ThreatGridv2

Query and upload samples to Cisco threat grid.
This integration was integrated and tested with version 2 of Cisco Secure Malware Analytics (Threat Grid)

Configure Cisco Secure Malware Analytics (Threat Grid) in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

threat-grid-sample-list

Search samples on the Threat Grid platform. Input parameters are ANDed together. Only finished samples can be searched (that is, the ones that are having a status of succ or fail.)

Base Command

threat-grid-sample-list

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Sample": [
            {
                "completed_at": "ThreatGrid_Sample[0]_completed_at",
                "filename": "md5",
                "id": "id",
                "md5": "md5",
                "os": "os",
                "sha1": "sha1",
                "sha256": "sha256",
                "started_at": "ThreatGrid_Sample[0]_started_at",
                "state": "succ",
                "status": "job_done",
                "submission_id": 1538519424,
                "submitted_at": "ThreatGrid_Sample[0]_submitted_at",
                "tags": [],
                "vm": "win7-x64"
            },
            {
                "completed_at": "ThreatGrid_Sample[1]_completed_at",
                "filename": "sha256",
                "id": "id",
                "md5": "md5",
                "os": "os",
                "sha1": "sha1",
                "sha256": "sha256",
                "started_at": "ThreatGrid_Sample[1]_started_at",
                "state": "succ",
                "status": "job_done",
                "submission_id": 1531508494,
                "submitted_at": "ThreatGrid_Sample[1]_submitted_at",
                "tags": [
                    "s",
                    "talos",
                    "gravity"
                ],
                "vm": "win7-x64"
            },
        ]
    }
}

Human Readable Output

Sample details

Completed At	Filename	Id	Md5	Os	Sha1	Sha256	Started At	State	Status	Submission Id	Submitted At	Tags	Vm
2022-12-05T04:17:00Z	md5	id	md5	os	sha1	sha256	2022-12-05T04:10:44Z	succ	job_done	1538519424	2022-12-05T04:10:44Z		win7-x64
2022-11-24T01:04:39Z	sha256	id	md5	os	sha1	sha256	2022-11-24T00:58:22Z	succ	job_done	1531508494	2022-11-24T00:58:22Z	s, talos, gravity	win7-x64

threat-grid-sample-upload

Submits a sample to threat grid for analysis. URL or file, not both.

Base Command

threat-grid-sample-upload

Input

Context Output

Command example

!threat-grid-sample-upload url=http://domain_example:80/ private=True

Human Readable Output

Upload sample is executing

threat-grid-submissions-search

Search threat grid submissions

Base Command

threat-grid-submissions-search

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Sample": [
            {
                "filename": "md5",
                "md5": "md5",
                "private": false,
                "sample": "sample",
                "sha1": "sha1",
                "sha256": "sha256",
                "state": "wait",
                "status": "pending",
                "submitted_at": "ThreatGrid_Sample[0]_submitted_at"
            },
            {
                "filename": "md5",
                "md5": "md5",
                "private": false,
                "sample": "sample",
                "sha1": "sha1",
                "sha256": "sha256",
                "state": "wait",
                "status": "pending",
                "submitted_at": "ThreatGrid_Sample[1]_submitted_at"
            },
        ]
    }
}

Human Readable Output

Samples Submissed

Showing page 1.
Current page size: 50

Filename	Md5	Private	Sample	Sha1	Sha256	State	Status	Submitted At
md5	md5	false	sample	sha1	sha256	wait	pending	2022-12-22T08:40:47Z
md5	md5	false	sample	sha1	sha256	wait	pending	2022-12-22T08:40:47Z

threat-grid-sample-summary-get

Returns summary analysis information

Base Command

threat-grid-sample-summary-get

Input

Context Output

Command example

!threat-grid-sample-summary-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "SampleAnalysisSummary": {
            "artifacts": {
                "disk": 6,
                "memory": 9,
                "network": 1
            },
            "filename": "www.domain_example_.url",
            "first_seen": "ThreatGrid_SampleAnalysisSummary_first_seen",
            "iocs": [
                {
                    "category": [
                        "static-anomaly"
                    ],
                    "confidence": 100,
                    "ioc": "html-small-file-redirect",
                    "score": 50,
                    "severity": 50,
                    "tags": [
                        "html",
                        "redirect"
                    ]
                },
                {
                    "category": [
                        "network-information"
                    ],
                    "confidence": 50,
                    "ioc": "http-response-redirect",
                    "score": 25,
                    "severity": 50,
                    "tags": [
                        "network",
                        "http",
                        "redirect"
                    ]
                },
                {
                    "category": [
                        "domain"
                    ],
                    "confidence": 95,
                    "ioc": "network-only-safe-domains-contacted",
                    "score": 19,
                    "severity": 20,
                    "tags": [
                        "umbrella",
                        "dns"
                    ]
                },
                {
                    "category": [
                        "network-information"
                    ],
                    "confidence": 25,
                    "ioc": "network-communications-http-get-url",
                    "score": 6,
                    "severity": 25,
                    "tags": [
                        "network",
                        "http",
                        "get"
                    ]
                }
            ],
            "last_seen": "ThreatGrid_SampleAnalysisSummary_last_seen",
            "magic_type": "ThreatGrid_SampleAnalysisSummary_magic_type",
            "md5": "md5",
            "registry_count": 143,
            "run_start": "ThreatGrid_SampleAnalysisSummary_run_start",
            "run_stop": "ThreatGrid_SampleAnalysisSummary_run_stop",
            "run_type": "url",
            "sample": "sample_id",
            "sha1": "sha1",
            "sha256": "sha256",
            "stream_count": 44,
            "tags": [],
            "times_seen": 85
        }
    }
}

Human Readable Output

Sample summary

Artifacts	Filename	First Seen	Iocs	Last Seen	Magic Type	Md5	Registry Count	Run Start	Run Stop	Run Type	Sample	Sha1	Sha256	Stream Count	Tags	Times Seen
disk: 6 memory: 9 network: 1	www.domain_example_.url	2021-12-29T15:43:00Z	{‘category’: [‘static-anomaly’], ‘confidence’: 100, ‘ioc’: ‘html-small-file-redirect’, ‘severity’: 50, ‘tags’: [‘html’, ‘redirect’], ‘score’: 50}, {‘category’: [‘network-information’], ‘confidence’: 50, ‘ioc’: ‘http-response-redirect’, ‘severity’: 50, ‘tags’: [‘network’, ‘http’, ‘redirect’], ‘score’: 25}, {‘category’: [‘domain’], ‘confidence’: 95, ‘ioc’: ‘network-only-safe-domains-contacted’, ‘severity’: 20, ‘tags’: [‘umbrella’, ‘dns’], ‘score’: 19}, {‘category’: [‘network-information’], ‘confidence’: 25, ‘ioc’: ‘network-communications-http-get-url’, ‘severity’: 25, ‘tags’: [‘network’, ‘http’, ‘get’], ‘score’: 6}	2022-12-21T12:09:33Z	MS Windows 95 Internet shortcut text (URL=http:<span//</span>www.domain_example>), ASCII text	md5	143	2022-12-21T12:09:33Z	2022-12-21T12:16:27Z	url	sample_id	sha1	sha256	44		85

threat-grid-who-am-i

Get logged in user

Base Command

threat-grid-who-am-i

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "User": {
            "active": true,
            "api_key": "key",
            "api_only": false,
            "device": false,
            "email": "ThreatGrid_User_email",
            "integration_id": "id",
            "login": "login_name",
            "name": "name",
            "organization_id": 485008,
            "role": "org-admin",
            "title": ""
        }
    }
}

Human Readable Output

Who am I ?

Active	Api Key	Api Only	Device	Email	Integration Id	Login	Name	Organization Id	Role	Title
true	key	false	false	mail	z1ci	login_name	name	id	org-admin

threat-grid-rate-limit-get

Get rate limit for a specific user name. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by a user. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day.

Base Command

threat-grid-rate-limit-get

Input

Context Output

Command example

!threat-grid-rate-limit-get login=login_name entity_type=user

Context Example

{
    "ThreatGrid": {
        "RateLimit": {
            "submission-rate-limit": [],
            "submission-wait-seconds": 0,
            "submissions-available": null
        }
    }
}

Human Readable Output

user rate limit

Submission-rate-limit	Submission-wait-seconds	Submissions-available
	0

threat-grid-feed-specific-get

Gets a specific threat feed

Base Command

threat-grid-feed-specific-get

Input

Context Output

Command example

!threat-grid-feed-specific-get feed_name=doc-net-com-dns

Context Example

{
    "ThreatGrid": {
        "Feed": [
            {
                "description": "DNS response information from requests made by document samples performing network communications.",
                "domain": "login.gogie.com.000000000000.phish.farm",
                "info": "ThreatGrid_Feed[0]_info",
                "ips": [
                    "ThreatGrid_Feed[0]_ips_0",
                    "ThreatGrid_Feed[0]_ips_1"
                ],
                "sample": "ThreatGrid_Feed[0]_sample",
                "sample_md5": "sample_md5",
                "sample_sha1": "sample_sha1",
                "sample_sha256": "sample_sha256",
                "timestamp": "ThreatGrid_Feed[0]_timestamp"
            },
            {
                "description": "DNS response information from requests made by document samples performing network communications.",
                "domain": "spamchallenge.msftemail.com",
                "info": "ThreatGrid_Feed[1]_info",
                "ips": [
                    "ThreatGrid_Feed[1]_ips_0",
                    "ThreatGrid_Feed[1]_ips_1"
                ],
                "sample": "ThreatGrid_Feed[1]_sample",
                "sample_md5": "sample_md5",
                "sample_sha1": "sample_sha1",
                "sample_sha256": "sample_sha256",
                "timestamp": "ThreatGrid_Feed[1]_timestamp"
            },

        ]
    }
}

Human Readable Output

Specific feed

Sample	Description
https://panacea.threatgrid.com/feeds/doc-net-com-dns/samples/4007c79d4db4af076e67a32b9aa9eae8	DNS response information from requests made by document samples performing network communications.
https://panacea.threatgrid.com/feeds/doc-net-com-dns/samples/9df95de1e738730ea3eb9c2ec122afa7	DNS response information from requests made by document samples performing network communications.

threat-grid-ip-search

Search IPs. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time.

Base Command

threat-grid-ip-search

Input

Context Output

Command example

!threat-grid-ip-search ip=8.8.8.8

Context Example

{
    "ThreatGrid": {
        "search": {
            "asn": {
                "asn": 15169,
                "org": "Google"
            },
            "flags": [
                {
                    "created_at": "ThreatGrid_search_flags[0]_created_at",
                    "expiration": "ThreatGrid_search_flags[0]_expiration",
                    "flag": 1,
                    "login": "admin",
                    "mine": false,
                    "reason": "Content Delivery Network"
                },
            ],
            "ip": "ThreatGrid_search_ip",
            "location": {
                "city": "Los Angeles",
                "country": "US",
                "region": "CA"
            },
            "rev": "dns.google",
            "tags": []
        }
    }
}

Human Readable Output

ip data

Asn	Flags	Ip	Location	Rev	Tags
org: Google asn: 15169	{‘created_at’: ‘2013-11-15T18:16:33Z’, ‘expiration’: ‘2025-01-01T00:00:00Z’, ‘flag’: 1, ‘login’: ‘admin’, ‘reason’: ‘Content Delivery Network’, ‘mine’: False}, {‘created_at’: ‘2013-11-15T18:16:34Z’, ‘expiration’: ‘2025-01-01T00:00:00Z’, ‘flag’: 1, ‘login’: ‘admin’, ‘reason’: ‘resolves to google-public-dns-a.domain_example’, ‘mine’: False}, {‘created_at’: ‘2013-07-25T14:08:34Z’, ‘expiration’: ‘2025-01-01T00:00:00Z’, ‘flag’: 1, ‘login’: ‘dean’, ‘reason’: ‘Whitelisted’, ‘mine’: False}	8.8.8.8	country: US region: CA city: Los Angeles	dns.google

threat-grid-analysis-annotations-get

Returns data regarding the annotations of the analysis

Base Command

threat-grid-analysis-annotations-get

Input

Context Output

Command example

!threat-grid-analysis-annotations-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "SampleAnnotations": {
            "network": {
                "ip1": {
                    "ts": "ThreatGrid_SampleAnnotations_network_ip1_ts"
                },
                "ip2": {
                    "asn": 15169,
                    "city": "c",
                    "country": "US",
                    "country_name": "United States",
                    "org": "Google",
                    "region": "NY",
                    "region_name": "New York",
                    "reverse_dns": [
                        "lga34s32-in-f3.1e100.net"
                    ],
                    "ts": "ThreatGrid_SampleAnnotations_network_ip2_ts"
                },
            }
        }
    }
}

Human Readable Output

List of samples analysis

ip1	ip2
ts: 2022-12-21T12:15:59Z	org: Google ts: 2022-12-21T12:15:59Z country: US city: c region_name: New York region: NY reverse_dns: lga34s32-in-f3.1e100.net country_name: United States asn: 15169	org: Google ts: 2022-12-21T12:15:59Z country: US city: Wantagh region_name: New York region: NY reverse_dns: lga34s34-in-f14.1e100.net country_name: United States asn: 15169	org: Google ts: 2022-12-21T12:15:59Z country: US city: Glen Cove

threat-grid-url-search

Search urls. Please provide the URL in the format http://example.com:80/ (note that ThreatGrid only support ‘.com’ domains).

Base Command

threat-grid-url-search

Input

Context Output

Command example

!threat-grid-url-search url=http://domain_example:80/

Context Example

{
    "ThreatGrid": {
        "search": {
            "host": "domain_example",
            "path": "/",
            "port": 80,
            "protocol": "http",
            "query": null,
            "query-params": null,
            "reference": null,
            "url": "ThreatGrid_search_url"
        }
    }
}

Human Readable Output

url data

Host	Path	Port	Protocol	Query	Query-params	Reference	Url
domain_example	/	80	http				http://domain_example:80/

threat-grid-feeds-artifact

Get artifacts threat feed

Base Command

threat-grid-feeds-artifact

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Artifact": [
            {
                "aid": 1,
                "artifact_md5": "md5",
                "artifact_sha256": "sha256",
                "confidence": 95,
                "ioc": "antivirus-service-flagged-artifact",
                "path": "md5.exe",
                "sample_id": "id",
                "severity": 100,
                "timestamp": "ThreatGrid_Artifact[0]_timestamp"
            },
            {
                "aid": 11,
                "artifact_md5": "artifact_md5",
                "artifact_sha256": "artifact_sha256",
                "confidence": 90,
                "ioc": "sample-pe-modified-on-disk",
                "path": "ThreatGrid_Artifact[1]_path",
                "sample_id": "id",
                "severity": 90,
                "timestamp": "ThreatGrid_Artifact[1]_timestamp"
            },
        ]
    }
}

Human Readable Output

Feeds IOCs list artifact

Showing page 1.
Current page size: 50

Aid	Artifact Md5	Artifact Sha256	Confidence	Ioc	Path	Sample Id	Severity	Timestamp
3	md5	sha256	90	antivirus-flagged-artifact	\Users\Administrator.exe	id	80	2022-12-05T04:10:44Z
9	md5	sha256	90	antivirus-flagged-artifact	912-.exe	id	80	2022-12-05T04:10:44Z

threat-grid-feeds-domain

Get domain threat feed

Base Command

threat-grid-feeds-domain

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Domain": [
            {
                "confidence": 95,
                "domain": "hookworm.capitaly.ru",
                "ioc": "network-snort-pua",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 90,
                "timestamp": "ThreatGrid_Domain[0]_timestamp"
            },
            {
                "confidence": 100,
                "domain": "augustawa.com",
                "ioc": "suspicious-user-agent",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 80,
                "timestamp": "ThreatGrid_Domain[1]_timestamp"
            },

        ]
    }
}

Human Readable Output

Feeds IOCs list domain

Showing page 1.
Current page size: 50

Confidence	Domain	Ioc	Sample Id	Sample Sha256	Severity	Timestamp
95	hookworm.capitaly.ru	network-snort-pua	sample_id	sample_sha256	90	2022-12-22T07:46:38Z
100	augustawa.com	suspicious-user-agent	sample_id	sample_sha256	80	2022-11-28T23:51:27Z

threat-grid-feeds-url

Get url threat feed

Base Command

threat-grid-feeds-url

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "url": [
            {
                "confidence": 95,
                "url": "hookworm.capitaly.ru",
                "ioc": "network-snort-pua",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 90,
                "timestamp": "ThreatGrid_url[0]_timestamp"
            },
            {
                "confidence": 100,
                "url": "augustawa.com",
                "ioc": "suspicious-user-agent",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 80,
                "timestamp": "ThreatGrid_url[1]_timestamp"
            },
        ]
    }
}

Human Readable Output

Feeds IOCs list url

Showing page 1.
Current page size: 50

Confidence	url	Ioc	Sample Id	Sample Sha256	Severity	Timestamp
95	hookworm.capitaly.ru	network-snort-pua	sample_id	sample_sha256	90	2022-12-22T07:46:38Z
100	augustawa.com	suspicious-user-agent	sample_id	sample_sha256	80	2022-11-28T23:51:27Z

threat-grid-feeds-ip

Get ips threat feed

Base Command

threat-grid-feeds-ip

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Ip": [
            {
                "confidence": 95,
                "ioc": "network-snort-pua",
                "ip": "ThreatGrid_Ip[0]_ip",
                "port": null,
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 90,
                "timestamp": "ThreatGrid_Ip[0]_timestamp"
            },
            {
                "confidence": 90,
                "ioc": "network-snort-indicator-compromise",
                "ip": "ThreatGrid_Ip[1]_ip",
                "port": null,
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 95,
                "timestamp": "ThreatGrid_Ip[1]_timestamp"
            },
        ]
    }
}

Human Readable Output

Feeds IOCs list ip

Showing page 1.
Current page size: 50

Confidence	Ioc	Ip	Port	Sample Id	Sample Sha256	Severity	Timestamp
95	network-snort-pua	ip		sample_id	sample_sha256	90	2022-12-22T07:46:38Z
90	network-snort-indicator-compromise	192.168.1.1		sample_id	sample_sha256	95	2022-12-09T14:22:54Z

threat-grid-feeds-network-stream

Get network stream threat feed

Base Command

threat-grid-feeds-network-stream

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "NetworkStreams": [
            {
                "confidence": 95,
                "dst": "ThreatGrid_NetworkStreams[0]_dst",
                "dst_port": 80,
                "ioc": "network-snort-pua",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 90,
                "src": "ThreatGrid_NetworkStreams[0]_src",
                "src_port": 49166,
                "timestamp": "ThreatGrid_NetworkStreams[0]_timestamp"
            },
            {
                "confidence": 100,
                "dst": "ThreatGrid_NetworkStreams[1]_dst",
                "dst_port": 80,
                "ioc": "suspicious-user-agent",
                "sample_id": "sample_id",
                "sample_sha256": "sample_sha256",
                "severity": 80,
                "src": "ThreatGrid_NetworkStreams[1]_src",
                "src_port": 49160,
                "timestamp": "ThreatGrid_NetworkStreams[1]_timestamp"
            },

        ]
    }
}

Human Readable Output

Feeds IOCs list network_stream

Showing page 1.
Current page size: 50

Confidence	Dst	Dst Port	Ioc	Sample Id	Sample Sha256	Severity	Src	Src Port	Timestamp
95	ip	80	network-snort-pua	sample_id	sample_sha256	90	ip	49164	2022-12-22T07:46:38Z
95	ip	80	network-snort-pua	sample_id	sample_sha256	90	ip	49158	2022-12-22T07:46:38Z

threat-grid-feeds-path

Get path threat feed

Base Command

threat-grid-feeds-path

Input

Context Output

Command example

#### Context Example

```json
{
    "ThreatGrid": {
        "Path": [
            {
                "confidence": 100,
                "ioc": "artifact-pe-no-name",
                "path": "\\Users\\Administrator\\.exe",
                "sample_id": "id",
                "sample_sha256": "sha256",
                "severity": 90,
                "timestamp": "ThreatGrid_Path[0]_timestamp"
            },
            {
                "confidence": 100,
                "ioc": "modified-file-in-system-dir",
                "path": "ThreatGrid_Path[1]_path",
                "sample_id": "id",
                "sample_sha256": "sha256",
                "severity": 85,
                "timestamp": "ThreatGrid_Path[1]_timestamp"
            },
        ]
    }
}

Human Readable Output

Feeds IOCs list path

Showing page 1.
Current page size: 50

Confidence	Ioc	Path	Sample Id	Sample Sha256	Severity	Timestamp
90	antivirus-flagged-artifact	\Users\Administrator.exe	id	sha256	80	2022-12-05T04:10:44Z
90	antivirus-flagged-artifact	912-.exe	id	sha256	80	2022-12-05T04:10:44Z

threat-grid-feeds-url

Get url threat feed

Base Command

threat-grid-feeds-url

Input

Context Output

threat-grid-analysis-artifacts-get

Returns the sample id artifact with artifact id

Base Command

threat-grid-analysis-artifacts-get

Input

Context Output

Command example

!threat-grid-analysis-artifacts-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "ArtifactAnalysis": {
            "1": {
                "antivirus": {
                    "reversing_labs": {
                        "first_seen": "ThreatGrid_ArtifactAnalysis_1_antivirus_reversing_labs_first_seen",
                        "last_seen": "ThreatGrid_ArtifactAnalysis_1_antivirus_reversing_labs_last_seen",
                        "query_hash": {
                            "sha256": "sha256"
                        },
                        "scanner_count": 25,
                        "scanner_match": 0,
                        "status": "KNOWN",
                        "threat_level": 0,
                        "threat_name": "",
                        "trust_factor": 5
                    },
                    "virustotal": {
                        "engines": 55,
                        "hits": 0,
                        "results": {},
                        "scanned": "ThreatGrid_ArtifactAnalysis_1_antivirus_virustotal_scanned",
                        "score": 0
                    }
                },
                "created-time": 0,
                "created_by": [],
                "entropy": 4.402529762804034,
                "executed_from": [],
                "forensics": {
                    "sections": {
                        "InternetShortcut": {
                            "properties": {
                                "URL": "ThreatGrid_ArtifactAnalysis_1_forensics_sections_InternetShortcut_properties_URL"
                            }
                        }
                    }
                },
                "magic-type": "ThreatGrid_ArtifactAnalysis_1_magic-type",
                "md5": "md5",
                "mime-type": "text/plain; charset=us-ascii",
                "modified_by": [],
                "origin": "submitted",
                "path": "www.domain_example_.url",
                "read_by": [],
                "relation": {
                    "contains": null,
                    "extracted_from": null,
                    "network": null,
                    "process": null
                },
                "sha1": "sha1",
                "sha256": "sha256",
                "size": 45,
                "type": "url",
                "whitelist": []
            },
            "10": {
                "antivirus": {
                    "reversing_labs": {
                        "first_seen": "",
                        "last_seen": "",
                        "query_hash": {
                            "sha256": "sha256"
                        },
                        "scanner_count": 0,
                        "scanner_match": 0,
                        "status": "UNKNOWN",
                        "threat_level": 0,
                        "threat_name": "",
                        "trust_factor": 0
                    }
                },
                "created-time": 1671624958,
                "created_by": [
                    24
                ],
                "entropy": 0,
                "executed_from": [],
                "forensics": null,
                "magic-type": "data",
                "md5": "md5",
                "mime-type": "application/octet-stream; charset=binary",
                "modified_by": [],
                "origin": "disk",
                "path": "path",
                "read_by": [],
                "relation": {
                    "contains": null,
                    "extracted_from": null,
                    "network": null,
                    "process": null
                },
                "sha1": "sha1",
                "sha256": "sha256",
                "size": 276959,
                "type": "",
                "whitelist": []
            },
            "11": {
                "antivirus": {
                    "reversing_labs": {
                        "first_seen": "ThreatGrid_ArtifactAnalysis_11_antivirus_reversing_labs_first_seen",
                        "last_seen": "ThreatGrid_ArtifactAnalysis_11_antivirus_reversing_labs_last_seen",
                        "query_hash": {
                            "sha256": "sha256"
                        },
                        "scanner_count": 42,
                        "scanner_match": 0,
                        "status": "KNOWN",
                        "threat_level": 0,
                        "threat_name": "",
                        "trust_factor": 0
                    }
                },
                "created-time": 1671624958,
                "created_by": [
                    24
                ],
                "entropy": 0,
                "executed_from": [],
                "forensics": null,
                "magic-type": "data",
                "md5": "md5",
                "mime-type": "application/octet-stream; charset=binary",
                "modified_by": [],
                "origin": "disk",
                "path": "path",
                "read_by": [],
                "relation": {
                    "contains": null,
                    "extracted_from": null,
                    "network": null,
                    "process": null
                },
                "sha1": "sha1",
                "sha256": "sha256",
                "size": 21700,
                "type": "",
                "whitelist": []
            },
            "12": {
                "antivirus": {
                    "reversing_labs": {
                        "first_seen": "",
                        "last_seen": "",
                        "query_hash": {
                            "sha256": "sha256"
                        },
                        "scanner_count": 0,
                        "scanner_match": 0,
                        "status": "UNKNOWN",
                        "threat_level": 0,
                        "threat_name": "",
                        "trust_factor": 0
                    }
                },
                "created-time": 1671624958,
                "created_by": [
                    24
                ],
                "entropy": 0.006721586530775835,
                "executed_from": [],
                "forensics": null,
                "magic-type": "data",
                "md5": "md5",
                "mime-type": "application/octet-stream; charset=binary",
                "modified_by": [],
                "origin": "disk",
                "path": "path",
                "read_by": [],
                "relation": {
                    "contains": null,
                    "extracted_from": null,
                    "network": null,
                    "process": null
                },
                "sha1": "sha1",
                "sha256": "sha256",
                "size": 262512,
                "type": "",
                "whitelist": []
            },
        }
    }
}

Human Readable Output

List of samples analysis

1	10
origin: submitted executed_from: path: www.domain_example_.url mime-type: text/plain; charset=us-ascii whitelist: created-time: 0 read_by: created_by: sha256: sha256 sha1: sha1 md5: md5 entropy: x type: url size: 45 modified_by: magic-type: MS Windows 95 Internet shortcut text (URL=http:<span//</span>www.domain_example>), ASCII text relation: {“contains”: null, “extracted_from”: null, “network”: null, “process”: null}	origin: disk executed_from: path: path mime-type: application/octet-stream; charset=binary whitelist: created-time: 1671624958 read_by: created_by: 24 sha256: sha256 sha1: sha1 md5: md5 entropy: 0 type: size: 276959 modified_by: magic-type: data relation: {“contains”: null, “extracted_from”: null, “network”: null, “process”: null}	origin: disk executed_from: path: path mime-type: application/octet-stream; charset=binary whitelist: created-time: 1671624958 read_by: created_by: 24 sha256: sha256 sha1: sha1 md5: md5 entropy: 0 type: size: 21700 modified_by: magic-type: data relation: {“contains”: null, “extracted_from”: null, “network”: null, “process”: null}	origin: disk executed_from: path: path mime-type: application/octet-stream; charset=binary whitelist: created-time: 1671624958 read_by: created_by: 24 sha256: sha256 sha1: sha1 md5: md5 entropy: 0.006721586530775835 type: size: 262512 modified_by: magic-type: data relation: {“contains”: null, “extracted_from”: null, “network”: null, “process”: null}	origin: disk executed_from: path: /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default/Code Cache/js/1500928ccce7b989_0 mime-type: application/octet-stream; charset=binary whitelist: created-time: 1671624958 read_by: created_by: sha256: sha256 sha1: sha1 md5: md5 entropy: 0.09552689517008506 type: size: 1917 modified_by: magic-type: data relation: {“contains”: null, “extracted_from”: null, “network”: null, “process”: null}

threat-grid-analysis-iocs-get

Returns data regarding the specified Indicator of Compromise

Base Command

threat-grid-analysis-iocs-get

Input

Context Output

Command example

!threat-grid-analysis-iocs-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "IOCAnalysis": [
            {
                "analysis-envs": [
                    "win",
                    "mac"
                ],
                "category": [
                    "network-information"
                ],
                "confidence": 50,
                "data": [
                    {
                        "Code": 302,
                        "Method": "GET",
                        "Network_Stream": 11,
                        "Status": "Found",
                        "Trans_ID": 0,
                        "URL": "ThreatGrid_IOCAnalysis[0]_data[0]_URL"
                    }
                ],
                "description": "An HTTP message indicating a redirection notice was detected in a network stream. The HTTP response codes are used as a means of conveying the status of the connection with the server to the client. Items within the 300 range indicate a redirection notice. These occur when a page has been temporarily or permanently moved.",
                "heuristic_coefficient": -0.0987738978328,
                "hits": 1,
                "ioc": "http-response-redirect",
                "mitre": [],
                "mitre-tactics": [],
                "mitre-techniques": [],
                "orbital-queries": [],
                "severity": 50,
                "suspected-sample-categories": [],
                "tags": [
                    "network",
                    "http",
                    "redirect"
                ],
                "title": "HTTP Redirection Response",
                "truncated": false
            },
            {
                "analysis-envs": [
                    "win",
                    "mac",
                    "browser"
                ],
                "category": [
                    "network-information"
                ],
                "confidence": 25,
                "data": [
                    {
                        "Method": "GET",
                        "Network_Stream": 11,
                        "URL": "ThreatGrid_IOCAnalysis[1]_data[0]_URL"
                    }
                ],
                "description": "Outbound HTTP GET to a remote server was detected. This is not inherently suspicious but malware will often use Gets in order to check in to the Command and Control servers upon infection or to download or exfiltrate data. Please view the 'HTTP' section under 'Network Analysis' for the associated traffic/communications. Additionally, the provided network PCAP will provide more details on the traffic stream.",
                "heuristic_coefficient": -26.131188198,
                "hits": 1,
                "ioc": "network-communications-http-get-url",
                "mitre": [
                    {
                        "tactic": "command and control",
                        "techniques": [
                            {
                                "subtechniques": [],
                                "technique": "application layer protocol"
                            }
                        ]
                    }
                ],
                "mitre-tactics": [
                    "command and control"
                ],
                "mitre-techniques": [
                    "application layer protocol"
                ],
                "orbital-queries": [],
                "severity": 25,
                "suspected-sample-categories": [],
                "tags": [
                    "network",
                    "http",
                    "get"
                ],
                "title": "Outbound HTTP GET Request From URL Submission",
                "truncated": false
            },

        ]
    }
}

Human Readable Output

List of samples analysis

Analysis-envs	Category	Confidence	Data	Description	Heuristic Coefficient	Hits	Ioc	Mitre	Mitre-tactics	Mitre-techniques	Orbital-queries	Severity	Suspected-sample-categories	Tags	Title	Truncated
win, mac	network-information	50	{‘Code’: 302, ‘Method’: ‘GET’, ‘Network_Stream’: 11, ‘Status’: ‘Found’, ‘Trans_ID’: 0, ‘URL’: ‘http://www.domain_example:80/’}	An HTTP message indicating a redirection notice was detected in a network stream. The HTTP response codes are used as a means of conveying the status of the connection with the server to the client. Items within the 300 range indicate a redirection notice. These occur when a page has been temporarily or permanently moved.	-0.0987738978328	1	http-response-redirect					50		network, http, redirect	HTTP Redirection Response	false
win, mac, browser	network-information	25	{‘Method’: ‘GET’, ‘Network_Stream’: 11, ‘URL’: ‘http://www.domain_example:80/’}	Outbound HTTP GET to a remote server was detected. This is not inherently suspicious but malware will often use Gets in order to check in to the Command and Control servers upon infection or to download or exfiltrate data. Please view the ‘HTTP’ section under ‘Network Analysis’ for the associated traffic/communications. Additionally, the provided network PCAP will provide more details on the traffic stream.	-26.131188198	1	network-communications-http-get-url	{‘tactic’: ‘command and control’, ‘techniques’: [{‘subtechniques’: [], ‘technique’: ‘application layer protocol’}]}	command and control	application layer protocol		25		network, http, get	Outbound HTTP GET Request From URL Submission	false

threat-grid-analysis-metadata-get

Returns metadata about the analysis

Base Command

threat-grid-analysis-metadata-get

Input

Context Output

Command example

!threat-grid-analysis-metadata-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "AnalysisMetadata": {
            "general_details": {
                "report_created": 1671624987,
                "sandbox_id": "scl-work-004",
                "sandbox_version": "pilot-d"
            },
            "malware_desc": [
                {
                    "filename": "www.domain_example_.url",
                    "magic": "ThreatGrid_AnalysisMetadata_malware_desc[0]_magic",
                    "md5": "md5",
                    "sha1": "sha1",
                    "sha256": "sha256",
                    "size": 45,
                    "type": "url"
                }
            ],
            "sandcastle_env": {
                "analysis_end": 1671624987,
                "analysis_features": [],
                "analysis_start": 1671624573,
                "controlsubject": "win",
                "current_os": "os",
                "display_name": "Windows 10 Browser",
                "run_time": 300,
                "sample_executed": 1671624638,
                "sandcastle": "3.5.124.17776.d4a3b85fe-1",
                "vm": "win10-x64-browser",
                "vm_id": "sample_id"
            }
        }
    }
}

Human Readable Output

List of samples analysis

Filename	Magic	Md5	Sha1	Sha256	Size	Type
www.domain_example_.url	MS Windows 95 Internet shortcut text (URL=http:<span//</span>www.domain_example>), ASCII text	md5	sha1	sha256	45	url

threat-grid-analysis-network-streams-get

Returns data regarding a specific network stream

Base Command

threat-grid-analysis-network-streams-get

Input

Context Output

Command example

!threat-grid-analysis-network-streams-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "NetworkAnalysis": {
            "0": {
                "bytes": 657,
                "bytes_missed": 0,
                "bytes_orig": 657,
                "bytes_orig_payload": 601,
                "bytes_payload": 601,
                "bytes_resp": 0,
                "bytes_resp_payload": 0,
                "conn_state": "S0",
                "dst": "ThreatGrid_NetworkAnalysis_0_dst",
                "dst_port": 67,
                "duration": 0.000993,
                "history": "D",
                "packets": 2,
                "packets_orig": 2,
                "service": "dhcp",
                "session": 0,
                "src": "ThreatGrid_NetworkAnalysis_0_src",
                "src_port": 68,
                "transport": "UDP",
                "ts_begin": 1671624615.898952,
                "ts_end": 1671624615.899945,
                "uid": "id"
            },
            "1": {
                "bytes": 664,
                "bytes_missed": 0,
                "bytes_orig": 0,
                "bytes_orig_payload": 0,
                "bytes_payload": 608,
                "bytes_resp": 664,
                "bytes_resp_payload": 608,
                "conn_state": "SHR",
                "decoded": [
                    {
                        "client_ip": "ThreatGrid_NetworkAnalysis_1_decoded[0]_client_ip",
                        "client_mac": "00:15:17:22:da:4d",
                        "dns_servers": [
                            "ThreatGrid_NetworkAnalysis_1_decoded[0]_dns_servers_0"
                        ],
                        "lease_time": 1200,
                        "netmask": "ThreatGrid_NetworkAnalysis_1_decoded[0]_netmask",
                        "routers": [
                            "ThreatGrid_NetworkAnalysis_1_decoded[0]_routers_0"
                        ],
                        "server_ip": "ThreatGrid_NetworkAnalysis_1_decoded[0]_server_ip",
                        "type": "DHCP_ACK"
                    }
                ],
                "dst": "ThreatGrid_NetworkAnalysis_1_dst",
                "dst_port": 67,
                "duration": 0.000839,
                "history": "^d",
                "packets": 2,
                "packets_resp": 2,
                "protocol": "DHCP",
                "service": "dhcp",
                "session": 1,
                "src": "ThreatGrid_NetworkAnalysis_1_src",
                "src_port": 68,
                "transport": "UDP",
                "ts_begin": 1671624615.899514,
                "ts_end": 1671624615.900353,
                "uid": "CnmnL8FPcbmixXLv1"
            },

        }
    }
}

Human Readable Output

List of samples analysis

0	1
transport: UDP dst: dst uid: d bytes_missed: 0 src: ip1 ts_end: 1671624615.899945 dst_port: 67 packets_orig: 2 bytes_orig_payload: 601 bytes: 657 bytes_orig: 657 duration: 0.000993 history: D bytes_resp_payload: 0 conn_state: S0 service: dhcp session: 0 bytes_resp: 0 ts_begin: 1671624615.898952 packets: 2 src_port: 68 bytes_payload: 601	decoded: {‘client_ip’: ‘192.168.1.28’, ‘client_mac’: ‘00:15:17:22:da:4d’, ‘dns_servers’: [‘192.168.1.1’], ‘lease_time’: 1200, ‘netmask’: ‘255.255.255.0’, ‘routers’: [‘192.168.1.1’], ‘server_ip’: ‘192.168.1.1’, ‘type’: ‘DHCP_ACK’} transport: UDP protocol: DHCP dst: 192.168.1.1 uid: CnmnL8FPcbmixXLv1 bytes_missed: 0 src: 192.168.1.28 packets_resp: 2 ts_end: 1671624615.900353 dst_port: 67 bytes_orig_payload: 0 bytes: 664 bytes_orig: 0 duration: 0.000839 history: ^d bytes_resp_payload: 608 conn_state: SHR service: dhcp session: 1 bytes_resp: 664 ts_begin: 1671624615.899514 packets: 2 src_port: 68 bytes_payload: 608	transport: TCP dst: dst uid: CG18zQzbcnKMJ9rYh bytes_missed: 0 src: 192.168.1.28 packets_resp: 10 ts_end: 1671624761.8172178 dst_port: 443 packets_orig: 7 bytes_orig_payload: 581 bytes: 5965 bytes_orig: 873 duration: 26.85108 history: ShADadfr bytes_resp_payload: 4680 conn_state: RSTR service: ssl session: 10 bytes_resp: 5092 ts_begin: 1671624734.966138 packets: 17 src_port: 49670 bytes_payload: 5261	decoded: [{‘request_path’: ‘/’, ‘url’: ‘http://www.domain_example:80/’, ‘ts’: 1671624747.411076, ‘host’: ‘www.domain_example’, ‘method’: ‘GET’, ‘request_filename’: ‘http-www.domain_example-80-11-1’, ‘sha256’: ‘sha256’, ‘port’: 80, ‘type’: ‘request’, ‘version’: ‘1.1’, ‘body_len’: 0, ‘actual_content_type’: ‘application/x-empty’, ‘decoded_url’: ‘http://www.domain_example:80/’, ‘headers’: {‘accept’: ‘text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9’, ‘accept-encoding’: ‘gzip, deflate’, ‘accept-language’: ‘en-US,en;q=0.9’, ‘connection’: ‘keep-alive’, ‘host’: ‘www.domain_example’, ‘upgrade-insecure-requests’: ‘1’, ‘user-agent’: ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36’}}, {‘ts’: 1671624747.505528, ‘sha256’: ‘sha256’, ‘status_code’: 302, ‘status’: ‘Found’, ‘type’: ‘response’, ‘reported_content_type’: ‘text/html; charset=UTF-8’, ‘version’: ‘1.1’, ‘body_len’: 231, ‘actual_content_type’: ‘text/html’, ‘fuids’: [‘FwgsLG2izIyrPnv7n4’], ‘headers’: {‘server’: ‘gws’, ‘origin-trial’: ‘ot’, ‘content-type’: ‘text/html; charset=UTF-8’, ‘content-length’: ‘231’, ‘bfcache-opt-in’: ‘unload’, ‘permissions-policy’: ‘unload=()’, ‘x-frame-options’: ‘SAMEORIGIN’, ‘location’: ‘https://www.domain_example/?gws_rd=ssl’, ‘set-cookie’: [‘1P_JAR=2022-12-21-12; expires=Fri, 20-Jan-2023 12:12:27 GMT; path=/; domain=.domain_example; Secure; SameSite=none’, ‘x; expires=Mon, 19-Jun-2023 12:12:27 GMT; path=/; domain=.domain_example; Secure; HttpOnly; SameSite=lax’], ‘date’: ‘Wed, 21 Dec 2022 12:12:27 GMT’, ‘cross-origin-opener-policy-report-only’: ‘same-origin-allow-popups; report-to=”gws”’, ‘x-xss-protection’: ‘0’, ‘report-to’: ‘{“group”:”gws”,”max_age”:2592000,”endpoints”:[{“url”:”https://csp.withdomain_example/csp/report-to/gws/other”}]}’, ‘cache-control’: ‘private’}}] transport: TCP protocol: HTTP dst: dst uid: C1A2px82MwQLhxvg3 bytes_missed: 0 src: 192.168.1.28 packets_resp: 4 ts_end: 1671624747.7983232 dst_port: 80 packets_orig: 4 bytes_orig_payload: 433 bytes: 3345 bytes_orig: 617 duration: 6.859333 history: ShADad bytes_resp_payload: 1278 conn_state: S1 service: http session: 11 bytes_resp: 2728 ts_begin: 1671624740.93899 packets: 8 src_port: 49671 bytes_payload: 1711

threat-grid-analysis-processes-get

Returns data regarding the specific process id in the analysis

Base Command

threat-grid-analysis-processes-get

Input

Context Output

Command example

!threat-grid-analysis-processes-get sample_id=sample_id

Context Example

{
    "ThreatGrid": {
        "ProcessAnalysis": {
            "1": {
                "analyzed_because": "Process activity after target sample started.",
                "atoms_added": [
                    "Ud"
                ],
                "kpid": "uid",
                "monitored": true,
                "mutants_created": [
                    "er",
                ],
                "new": false,
                "parent": "",
                "pid": 1692,
                "ppid": 61,
                "proc": false,
                "process_name": "Explorer.EXE",
                "registry_keys_created": [
                    {
                        "access": [
                            "CREATE_SUB_KEY",
                            "READ_CONTROL",
                            "SET_VALUE"
                        ],
                        "name": "REGISTRY",
                        "options": [
                            "REG_OPTION_VOLATILE"
                        ]
                    }
                ],
                "registry_keys_deleted": [
                    "REGISTRY",
                    "REGISTRY",
                ],
                "registry_keys_modified": [
                    {
                        "data": "data",
                        "data_type": "BINARY",
                        "name": "REGISTRY",
                        "value_name": "VirtualDesktop"
                    }
                ],
                "startup_info": {
                    "command_line": "info",
                    "current_directory": "info",
                    "desktop_info": "info",
                    "image_pathname": "info",
                    "incomplete": false,
                    "runtime_data": "",
                    "shell_info": "info",
                    "tid": "id",
                    "upid": 1692,
                    "uthread": 0,
                    "window_title": "Microsoft.Windows.Explorer"
                },
                "threads": [
                    {
                        "client_id": "id",
                        "create_suspended": "0x0",
                        "process": "0x00000000",
                        "process_handle": "0xffffffff",
                        "return": 0,
                        "thread": "0x00000000"
                    },
                ],
                "time": "Wed, 21 Dec 2022 12:10:16 UTC"
            },
            "12": {
                "analyzed_because": "Parent is being analyzed",
                "files_checked": [
                    "-active.pma",
                    "-spare.pma"
                ],
                "files_created": [
                    "-active.pma",
                    ".pma~RF3e02b2be.TMP"
                ],
                "files_deleted": [
                    ".pma",
                    ".pma~RF3e02b2be.TMP"
                ],
                "kpid": "0xffffe00144f57080",
                "monitored": true,
                "new": true,
                "parent": "0xffffe0014409e680",
                "pid": 2680,
                "ppid": 9,
                "proc": false,
                "process_name": "chrome.exe",
                "startup_info": {
                    "command_line": "ThreatGrid_ProcessAnalysis_12_startup_info_command_line",
                    "current_directory": "D:\\",
                    "desktop_info": "info",
                    "image_pathname": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
                    "incomplete": false,
                    "runtime_data": "",
                    "shell_info": "",
                    "tid": "0xffffe00144f62400",
                    "upid": 2680,
                    "uthread": 0,
                    "window_title": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
                },
                "threads": [
                    {
                        "client_id": 6004801706494351000,
                        "create_suspended": "0x0",
                        "process": "0x00000000",
                        "process_handle": "0xffffffff",
                        "return": 0,
                        "thread": "0x00000000"
                    },
                    {
                        "client_id": 6071227511780497000,
                        "create_suspended": "0x0",
                        "process": "0x00000000",
                        "process_handle": "0xffffffff",
                        "return": 0,
                        "thread": "0x00000000"
                    }
                ],
                "time": "Wed, 21 Dec 2022 12:10:41 UTC"
            },
        }
    }
}

Human Readable Output

List of samples analysis

1	12
threads: {‘client_id’: “id”, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: “id”, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 39480025973576, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’} atoms_added: ImmersiveContextMenuArray_159288160-13, ImmersiveContextMenuArray_159288160-14, ImmersiveContextMenuArray_159288448-11, ImmersiveContextMenuArray_159288448-13, ImmersiveContextMenuArray_159288448-14, ImmersiveContextMenuArray_159288448-17, ImmersiveContextMenuArray_159288736-10, ImmersiveContextMenuArray_159288736-12, ImmersiveContextMenuArray_159288736-13, ImmersiveContextMenuArray_159288736-17, ImmersiveContextMenuArray_159288832-12, ImmersiveContextMenuArray_159288832-14, ImmersiveContextMenuArray_159288832-16, ImmersiveContextMenuArray_159288832-17, ImmersiveContextMenuArray_159289024-11, ImmersiveContextMenuArray_159289024-12, ImmersiveContextMenuArray_159289600-18, ImmersiveContextMenuArray_159289696-17, ImmersiveContextMenuArray_159289696-18, ImmersiveContextMenuArray_159289888-16, ImmersiveContextMenuArray_159289888-18, ImmersiveContextMenuArray_159289984-15, ImmersiveContextMenuArray_4294967295, ImmersiveContextMenuArray_60889232-10, ImmersiveContextMenuArray_60889232-8, ImmersiveContextMenuArray_60889232-9, ImmersiveContextMenuArray_60890192-11, ImmersiveContextMenuArray_60890192-7, ImmersiveContextMenuArray_60890192-8, ImmersiveContextMenuArray_60890192-9, ImmersiveContextMenuArray_60891440-11, ImmersiveContextMenuArray_60891440-12, ImmersiveContextMenuArray_60891440-7, ImmersiveContextMenuArray_60891440-9, ImmersiveContextMenuArray_60891728-10, ImmersiveContextMenuArray_60891728-6, ImmersiveContextMenuArray_60891728-9, ImmersiveContextMenuArray_60891824-5, ImmersiveContextMenuArray_60891824-6, ImmersiveContextMenuArray_60891824-7, ImmersiveContextMenuArray_60891824-8, ImmersiveContextMenuArray_60891920-4, ImmersiveContextMenuArray_60891920-5, ImmersiveContextMenuArray_60891920-6, ImmersiveContextMenuArray_60891920-7, ImmersiveContextMenuArray_61294096-3, ImmersiveContextMenuArray_61294096-4, ImmersiveContextMenuArray_61294096-6, ImmersiveContextMenuArray_61295440-2, ImmersiveContextMenuArray_61295440-3, ImmersiveContextMenuArray_61295440-5, ImmersiveContextMenuArray_61295824-131233, ImmersiveContextMenuArray_61295824-2, ImmersiveContextMenuArray_61295824-4, ImmersiveContextMenuArray_61295824-5, ImmersiveContextMenuArray_61441088-1, ImmersiveContextMenuArray_61441088-4001, ImmersiveContextMenuArray_61441280-4002, ImmersiveContextMenuArray_61441568-2, ImmersiveContextMenuArray_61441856-4003, ImmersiveContextMenuArray_61441952-131233, ImmersiveContextMenuArray_61442144-4001, ImmersiveContextMenuArray_61442432-4002, ImmersiveContextMenuArray_61442528-4000, ImmersiveContextMenuArray_61442624-4000, ImmersiveContextMenuArray_61442720-1, ImmersiveContextMenuArray_61443008-1, ImmersiveContextMenuArray_61443008-4002, ImmersiveContextMenuArray_61443296-131233, ImmersiveContextMenuArray_61443296-4001, ImmersiveContextMenuArray_61443776-4000, ImmersiveContextMenuArray_61443968-1, ImmersiveContextMenuArray_61443968-4003, ImmersiveContextMenuArray_61444064-4002, ImmersiveContextMenuArray_61444160-4001, ImmersiveContextMenuArray_61444256-3, ImmersiveContextMenuArray_61444256-4000, ImmersiveContextMenuArray_61444448-2, ImmersiveContextMenuArray_61444736-131233, ImmersiveContextMenuArray_61444832-4003, TrayRaisedWindowProp, uia analyzed_because: Process activity after target sample started. registry_keys_created: {‘access’: [‘CREATE_SUB_KEY’, ‘READ_CONTROL’, ‘SET_VALUE’], ‘name’: ‘REGISTRY\USER\S-1-5-21-3467368655-986044752-3166994390-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\APPLICATIONVIEWMANAGEMENT\W32:000000000006013C’, ‘options’: [‘REG_OPTION_VOLATILE’]} monitored: true parent: new: false mutants_created: Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer, Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer pid: 1692 kpid: uid ppid: 61 time: Wed, 21 Dec 2022 12:10:16 UTC registry_keys_deleted: REGISTRY\USER\S-1-5-21-3467368655-986044752-3166994390-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\APPLICATIONVIEWMANAGEMENT\W32:00000000000A0232, REGISTRY\USER\S-1-5-21-3467368655-986044752-3166994390-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\APPLICATIONVIEWMANAGEMENT\W32:0000000000100036, REGISTRY\USER\S-1-5-21-3467368655-986044752-3166994390-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\HOMEGROUP\UISTATUSCACHE proc: false process_name: Explorer.EXE registry_keys_modified: {‘data’: ‘EAAAADAwRFb0BwKtsB1qQ5DP0vmf3UYC’, ‘data_type’: ‘BINARY’, ‘name’: ‘REGISTRY\USER\S-1-5-21-3467368655-986044752-3166994390-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\APPLICATIONVIEWMANAGEMENT\W32:000000000006013C’, ‘value_name’: ‘VirtualDesktop’}	files_checked: \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma, \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma files_deleted: \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma, \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3e02b2be.TMP threads: {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 0, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 18375121096688828000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 18375121096688828000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6071227511780497000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6071227511780497000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’} analyzed_because: Parent is being analyzed files_created: \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma, \Users\Administrator\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3e02b2be.TMP monitored: true parent: 0xffffe0014409e680 new: true pid: 2680 kpid: 0xffffe00144f57080 ppid: 9 time: Wed, 21 Dec 2022 12:10:41 UTC proc: false process_name: chrome.exe	threads: {‘client_id’: 7820861427712559000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 7820861427712559000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 7820861427712559000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 7820861427712559000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 7820861427712559000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’} analyzed_because: Process activity after target sample started. monitored: true parent: new: false pid: 840 kpid: 0xffffe0014497a840 ppid: 52 time: Wed, 21 Dec 2022 12:10:42 UTC proc: false process_name: svchost.exe	analyzed_because: Process activity after target sample started. monitored: true parent: new: false pid: 236 kpid: 0xffffe001434ea080 ppid: null time: Wed, 21 Dec 2022 12:10:47 UTC proc: false process_name: svchost.exe	analyzed_because: Process activity after target sample started. monitored: true parent: new: false pid: 1284 kpid: 0xffffe00144a89840 ppid: 52 time: Wed, 21 Dec 2022 12:10:48 UTC proc: false process_name: svchost.exe	analyzed_because: Process activity after target sample started. files_created: \Device\NamedPipe\Sessions\1\AppContainerNamedObjects\S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742 monitored: true parent: new: false pid: 580 kpid: 0xffffe0014486e340 ppid: 52 time: Wed, 21 Dec 2022 12:10:48 UTC proc: false process_name: svchost.exe	analyzed_because: Process activity after target sample started. monitored: true parent: new: false sockets: {‘file_handle’: ‘0x954’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624708.7818744}, {‘file_handle’: ‘0x9c0’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624708.830168}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624714.8858435}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624781.8725078}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624792.5076175}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624814.9515114}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624821.0024314}, {‘file_handle’: ‘0x98c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624825.1760237}, {‘file_handle’: ‘0x968’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624835.1903608}, {‘file_handle’: ‘0x95c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624835.7948673}, {‘file_handle’: ‘0x95c’, ‘protocol’: ‘0’, ‘state’: 1, ‘states’: [], ‘timestamp’: 1671624858.605007} pid: 1100 kpid: 0xffffe00144cf1080 ppid: 52 time: Wed, 21 Dec 2022 12:10:52 UTC proc: false process_name: svchost.exe	files_checked: \Program Files\Google\Chrome\Application\88.0.4324.104\SwiftShader.ini threads: {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 0, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0x80000b48’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 6004801706494351000, ‘create_suspended’: ‘0x0’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0xffffffff’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 8397322214375721000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0x80000984’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 8397322214375721000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0x80000b40’, ‘return’: 0, ‘thread’: ‘0x00000000’}, {‘client_id’: 8397322214375721000, ‘create_suspended’: ‘0x1’, ‘process’: ‘0x00000000’, ‘process_handle’: ‘0x80000b40’, ‘return’: 0, ‘thread’: ‘0x00000000’} atoms_added: D3D9_IdHot_Ctrl_SnapDesktop analyzed_because: Parent is being analyzed monitored: true parent: 0xffffe0014409e680 new: true pid: 2296 kpid: 0xffffe0014444a840 ppid: 9 time: Wed, 21 Dec 2022 12:10:54 UTC proc: false process_name: chrome.exe

file

Checks the file reputation of the specified hash.

Base Command

file

Input

Context Output

ip

Checks the reputation of an IP address.

Base Command

ip

Input

Context Output

url

Checks the reputation of a URL.

Base Command

url

Input

Context Output

domain

Checks the reputation of a domain.

Base Command

domain

Input

Context Output

threat-grid-domain-samples-list

Returns a list of samples associated with a Domain.

Base Command

threat-grid-domain-samples-list

Input

Context Output

Command example

!threat-grid-domain-samples-list domain=domain_example

Context Example

{
    "ThreatGrid": {
        "DomainAssociatedSample": {
            "domain": "domain_example",
            "samples": [
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "domain_example_.url",
                    "iocs": [],
                    "login": "login_name",
                    "owner": "self",
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_example",
                    "timestamp": "ThreatGrid_DomainAssociatedSample_samples[0]_timestamp"
                },
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "file_name",
                    "iocs": [],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_e",
                    "timestamp": "ThreatGrid_DomainAssociatedSample_samples[1]_timestamp"
                },
            ]
        }
    }
}

Human Readable Output

List of samples associated to the domain - domain_example

Showing page 1.
Current page size: 50

Filename	Login	Private	Sample	Sha256	Timestamp
domain_example_.url	login_name	false	sample_e	sha256_example	2022-12-22T08:30:57Z
file_name		false	sample_e	sha256_e	2022-12-22T08:29:38Z

threat-grid-ip-samples-list

Returns a list of samples associated with an IP.

Base Command

threat-grid-ip-samples-list

Input

Context Output

Command example

!threat-grid-ip-samples-list ip=8.8.8.8

Context Example

{
    "ThreatGrid": {
        "IpAssociatedSample": {
            "ip": "ThreatGrid_IpAssociatedSample_ip",
            "samples": [
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "filename",
                    "iocs": [
                        {
                            "confidence": 60,
                            "ioc": "pe-header-linker-major",
                            "sample": "sample_e",
                            "severity": 5
                        }
                    ],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_e",
                    "timestamp": "ThreatGrid_IpAssociatedSample_samples[0]_timestamp"
                },
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "file_name",
                    "iocs": [
                        {
                            "confidence": 50,
                            "ioc": "file-ini-read",
                            "sample": "sample_e",
                            "severity": 30
                        },
                        {
                            "confidence": 60,
                            "ioc": "pe-resource-lang-romanian",
                            "sample": "sample_e",
                            "severity": 25
                        },
                        {
                            "confidence": 50,
                            "ioc": "network-fast-flux-nameserver",
                            "sample": "sample_e",
                            "severity": 35
                        }
                    ],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_e",
                    "timestamp": "ThreatGrid_IpAssociatedSample_samples[1]_timestamp"
                },

            ]
        }
    }
}

Human Readable Output

List of samples associated to the ip - 8.8.8.8

Showing page 1.
Current page size: 50

Filename	Login	Private	Sample	Sha256	Timestamp
filename		false	sample_e	sha256_e	2022-12-22T08:09:30Z
file_name		false	sample_e	sha256_e	2022-12-22T08:07:40Z

threat-grid-path-samples-list

Returns a list of samples associated with a Path.

Base Command

threat-grid-path-samples-list

Input

Context Output

Command example

!threat-grid-path-samples-list path=user

Context Example

{
    "ThreatGrid": {
        "PathAssociatedSample": {
            "path": "user",
            "samples": [
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "user",
                    "iocs": [
                        {
                            "confidence": 100,
                            "ioc": "html-script-prefix-suffix",
                            "sample": "sample_e",
                            "severity": 85
                        }
                    ],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_e",
                    "timestamp": "ThreatGrid_PathAssociatedSample_samples[0]_timestamp"
                },
                {
                    "details": "/api/v2/samples/sample_e",
                    "filename": "file_name",
                    "iocs": [
                        {
                            "confidence": 85,
                            "ioc": "pe-invalid-certificate-signature",
                            "sample": "sample_e",
                            "severity": 100
                        },
                        {
                            "confidence": 100,
                            "ioc": "pe-certificate",
                            "sample": "sample_e",
                            "severity": 10
                        }
                    ],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_e",
                    "sha256": "sha256_e",
                    "timestamp": "ThreatGrid_PathAssociatedSample_samples[1]_timestamp"
                },
            ]
        }
    }
}

Human Readable Output

List of samples associated to the path - user

Showing page 1.
Current page size: 50

Filename	Login	Private	Sample	Sha256	Timestamp
user		false	sample_e	sha256_e	2022-11-11T08:26:04Z
file_name		false	sample_e	sha256_e	2022-10-30T13:09:35Z

threat-grid-url-samples-list

Returns a list of samples associated with an URL.

Base Command

threat-grid-url-samples-list

Input

Context Output

Command example

!threat-grid-url-samples-list url=http://domain_example:80/

Context Example

{
    "ThreatGrid": {
        "UrlAssociatedSample": {
            "samples": [
                {
                    "details": "/api/v2/samples/sample_id",
                    "filename": "file_name",
                    "iocs": [
                        {
                            "confidence": 25,
                            "ioc": "network-communications-http-get-url",
                            "sample": "sample_id",
                            "severity": 25
                        }
                    ],
                    "login": "login_name",
                    "owner": "self",
                    "private": false,
                    "relation": null,
                    "sample": "sample_id",
                    "sha256": "sha256_example",
                    "timestamp": "ThreatGrid_UrlAssociatedSample_samples[0]_timestamp"
                },
                {
                    "details": "/api/v2/samples/sample_id",
                    "filename": "file_name",
                    "iocs": [
                        {
                            "confidence": 90,
                            "ioc": "pe-uses-stealth-packer",
                            "sample": "sample_id",
                            "severity": 90
                        }
                    ],
                    "login": null,
                    "owner": null,
                    "private": false,
                    "relation": null,
                    "sample": "sample_id",
                    "sha256": "sha256_example",
                    "timestamp": "ThreatGrid_UrlAssociatedSample_samples[1]_timestamp"
                },
            ],
            "sha256": "sha256_example",
            "url": "ThreatGrid_UrlAssociatedSample_url"
        }
    }
}

Human Readable Output

List of samples associated to the url - sha256_example

Showing page 1.
Current page size: 50

Filename	Login	Private	Sample	Sha256	Timestamp
domain_example_.url	login_name	false	sample_id	sha256_example	2022-12-22T08:36:44Z
file_name		false	sample_id	sha256_example	2022-12-22T08:35:03Z
file_name		false	sample_id	sha256_example	2022-12-22T08:35:03Z
domain_example_.url	login_name	false	sample_e	sha256_example	2022-12-22T08:30:57Z

threat-grid-registry-key-samples-list

Returns a list of samples associated with a specified registry key.

Base Command

threat-grid-registry-key-samples-list

Input

Context Output

Command example

!threat-grid-registry-key-samples-list registry_key=ChangeNotice

Context Example

{
    "ThreatGrid": {
        "RegistryKeyAssociatedSample": {
            "key": "ChangeNotice",
            "samples": []
        }
    }
}

Human Readable Output

List of samples associated to the registry_key - ChangeNotice

Showing page 1.
Current page size: 50
No entries.

threat-grid-ip-associated-domains

Returns a list of domains associated with the IP.

Base Command

threat-grid-ip-associated-domains

Input

Context Output

Command example

!threat-grid-ip-associated-domains ip=8.8.8.8

Context Example

{
    "ThreatGrid": {
        "IpAssociatedDomain": {
            "domains": [
                {
                    "details": "/api/v2/domains/domain",
                    "domain": "domain"
                },
                {
                    "details": "/api/v2/domains/domain",
                    "domain": "domain"
                },
            ],
            "ip": "ThreatGrid_IpAssociatedDomain_ip"
        }
    }
}