ThreatExchange Deprecated

commonfields:
  id: ThreatExchange
  version: -1
name: ThreatExchange
display: ThreatExchange (Deprecated)
deprecated: true
fromversion: 5.0.0
category: Data Enrichment & Threat Intelligence
provider: Meta
description: Deprecated. Use the ThreatExchange v2 integration instead.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: Server
  defaultvalue: https://graph.facebook.com
  type: 0
  required: true
- display: App ID
  name: appID
  defaultvalue: ""
  type: 0
  required: true
- display: App Secret
  name: appSecret
  defaultvalue: ""
  type: 4
  required: true
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Use system proxy settings
  name: useproxy
  defaultvalue: "true"
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: Api version
  name: apiVersion
  defaultvalue: v2.8
  type: 0
  required: true
script:
  script: ''
  type: javascript
  commands:
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: Hash of the file to query. Supports MD5, SHA1 and SHA256 hashes.
    - name: limit
      description: The maximum number of results per page. The maximum is 1000. Default is 20.
      defaultValue: "20"
    - name: headers
      description: 'A comma-separated list of headers to display in human-readable format. For example: header1,header2,header3'
    - name: since
      description: 'The start timestamp for collecting malware, format: 1391813489'
    - name: until
      description: 'The end timestamp for collecting malware, format: 1391813489'
    outputs:
    - contextPath: File.MD5
      description: Bad MD5 hash found.
    - contextPath: File.SHA1
      description: Bad SHA1 hash found.
    - contextPath: File.SHA256
      description: Bad SHA256 hash found.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
    - contextPath: File.Malicious.Score
      description: For malicious files, the score from the vendor.
    description: Checks the file reputation of the given hash.
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to check.
    - name: headers
      description: 'A comma-separated list of headers to display in human-readable format. For example: header1,header2,header3.'
    outputs:
    - contextPath: IP.Address
      description: Bad IP address found.
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs addresse, the vendor that made the decision.
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: IP.Malicious.Score
      description: For malicious IP addresses, the score from the vendor.
    description: Checks the reputation of the given IP address.
  - name: url
    arguments:
    - name: url
      required: true
      description: URL to be checked
    - name: limit
      description: The maximum number of results per page. The maximum is 1000. Default is 20.
      defaultValue: "20"
    - name: headers
      description: 'Headers to display in Human readable format, comma separated format, for example: header1,header2,header3'
    - name: since
      description: 'The start timestamp for collecting malware, format: 1391813489'
    - name: until
      description: 'The end timestamp for collecting malware, format: 1391813489'
    outputs:
    - contextPath: URL.Data
      description: Bad URLs found
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason for the vendor to make the decision
    - contextPath: URL.Malicious.Score
      description: For malicious URLs, the score from the vendor
    description: Check URL Reputation
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      description: Domain name to check reputation
    - name: limit
      description: The maximum number of results per page. The maximum is 1000. Default is 20.
      defaultValue: "20"
    - name: headers
      description: 'Headers to display in Human readable format, comma separated format, for example: header1,header2,header3'
    - name: since
      description: 'The start timestamp for collecting malware, format: 1391813489'
    - name: until
      description: 'The end timestamp for collecting malware, format: 1391813489'
    outputs:
    - contextPath: Domain.Name
      description: Bad domain found
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason that the vendor made the decision.
    description: Check domain reputation
  - name: threatexchange-query
    arguments:
    - name: text
      default: true
      description: Free-form text field with a value to search for. This can be a file hash or a string found in other fields of the objects.
    - name: type
      description: 'The type of descriptor to search for. For more information see: https://developers.facebook.com/docs/threat-exchange/reference/apis/indicator-type/v2.9'
    - name: limit
      description: The maximum number of results per page. The maximum is 1000. Default is 20.
      defaultValue: "20"
    - name: headers
      description: 'Headers to display in Human readable format, comma separated format, for example: header1,header2,header3'
    - name: since
      description: 'The start timestamp for collecting malware, format: 1391813489'
    - name: until
      description: 'The end timestamp for collecting malware, format: 1391813489'
    description: ' Searches for subjective opinions on indicators of compromise stored in ThreatExchange'
  - name: threatexchange-members
    arguments: []
    description: Returns a list of current members of the ThreatExchange, alphabetized by application name. Each application may also include an optional contact email address. You can set this address, if desired, under the settings panel for your application
tests:
- ThreatExchange-test