when the asset_type is SocialNetwork.
      name: asset_social_network
    - description: A comma-separated list of group IDs to associate to the victim.
      name: associated_groups_ids
      isArray: true
    - auto: PREDEFINED
      description: The attribute type to associate to the victim.
      name: attribute_type
      predefined:
      - Additional Analysis and Context
      - Description
      - External ID
      - Impact Description
      - Impact Score
      - Physical Address
      - Response Team & Staff involved
      - Source
      - Takedown Requests
      - Targeted Industry Sector
      - Title
    - description: The attribute value to associate to the victim.
      name: attribute_value
    - auto: PREDEFINED
      description: The mode of the update operation. Relevant for associated groups, attributes, security labels and tags.
      name: mode
      predefined:
      - append
      - delete
      - replace
      defaultValue: append
    description: Updates a victim.
    name: tc-update-victim
    outputs:
    - contextPath: TC.Victim.Name
      description: The name of the victim.
      type: string
    - contextPath: TC.Victim.ownerId
      description: The ID of the owner of the victim.
      type: string
    - contextPath: TC.Victim.id
      description: The ID of the victim.
      type: string
    - contextPath: TC.Victim.ownerName
      description: The ownerName of the victim.
      type: string
    - contextPath: TC.Victim.webLink
      description: The web link of the victim.
      type: string
    - contextPath: TC.Victim.description
      description: The description of the victim.
      type: string
    - contextPath: TC.Victim.org
      description: The organization of the victim.
      type: string
    - contextPath: TC.Victim.suborg
      description: The sub-organization of the victim.
      type: string
    - contextPath: TC.Victim.workLocation
      description: The work location of the victim.
      type: string
    - contextPath: TC.Victim.nationality
      description: The nationality of the victim.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim.
      name: victim_id
      required: true
    description: Deletes a victim.
    name: tc-delete-victim
  - arguments:
    - description: The ID of a specific victim to retrieve. If not specified, all victims will be retrieved.
      name: victim_id
    - description: A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
    - auto: PREDEFINED
      description: Whether to add victim's assets metadata to the result.
      name: include_assets
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - auto: PREDEFINED
      description: Whether to add victim's associated groups metadata to the result.
      name: include_associated_groups
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - auto: PREDEFINED
      description: Whether to add victim's attributes metadata to the result.
      name: include_attributes
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - auto: PREDEFINED
      description: Whether to add victim's security labels metadata to the result.
      name: include_security_labels
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - auto: PREDEFINED
      description: Whether to add all victim metadata to the results.
      name: include_all_metaData
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - description: The page to take the results from. The first is 0.
      name: page
      defaultValue: '0'
    - description: The maximum number of results that can be returned.
      name: limit
      defaultValue: '50'
    description: Retrieves victims.
    name: tc-list-victims
    outputs:
    - contextPath: TC.Victim.id
      description: The victim's ID.
      type: Number
    - contextPath: TC.Victim.securityLabels.data.id
      description: The security label ID.
      type: Number
    - contextPath: TC.Victim.securityLabels.data.name
      description: The security label name.
      type: String
    - contextPath: TC.Victim.securityLabels.data.description
      description: The security label description.
      type: String
    - contextPath: TC.Victim.securityLabels.data.color
      description: The security label color.
      type: String
    - contextPath: TC.Victim.securityLabels.data.owner
      description: The security label owner.
      type: String
    - contextPath: TC.Victim.securityLabels.data.dateAdded
      description: The security label date added.
      type: Date
    - contextPath: TC.Victim.ownerId
      description: The victim's owner ID.
      type: Number
    - contextPath: TC.Victim.ownerName
      description: The victim's owner name.
      type: String
    - contextPath: TC.Victim.webLink
      description: The victim's web link.
      type: String
    - contextPath: TC.Victim.tags.data.id
      description: The victim's tag ID.
      type: Number
    - contextPath: TC.Victim.tags.data.name
      description: The victim's tag name.
      type: String
    - contextPath: TC.Victim.tags.data.lastUsed
      description: The victim's tag last use.
      type: Date
    - contextPath: TC.Victim.name
      description: The victim's name.
      type: String
    - contextPath: TC.Victim.description
      description: The victim's description.
      type: String
    - contextPath: TC.Victim.org
      description: The victim's organization.
      type: String
    - contextPath: TC.Victim.workLocation
      description: The victim's work location.
      type: String
    - contextPath: TC.Victim.nationality
      description: The victim's nationality.
      type: String
    - contextPath: TC.Victim.suborg
      description: The victim's sub-organization.
      type: String
    - contextPath: TC.Victim.assets.data.id
      description: The victim asset ID.
      type: Number
    - contextPath: TC.Victim.assets.data.type
      description: The victim asset type.
      type: String
    - contextPath: TC.Victim.assets.data.victimId
      description: The victim asset victim ID.
      type: Number
    - contextPath: TC.Victim.assets.data.phone
      description: The victim asset phone number.
      type: String
    - contextPath: TC.Victim.assets.data.webLink
      description: The victim asset web link.
      type: String
    - contextPath: TC.Victim.assets.data.website
      description: The victim asset website.
      type: String
    - contextPath: TC.Victim.assets.data.accountName
      description: The victim asset account name.
      type: String
    - contextPath: TC.Victim.assets.data.networkType
      description: The victim asset network type.
      type: String
    - contextPath: TC.Victim.assets.data.address
      description: The victim asset address.
      type: String
    - contextPath: TC.Victim.assets.data.addressType
      description: The victim asset address type.
      type: String
    - contextPath: TC.Victim.assets.data.socialNetwork
      description: The victim asset social network.
      type: String
    - contextPath: TC.Victim.associatedGroups.id
      description: The victim's associated group ID.
      type: Unknown
    - contextPath: TC.Victim.attributes.data.id
      description: The victim attribute ID.
      type: Number
    - contextPath: TC.Victim.attributes.data.dateAdded
      description: The victim attribute date added.
      type: Date
    - contextPath: TC.Victim.attributes.data.type
      description: The victim attribute type.
      type: String
    - contextPath: TC.Victim.attributes.data.value
      description: The victim attribute value.
      type: String
    - contextPath: TC.Victim.attributes.data.source
      description: The victim attribute source.
      type: String
    - contextPath: TC.Victim.attributes.data.createdBy.id
      description: The victim attribute creator ID.
      type: Number
    - contextPath: TC.Victim.attributes.data.createdBy.userName
      description: The victim attribute creator user name.
      type: String
    - contextPath: TC.Victim.attributes.data.createdBy.firstName
      description: The victim attribute creator first name.
      type: String
    - contextPath: TC.Victim.attributes.data.createdBy.lastName
      description: The victim attribute creator last name.
      type: String
    - contextPath: TC.Victim.attributes.data.createdBy.pseudonym
      description: The victim attribute creator pseudonym.
      type: String
    - contextPath: TC.Victim.attributes.data.createdBy.owner
      description: The victim attribute creator owner.
      type: String
    - contextPath: TC.Victim.attributes.data.lastModified
      description: The victim attribute last modified time.
      type: Date
    - contextPath: TC.Victim.attributes.data.pinned
      description: Whether the victim attribute is pinned.
      type: String
    - contextPath: TC.Victim.attributes.data.default
      description: Whether the victim attribute is default.
      type: String
  - arguments:
    - default: true
      description: The ID of the victim.
      name: victim_id
      required: true
    - auto: PREDEFINED
      description: The asset type.
      name: asset_type
      required: true
      predefined:
      - EmailAddress
      - NetworkAccount
      - Phone
      - SocialNetwork
      - WebSite
    - description: The asset value.
      name: asset_value
      required: true
    - description: The asset address type. Relevant only when the asset_type is EmailAddress.
      name: asset_address_type
    - description: The asset network type. Relevant only when the asset_type is NetworkAccount.
      name: asset_network_type
    - description: The asset social network. Required only when the asset_type is SocialNetwork.
      name: asset_social_network
    description: Creates a victim asset.
    name: tc-create-victim-asset
    outputs:
    - contextPath: TC.VictimAsset.id
      description: The ID of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.type
      description: The type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.victimId
      description: The ID of the victim.
      type: string
    - contextPath: TC.VictimAsset.webLink
      description: The web link of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.phone
      description: The phone number of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.address
      description: The address of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.accountName
      description: The account name of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.addressType
      description: The address type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.networkType
      description: The network type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.socialNetwork
      description: The social network of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.website
      description: The website of the victim asset.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim asset.
      name: victim_asset_id
      required: true
    - description: The asset value.
      name: asset_value
      required: true
    - description: The asset address type. Relevant only when the asset_type is EmailAddress.
      name: asset_address_type
    - description: The asset network type. Relevant only when the asset_type is NetworkAccount.
      name: asset_network_type
    - description: The asset social network. Required only when the asset_type is SocialNetwork.
      name: asset_social_network
    description: Updates a victim asset.
    name: tc-update-victim-asset
    outputs:
    - contextPath: TC.VictimAsset.id
      description: The ID of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.type
      description: The type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.victimId
      description: The ID of the victim.
      type: string
    - contextPath: TC.VictimAsset.webLink
      description: The web link of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.phone
      description: The phone number of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.address
      description: The address of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.accountName
      description: The account name of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.addressType
      description: The address type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.networkType
      description: The network type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.socialNetwork
      description: The social network of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.website
      description: The website of the victim asset.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim asset.
      name: victim_asset_id
      required: true
    description: Deletes a victim asset.
    name: tc-delete-victim-asset
  - arguments:
    - description: The ID of a specific victim asset to retrieve. If not specified, all victim assets will be retrieved.
      name: victim_asset_id
    - description: A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
    - description: The page to take the results from. The first is 0.
      name: page
      defaultValue: '0'
    - description: The maximum number of results that can be returned.
      name: limit
      defaultValue: '50'
    description: Retrieves victim assets.
    name: tc-list-victim-assets
    outputs:
    - contextPath: TC.VictimAsset.id
      description: The ID of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.type
      description: The type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.victimId
      description: The ID of the victim.
      type: string
    - contextPath: TC.VictimAsset.webLink
      description: The web link of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.phone
      description: The phone number of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.address
      description: The address of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.accountName
      description: The account name of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.addressType
      description: The address type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.networkType
      description: The network type of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.socialNetwork
      description: The social network of the victim asset.
      type: string
    - contextPath: TC.VictimAsset.website
      description: The website of the victim asset.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim.
      name: victim_id
      required: true
    - auto: PREDEFINED
      description: A comma-separated list of the security labels to apply to the victim attribute.
      name: security_labels
      isArray: true
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - auto: PREDEFINED
      description: The attribute type.
      name: attribute_type
      required: true
      predefined:
      - Additional Analysis and Context
      - Description
      - External ID
      - Impact Description
      - Impact Score
      - Physical Address
      - Response Team & Staff involved
      - Source
      - Takedown Requests
      - Targeted Industry Sector
      - Title
    - description: The attribute value.
      name: attribute_value
      required: true
    - description: The attribute source.
      name: source
    description: Creates a victim attribute.
    name: tc-create-victim-attribute
    outputs:
    - contextPath: TC.VictimAttribute.dateAdded
      description: The date that the victim attribute was added.
      type: string
    - contextPath: TC.VictimAttribute.default
      description: Whether the attribute is the default attribute of its type for the victim to which it is added.
      type: string
    - contextPath: TC.VictimAttribute.id
      description: The ID of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.lastModified
      description: The date that the victim attribute was last modified.
      type: string
    - contextPath: TC.VictimAttribute.pinned
      description: Whether the victim attribute is pinned.
      type: string
    - contextPath: TC.VictimAttribute.type
      description: The type of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.value
      description: The value of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.firstName
      description: The first name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.id
      description: The ID of the victim the attribute associated to.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.lastName
      description: The last name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.owner
      description: The owner of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.pseudonym
      description: The pseudonym of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.userName
      description: The user name of the user who created the victim attribute.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim attribute.
      name: victim_attribute_id
      required: true
    - auto: PREDEFINED
      description: A comma-separated list of the security labels to apply to the victim attribute.
      name: security_labels
      isArray: true
      predefined:
      - TLP:RED
      - TLP:GREEN
      - TLP:AMBER
      - TLP:WHITE
      - TLP:AMBER+STRICT
      - TLP:CLEAR
    - description: The attribute value.
      name: attribute_value
      required: true
    - description: The attribute source.
      name: source
    description: Updates a victim attribute.
    name: tc-update-victim-attribute
    outputs:
    - contextPath: TC.VictimAttribute.dateAdded
      description: The date that the victim attribute was added.
      type: string
    - contextPath: TC.VictimAttribute.default
      description: Whether the attribute is the default attribute of its type for the victim to which it is added.
      type: string
    - contextPath: TC.VictimAttribute.id
      description: The ID of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.lastModified
      description: The date that the victim attribute was last modified.
      type: string
    - contextPath: TC.VictimAttribute.pinned
      description: Whether the victim attribute is pinned.
      type: string
    - contextPath: TC.VictimAttribute.type
      description: The type of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.value
      description: The value of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.firstName
      description: The first name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.id
      description: The ID of the victim the attribute associated to.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.lastName
      description: The last name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.owner
      description: The owner of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.pseudonym
      description: The pseudonym of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.userName
      description: The user name of the user who created the victim attribute.
      type: string
  - arguments:
    - default: true
      description: The ID of the victim attribute.
      name: victim_attribute_id
      required: true
    description: Deletes a victim attribute.
    name: tc-delete-victim-attribute
  - arguments:
    - default: true
      description: The ID of a specific victim attribute to retrieve. If not specified, all victim attributes will be retrieved.
      name: victim_attribute_id
    - description: The ID of a specific victim to retrieve its attributes.
      name: victim_id
    - description: A free text TQL filter. Refer to https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql for a basic TQL guide.
      name: filter
    - description: The page to take the results from. The first is 0.
      name: page
      defaultValue: '0'
    - description: The maximum number of results that can be returned.
      name: limit
      defaultValue: '50'
    description: Retrieves victim attributes.
    name: tc-list-victim-attributes
    outputs:
    - contextPath: TC.VictimAttribute.dateAdded
      description: The date that the victim attribute was added.
      type: string
    - contextPath: TC.VictimAttribute.default
      description: Whether the attribute is the default attribute of its type for the victim to which it is added.
      type: string
    - contextPath: TC.VictimAttribute.id
      description: The ID of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.lastModified
      description: The date that the victim attribute was last modified.
      type: string
    - contextPath: TC.VictimAttribute.pinned
      description: Whether the victim attribute is pinned.
      type: string
    - contextPath: TC.VictimAttribute.type
      description: The type of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.value
      description: The value of the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.firstName
      description: The first name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.id
      description: The ID of the victim the attribute associated to.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.lastName
      description: The last name of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.owner
      description: The owner of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.pseudonym
      description: The pseudonym of the user who created the victim attribute.
      type: string
    - contextPath: TC.VictimAttribute.createdBy.userName
      description: The user name of the user who created the victim attribute.
      type: string
  - arguments:
    - description: A specific attribute type to retrieve. If not specified, all attribute types will be retrieved.
      name: attribute_type_id
    - description: The page to take the results from. The first is 0.
      name: page
      defaultValue: '0'
    - description: The maximum number of results that can be returned.
      name: limit
      defaultValue: '50'
    description: Retrieved all attribute types.
    name: tc-list-attribute-type
    outputs:
    - contextPath: TC.AttributeType.allowMarkdown
      description: Whether the attribute type markdown allowed.
      type: string
    - contextPath: TC.AttributeType.description
      description: The attribute type description.
      type: string
    - contextPath: TC.AttributeType.name
      description: The attribute type name.
      type: string
    - contextPath: TC.AttributeType.errorMessage
      description: The attribute type error message.
      type: string
    - contextPath: TC.AttributeType.id
      description: The attribute type ID.
      type: string
    - contextPath: TC.AttributeType.maxSize
      description: The attribute type maximum size.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.description
      description: The attribute type validation rule description.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.id
      description: The attribute type validation rule ID.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.name
      description: The attribute type validation rule name.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.text
      description: The attribute type validation rule text.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.type
      description: The attribute type validation rule type.
      type: string
    - contextPath: TC.AttributeType.TC.AttributeType.validationRule.version
      description: The attribute type validation rule version.
      type: string
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 5.0.0
defaultmapperin: Threatconnect Mapper (incoming)
defaultclassifier: Threatconnect classifier
tests:
- test-threatConnectv3